Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper addresses the vulnerability of retrieval-augmented generation (RAG) agents to Multi-Session Memory Poisoning (MSMP), where adversaries can inject malicious memories that influence future responses without altering model weights. The authors introduce Signed Memory with Smoothed Retrieval (SMSR), a novel defense mechanism that combines HMAC-SHA256 provenance tracking and randomized memory ablation to provide certified robustness against such attacks. Experimental results show that SMSR effectively reduces attack success rates from as high as 100% to as low as 5.3% in various scenarios, demonstrating its efficacy in safeguarding persistent memory systems in LLM agents.
A new defense mechanism cuts Multi-Session Memory Poisoning attack success from nearly total to just 5.3%, proving that certified robustness is achievable in persistent LLM systems.
Retrieval-augmented generation (RAG) agents increasingly run with persistent memory that accumulates across user sessions. This creates a new attack surface: an adversary interacting only through normal channels can inject crafted memories that, once retrieved, steer the agent's responses for future users, without touching model weights or code. We call this Multi-Session Memory Poisoning (MSMP) and show that no existing defence certifies against it; static-corpus defences (RobustRAG, ReliabilityRAG) assume a fixed knowledge base, and heuristic filters are bypassed by fluent enterprise-style text. We present Signed Memory with Smoothed Retrieval (SMSR), the first defence with a certified robustness bound for this setting. Component 1 adds HMAC-SHA256 provenance at write time, blocking unsigned injection. Component 2 applies randomised memory ablation with verdict-based majority voting at query time, bounding the influence of authenticated adversaries. We prove that no provenance-free retrieval-time filter can certify against adaptive injection, derive a hypergeometric certificate for Component 2, and formalise the Consistent Minority Effect, whereby a consistent adversarial answer wins string-based voting as a numerical minority while verdict-based voting removes it. Across 15 enterprise scenarios (3,150 repeated trials), Component 1 cuts attack success from 93-100% to 0% for all unsigned variants. For an authenticated adversary with a single injection, Component 2 holds success to 8.0% (95% CI [5.8, 10.9], n=450), below the certified worst case. In an end-to-end query-only attack where the agent itself writes the poison rather than it being pre-seeded, SMSR reduces success from 65.3% to 5.3% (n=150, non-overlapping CIs) on a live agent stack. Clean-query utility is 90% (Component 1) and 85% (combined).