Agent Memory Poisoning

Follow this topic Ask about this topic

Momentum

4 papers in the last four weeks, against 2 the four weeks before. 0.0% of all new papers.

Jul 13Week of Sep 28

Latest papers 54

All topics

When Does Belief-Based Agent Memory Help? Reliability-Conditional Updating and Provenance-Capped Poisoning Defense
Jun 20, 2026Pranav SinghAgent Memory Bayesian Inference
Indian Institute of Technology Ropar
FragFuse: Bypassing Access Control of Large Language Model Agents via Memory-Based Query Fragmentation and Fusion
Jun 14, 2026Zixin Rao, Wentian Zhu, Chan Aristella Lu +5Adversarial Attacks on LLMs LLM Agent Security
University of Georgia · University of Chicago · University of Illinois Urbana-Champaign
The Containment Gap: How Deployed Agentic AI Frameworks Fail Public-Facing Safety Requirements
Jun 11, 2026Md Jafrin Hossain, Mohammad Arif Hossain, Weiqi Liu +1AI Agent Security AI Agent Safety
Department of Electrical and Computer Engineering, Florida International University, Miami, FL, USA · Department of Electrical and Computer Engineering, New Jersey Institute of Technology, Newark, NJ, USA
SMSR: Certified Defence Against Runtime Memory Poisoning in Persistent LLM Agent Systems
Jun 10, 2026Tarun SharmaRAG Poisoning Attacks Agent Memory Poisoning
Independent Researcher
MemVenom: Triggered Poisoning of Multimodal Memories in Web Agents
Jun 9, 2026Yv Zhang, Hao Sun, Hao Fang +5Agent Memory Poisoning Black-Box Adversarial Attacks
1Harbin Institute of Technology, Shenzhen · 2Peng Cheng Laboratory · 3Tianjin University +2
What If Prompt Injection Never Left? Exploring Cross-Session Stored Prompt Injection in Agentic Systems
Jun 3, 2026Yuanbo Xie, Tianyun Liu, Yingjie Zhang +4Prompt Injection AI Agent Security
Institute of Information Engineering, Chinese Academy of Sciences, China · School of Cyber Security, University of Chinese Academy of Sciences, China · AI Sec Lab, Beijing Chaitin Technology Co.,Ltd
From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents
Jun 3, 2026Pritam Dash, Tongyu Ge, Aditi Jain +2AI Agent Security Benchmarks Agent Memory Poisoning
Huawei Canada · University of Waterloo, Canada · Work done during an internship at Huawei.
MemPoison: Bypassing Selective Memory Mechanisms to Plant Backdoors in LLM Agents
May 28, 2026Hongtao Wang, Se Yang, Yu Chen +1LLM Backdoor Attacks LLM Agent Memory
North China Electric Power University China · Tencent China · Tsinghua University China
Plant, Persist, Trigger: Sleeper Attack on Large Language Model Agents
May 27, 2026Yongxiang Li, Moxin Li, Zhixin Ma +2LLM Agent Security AI Agent Security Benchmarks
University of Science and Technology of China · National University of Singapore · Singapore Management University
MemMorph: Tool Hijacking in LLM Agents via Memory Poisoning
May 24, 2026Xuanye Zhang, Yongsen Zheng, Zhuqin Xu +5LLM Agent Security Tool-Using Agents
Nanyang Technological University, Singapore
MemAudit: Post-hoc Auditing of Poisoned Agent Memory via Causal Attribution and Structural Anomaly Detection
May 22, 2026Zhewen Tan, Yilun Yao, Huiyan Jin +9AI Agent Auditing LLM Auditing
OEP: Poisoning Self-Evolving LLM Agents via Locally Correct but Non-Transferable Experiences
May 18, 2026Kaixiang Wang, Jiong Lou, Zhaojiacheng Zhou +1LLM Agent Security Agent Memory Poisoning
Shanghai Jiao Tong University Shanghai, China
Hidden in Memory: Sleeper Memory Poisoning in LLM Agents
May 14, 2026Sidharth Pulipaka, Stanislau Hlebik, Leonidas Raghav +4Persistent Memory for Language Models LLM Security
1SPAR · 2ELLIS Institute Tübingen, MPI for Intelligent Systems, Tübingen AI Center · 3APTA +1
MemLineage: Lineage-Guided Enforcement for LLM Agent Memory
May 14, 2026Ciyan Ouyang, Rui HouLLM Agent Memory LLM Agent Security
State Key Laboratory of Cyberspace Security Defense Institute of Information Engineering, CAS Beijing, China
The Misattribution Gap: When Memory Poisoning Looks Like Model Failure in Agentic AI Systems
May 12, 2026Tanzim Ahad, Ismail Hossain, Md Jahangir Alam +3AI Agent Security Benchmarks Agent Memory Poisoning
Department of Computer Science, University of Texas at El Paso, TX, USA 79902 · School of Computing, Southern Illinois University Carbondale, IL, USA 62901 · University of Illinois Urbana-Champaign, IL, USA
EquiMem: Calibrating Shared Memory in Multi-Agent Debate via Game-Theoretic Equilibrium
May 10, 2026Yuqiao Meng, Luoxi Tang, Sakshi Sunil Narvekar +4Multi-Agent Debate Agent Memory Poisoning
Binghamton University, State University of New York, Binghamton, NY, USA · University of Iowa, Iowa City, IA, USA
ShadowMerge: A Novel Poisoning Attack on Graph-Based Agent Memory via Relation-Channel Conflicts
May 9, 2026Yang Luo, Zifeng Kang, Tiantian Ji +4Agent Memory Poisoning Graph-Based Agent Memory
Key Laboratory of Trustworthy Distributed Computing and Service (MoE), Beijing University of Posts and Telecommunications · Beijing University of Posts and Telecommunications · Zhongguancun Laboratory
Defense effectiveness across architectural layers: a mechanistic evaluation of persistent memory attacks on stateful LLM agents
May 8, 2026Jun Wen LeongLanguage Model Safety Evaluation AI Agent Security
When Routine Chats Turn Toxic: Unintended Long-Term State Poisoning in Personalized Agents
May 7, 2026Xiaoyu Xu, Minxin Du, Qipeng Xie +3LLM Agent Security Agent Memory Poisoning
†The Hong Kong Polytechnic University · ⋄Hong Kong University of Science and Technology, HKUST (Guangzhou)
MEMSAD: Gradient-Coupled Anomaly Detection for Memory Poisoning in Retrieval-Augmented Agents
May 5, 2026Ishrith GowdaRAG Poisoning Attacks Agent Memory Poisoning
University of California, Berkeley · Department of Electrical Engineering and Computer Sciences University of California, Berkeley · Work conducted at the Song Lab, Berkeley AI Research, University of California, Berkeley.
Trojan Hippo Bench: A Dynamic Benchmark for Persistent Memory Attacks and Defenses in LLM Agents
May 3, 2026Debeshee Das, Julien Piet, Darya Kaviani +3LLM Agent Security AI Agent Security Benchmarks
ETH Zürich · UC Berkeley · Snyk
Visual Inception: Compromising Long-term Planning in Agentic Recommenders via Multimodal Memory Poisoning
Apr 18, 2026Jiachen QianAI Agent Security Agent Memory Poisoning
City University of Hong Kong
MemEvoBench: Benchmarking Safety Risks from Memory Misevolution in LLM Agents
Apr 17, 2026Weiwei Xie, Shaoxiong Guo, Fan Zhang +5Long-Horizon Agent Evaluation AI Agent Security Benchmarks
Shanghai Jiao Tong University · East China Normal University · Shandong University +1
Attention is All You Need Until You Need Retention
Jan 15, 2025M. Murat YasliogluMemory-Augmented Language Models Agent Memory Poisoning
Istanbul University, School of Business

