Search papers, labs, and topics across Lattice.
This paper introduces MemPoison, a benchmark and analysis framework designed to identify and evaluate persistent memory vulnerabilities in LLM agents, revealing how adversarial content can be injected and retained across interactions. The study categorizes attacks into three tiers of corruption, demonstrating that while existing defenses can mitigate direct single-record attacks, they are ineffective against more complex multi-record and dormant corruption strategies. The findings highlight critical blind spots in current memory defense mechanisms, suggesting a need for adaptive, context-sensitive approaches to enhance security in LLMs.
Existing memory defenses fail to protect against complex adversarial attacks, exposing LLMs to persistent vulnerabilities that can distort behavior over time.
Persistent external memory enhances agent continuity but introduces persistent security vulnerabilities: adversarial content can be injected via standard interaction channels, retained across turns, and later distort downstream behavior. To address this challenge, we propose MemPoison, a comprehensive benchmark and analysis framework featuring 1227 hand-validated cases across four attack types, three injection channels, and three representative memory substrates, evaluated on seven open-weight and three closed-weight model families. We introduce a three-tier taxonomy: (L1) direct single-record corruption, (L2) compositional multi-record corruption and (L3) context-triggered dormant corruption. Our evaluations reveal a distinct defense frontier: while baseline write-time defenses, such as consistency checks, substantially suppress direct L1 attacks, they fail to reliably suppress L2 and L3 attacks. Through mechanistic influence decomposition (MID), we demonstrate structural blind spots in write-time defenses, which admit seemingly benign records that later become harmful through joint retrieval composition or trigger-conditioned activation. Our findings advocate for shifting from static filtering to adaptive, context-sensitive memory defense strategies.
