Agent Memory Poisoning

Follow this topic Ask about this topic

Agent memory poisoning examines how misleading or malicious information enters an AI agent’s persistent memory and shapes behavior across later tasks or sessions. Attacks can exploit external content, memory updates, retrieval, consolidation, multimodal inputs, or sharing between agents, sometimes steering tool use long after the original exposure. Defenses include provenance tracking, source-trust limits, write-time anomaly checks, retrieval-time controls, cryptographic lineage, and selective auditing or rollback; benchmarks increasingly test persistence, downstream effects, and repair. A central challenge is distinguishing harmful content from useful but untrusted evidence: static filters can miss attacks assembled across records or activated by context, while stricter controls can block legitimate learning and adaptation.

Latest papers

79 papers12 papers in the last four weeks, up 140% on the four weeks before. 0.1% of all new papers.

MemLineage: Lineage-Guided Enforcement for LLM Agent Memory
May 14, 2026Ciyan Ouyang, Rui HouLLM Agent Memory LLM Agent Security
State Key Laboratory of Cyberspace Security Defense Institute of Information Engineering, CAS Beijing, China
The Misattribution Gap: When Memory Poisoning Looks Like Model Failure in Agentic AI Systems
May 12, 2026Tanzim Ahad, Ismail Hossain, Md Jahangir Alam +3AI Agent Security Benchmarks Agent Memory Poisoning
Department of Computer Science, University of Texas at El Paso, TX, USA 79902 · School of Computing, Southern Illinois University Carbondale, IL, USA 62901 · University of Illinois Urbana-Champaign, IL, USA
EquiMem: Calibrating Shared Memory in Multi-Agent Debate via Game-Theoretic Equilibrium
May 10, 2026Yuqiao Meng, Luoxi Tang, Sakshi Sunil Narvekar +4Multi-Agent Debate Agent Memory Poisoning
Binghamton University, State University of New York, Binghamton, NY, USA · University of Iowa, Iowa City, IA, USA
ShadowMerge: A Novel Poisoning Attack on Graph-Based Agent Memory via Relation-Channel Conflicts
May 9, 2026Yang Luo, Zifeng Kang, Tiantian Ji +4Agent Memory Poisoning Graph-Based Agent Memory
Key Laboratory of Trustworthy Distributed Computing and Service (MoE), Beijing University of Posts and Telecommunications · Beijing University of Posts and Telecommunications · Zhongguancun Laboratory
Injection-Execution Dissociation: A Mechanistic Evaluation of Persistent Memory Attacks and Defenses in Stateful LLM Agents
May 8, 2026Jun Wen LeongLanguage Model Safety Evaluation AI Agent Security
When Routine Chats Turn Toxic: Unintended Long-Term State Poisoning in Personalized Agents
May 7, 2026Xiaoyu Xu, Minxin Du, Qipeng Xie +3LLM Agent Security Agent Memory Poisoning
†The Hong Kong Polytechnic University · ⋄Hong Kong University of Science and Technology, HKUST (Guangzhou)
MEMSAD: Gradient-Coupled Anomaly Detection for Memory Poisoning in Retrieval-Augmented Agents
May 5, 2026Ishrith GowdaRAG Poisoning Attacks Agent Memory Poisoning
University of California, Berkeley · Department of Electrical Engineering and Computer Sciences University of California, Berkeley · Work conducted at the Song Lab, Berkeley AI Research, University of California, Berkeley.
Trojan Hippo Bench: A Dynamic Benchmark for Persistent Memory Attacks and Defenses in LLM Agents
May 3, 2026Debeshee Das, Julien Piet, Darya Kaviani +3LLM Agent Security AI Agent Security Benchmarks
ETH Zürich · UC Berkeley · Snyk
Visual Inception: Compromising Long-term Planning in Agentic Recommenders via Multimodal Memory Poisoning
Apr 18, 2026Jiachen QianAI Agent Security Agent Memory Poisoning
City University of Hong Kong
MemEvoBench: Benchmarking Safety Risks from Memory Misevolution in LLM Agents
Apr 17, 2026Weiwei Xie, Shaoxiong Guo, Fan Zhang +5Long-Horizon Agent Evaluation AI Agent Security Benchmarks
Shanghai Jiao Tong University · East China Normal University · Shandong University +1
Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw
Apr 6, 2026Zijun Wang, Haoqin Tu, Letian Zhang +11AI Agent Security AI Agent Safety
UC Santa Cruz · NUS · Tencent +3
Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents
Apr 3, 2026Wei Zou, Mingwen Dong, Miguel Romero Calvo +7AI Agent Security Agent Memory Poisoning
Pennsylvania State University · Amazon Web Services
Mind Your HEARTBEAT! Claw Background Execution Inherently Enables Silent Memory Pollution
Mar 24, 2026Yechao Zhang, Shiqian Zhao, Jie Zhang +5AI Agent Security Agent Memory Poisoning
Nanyang Technological University · Agency for Science, Technology and Research (A*STAR) · Johns Hopkins University
Memory poisoning and secure multi-agent systems
Mar 20, 2026Vicenç Torra, Maria Bras-AmorósAgent Memory Poisoning AI Agent Security
Department of Computing Science, Umeå University, Umeå, Sweden. · Departament of Mathematics, Universitat Politècnica de Catalunya, Catalonia, Spain.
Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injections
Feb 17, 2026Xianglin Yang, Yufei He, Shuo Ji +2Prompt Injection Attacks on AI Agents Agent Memory Poisoning
School of Computing National University of Singapore
SuperLocalMemory: Privacy-Preserving Multi-Agent Memory with Bayesian Trust Defense Against Memory Poisoning
Feb 17, 2026Varun Pratap BhardwajAgent Memory Agent Memory Management
Independent Research
ER-MIA: Black-Box Adversarial Memory Injection Attacks on Long-Term Memory-Augmented Large Language Models
Feb 17, 2026Mitchell Piehl, Zhaohan Xi, Zuobin Xiong +2Adversarial Attacks on LLMs LLM Security
Department of Computer Science, The University of Iowa · School of Computing, State University of New York at Binghamton · Department of Computer Science, University of Nevada, Las Vegas +1
Cross-User Poisoning: User-Task Boundary Failures in Multi-User Collaborative Language Agents
Nov 21, 2025Atharv Singh Patlan, Peiyao Sheng, S. Ashwin Hebbar +2Data Poisoning Attacks Agent Memory Poisoning
Princeton University · Sentient
Attention is All You Need Until You Need Retention
Jan 15, 2025M. Murat YasliogluMemory-Augmented Language Models Agent Memory Poisoning
Istanbul University, School of Business

