# INP-09 Memory and retrieval injection defense (Critical)

Domain: INP Input & Prompt Security · HI-AAF v1.3 · Public review · https://humanintel.net/standard/inp/inp-09

Content retrieved from agent memory, vector stores, embedding indexes, and RAG sources is treated as untrusted data. Instructions discovered in retrieved content are not executed without trust-boundary confirmation.

Content retrieved from agent memory, vector stores, embedding indexes, and RAG sources is treated as untrusted data under INP-02. Instructions discovered in retrieved content are not executed without trust-boundary confirmation per INP-03. Memory poisoning is included in red-team coverage under SPC-03. This control addresses the growing attack surface of persistent and session-scoped memory.

Critical control: a Critical failure precludes HI-AAF Certification regardless of the maturity level achieved on any other control.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for INP-09: All retrieval paths (memory, vector stores, RAG) apply untrusted-data handling; memory poisoning is covered in the most recent red-team assessment; injection attempts in retrieved content are logged and surfaced to the human review queue.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- All retrieval paths (memory, vector stores, RAG) apply untrusted-data handling.
- Memory poisoning is covered in the most recent red-team assessment.
- Injection attempts in retrieved content are logged and surfaced to the human review queue.

## Framework mappings

- OWASP LLM Top 10: LLM01, LLM07
- EU AI Act: Art. 15(4)
- MITRE ATLAS: Initial Access
- Singapore: MAIGF Security, AI Verify Security

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Related

- Cites SPC-03 Adversarial assessment: https://humanintel.net/standard/spc/spc-03
- Cites INP-02 Indirect prompt injection defense: https://humanintel.net/standard/inp/inp-02
- Cites INP-03 Trust boundary enforcement: https://humanintel.net/standard/inp/inp-03
- Cited by SPC-03 Adversarial assessment: https://humanintel.net/standard/spc/spc-03

## Cite this control

Human Intelligence. HI-AAF v1.3, INP-09 Memory and retrieval injection defense. Public review edition, July 2026. https://humanintel.net/standard/inp/inp-09