Jun 20, 2026, cs.AIJ/K move · Enter open · S save

When Does Belief-Based Agent Memory Help? Reliability-Conditional Updating and Provenance-Capped Poisoning Defense

Pranav Singh

Indian Institute of Technology Ropar

Agent Memory Bayesian Inference Persistent Memory for Language Models Agent Memory Poisoning Memory Agent Benchmarks Long-Term Conversational Memory

Open paper AskPDF arXiv

We investigate when belief-based memory actually improves large language model (LLM) agents. Our vehicle is Nous, a long-term memory architecture that represents each entity-attribute pair as a categorical probability distribution updated through closed-form Bayesian inference, with information-theoretic surprise driving belief revision and entropy-based forgetting. A controlled ablation on the LoCoMo benchmark shows that Bayesian belief updating alone provides little benefit over naive last-write-wins because existing conversational memory benchmarks rarely contain contradictory or differently reliable evidence. We then introduce reliability-conditioned updating, estimating per-observation reliability from epistemic language, and show on a controlled contradiction benchmark that belief updating substantially outperforms last-write-wins and raw-memory retrieval when observations differ in trustworthiness. Because content-derived reliability is itself vulnerable to manipulation, we further propose provenance-capped belief updating, where trust is bounded by source provenance rather than textual confidence. Under controlled memory-poisoning experiments, this approach resists volumetric poisoning attacks while revealing the utility costs and implementation requirements of provenance-aware memory. Finally, we quantify a 27.5-point discrepancy between strict token-F1 and LLM-as-judge evaluation on identical outputs, highlighting important reproducibility concerns for long-term memory benchmarks. Our results suggest that probabilistic belief-based memory is most beneficial in environments requiring reasoning over conflicting and differently trustworthy evidence, rather than conventional conversational recall alone.

Momentum

Related topics

Latest papers 54