May 14, 2026J/K move · Enter open · S save

MemLineage: Lineage-Guided Enforcement for LLM Agent Memory

Ciyan Ouyang, Rui Hou

State Key Laboratory of Cyberspace Security Defense Institute of Information Engineering, CAS Beijing, China

LLM Agent Memory LLM Agent Security Agent Memory Poisoning

Open paper AskPDF arXiv

We introduce MemLineage, a defense for LLM agent memory that attaches both cryptographic provenance and LLM-mediated derivation lineage to every entry. Recent and concurrent work shows that untrusted content can be written into persistent agent state and re-enter later sessions as an instruction; the remaining systems question is how to preserve useful memory recall while preventing such state from justifying sensitive actions. MemLineage treats this as a chain-of-custody problem rather than a filtering problem. It is a six-module design around an RFC-6962 Merkle log over per-principal Ed25519-signed entries: a weighted derivation DAG records which retrieved entries influenced each new memory, and a max-of-strong-edges propagation rule makes Untrusted-Path Persistence hold for any chain whose attribution edges remain above threshold. The sensitive-action gate then refuses dispatches whose active justification descends from an external ancestor, while still allowing benign recall. We evaluate three defense cells against three memory-poisoning workloads on a deterministic mechanism-isolation harness; MemLineage is the only configuration in that harness that drives all three columns to zero ASR, while sub-millisecond per-operation overhead keeps it well below the noise floor of any LLM call. A Codex-backed AgentDojo bridge further separates strong-model behavior from defense-layer behavior: under an intentionally vulnerable tool-output profile, no-defense and signature-only baselines fail on all six banking pairs, while all MemLineage rows reduce strict AgentDojo ASR to zero. The core deterministic artifacts are byte-equal CI-verified; hosted-model AgentDojo and live-model sweeps are recorded as auditable logs rather than byte-pinned artifacts.