Search papers, labs, and topics across Lattice.
This paper addresses the vulnerability of LLM agents to indirect memory poisoning, where untrusted external content can influence future decisions through long-term memory. The authors introduce \textsc{PipePoison}, an end-to-end optimization framework that leverages feedback from local shadow systems to optimize the multi-stage pipeline of memory writing, retrieval, and utilization. Their approach significantly improves the attack utilization rate by 19.1 percentage points across various agent frameworks and memory mechanisms, demonstrating robustness even against unseen configurations and multiple defenses.
Indirect memory poisoning can be effectively optimized through a novel end-to-end approach, boosting attack success rates significantly even against robust defenses.
Long-term memory can turn untrusted external content into persistent influence over an LLM agent's future decisions, creating the threat of indirect memory poisoning. A successful attack must survive a multi-stage pipeline comprising memory writing, retrieval, and utilization. Existing attacks largely rely on intra-stage optimization, optimizing individual stages in isolation while overlooking inter-stage coupling. Specifically, these stages impose different requirements on the same poisoning content, and each stage operates on the transformed output of its predecessor. Consequently, optimizing one stage may undermine the effectiveness of other stages, while upstream transformations may erase improvements intended for downstream stages. Indirect memory poisoning should therefore be viewed as an end-to-end optimization problem. Based on this insight, we present \textsc{PipePoison}, which collects fine-grained stage feedback from local shadow systems, uses chain-structured losses to identify and optimize the stage bottlenecking end-to-end success, and applies stability-calibrated stage and configuration weights to improve transferability. Across three agent frameworks and four memory mechanisms, \textsc{PipePoison} improves attack utilization rate by 19.1 percentage points. Even on fully unseen victim configurations, it outperforms the strongest baseline by 16 percentage points and remains effective under eight representative defenses.
