Search papers, labs, and topics across Lattice.
This paper identifies a critical vulnerability in LLM agents that utilize long-term memory (LTM) by demonstrating how a malicious tool can exploit the tool interface to extract private user data, despite existing memory isolation defenses. The authors introduce SPORE, a novel extraction attack that enhances retrieval precision by decoupling adversarial commands from memory anchors, allowing for systematic exploration of memory regions. The attack achieves an impressive 80.0% extraction rate with unlimited triggers, revealing that current isolation strategies are inadequate for safeguarding user privacy in multi-user environments.
Memory isolation fails to protect user data in LLM agents, as demonstrated by the SPORE attack, which achieves an 80% extraction rate even with limited triggers.
LLM-based agents extend large language models with long-term memory (LTM) that persists privacy-sensitive user data across sessions. Production systems mitigate extraction risks through memory isolation, binding each user's LTM to a unique identifier. This defense has blocked known attacks on shared storage, fostering the assumption that isolated LTM is secure. We identify the tool interface as an overlooked attack surface. Agents routinely embed LTM-retrieved data in tool invocation parameters, enabling a malicious tool to exfiltrate private memory without violating user-level isolation. Naive adaptations of user-side extraction techniques fail because the adversarial command's semantics interfere with retrieval precision, and platform-imposed tool-call limits constrain the extraction budget per trigger. We present SPORE, the first extraction attack designed for this threat model. SPORE decouples the adversarial command from retrieval anchors by persisting the command in short-term memory and emitting semantically pure anchors in tool responses. The restored retrieval precision enables a geometric coverage optimization over the embedding space that systematically steers anchors toward unexplored memory regions. To sustain extraction beyond tool-call limits, SPORE persists reactivation payloads in memory that automatically resume the attack within and across sessions without additional user triggers. SPORE achieves an 80.0% record extraction rate with unlimited triggers and 47.0% with only 20 triggers. In multi-user deployments, attackers can link extracted records to user identities, enabling targeted surveillance. These results demonstrate that memory isolation alone is insufficient and call for reexamining tool-side trust boundaries in agent architectures.
