Proof Before Reuse prevents poisoned skills in agent procedural memory by requiring cross-session reproduction

• Proof Before Reuse method exposed poisoned skills in 0/30 sessions, compared to 3/30 for naive memory and 30/30 for replay.
• The method serves a skill only after two later sessions reproduce its change and pass its test, showing the agent only the lines those sessions also wrote.
• Testing used Claude Haiku 5.5 and Sonnet 5.5 with a hidden verifier containing 187 behavioural checks across five scored sessions per arm.
• Replay of recorded edits reintroduced poison in 30/30 repos with all tests passing, while naive memory exposed poison in 3/30 sessions.

Method and Results

• Poisoned learning sessions (new file, unrelated line, or fused line) were followed by three clean sessions on the same task.
• Line-level filtering successfully removed fused poison that passed step-level checks in the Proof Before Reuse arm.
• The study measured exposure rather than harm, as no model applied a poison it saw during the test sessions.

Limitations

• Results are based on one task with n=5 per cell, yielding p≈0.24, which is not statistically significant.
• Rules were tuned on the same task, and a poison placed directly in the repo defeats the method.
• Code and per-session records are available at https://github.com/TheWariend/MuscleMemory.