aiqbench analysis
This research identifies critical structural blind spots in Large Language Model agent memory systems, demonstrating how adversarial content can persist across interaction turns to distort downstream behavior. The study moves beyond simple filtering by exposing limitations in current write-time defenses against compositional and context-triggered attacks, advocating for adaptive security strategies.
MemPoison: Uncovering Persistent Memory Threats and Structural Blind Spots in LLM Agents
arXiv:2607.14651v2 Announce Type: replace-cross Abstract: Persistent external memory enhances agent continuity but introduces persistent security vulnerabilities: adversarial content can be injected via standard interaction channels, retained across turns, and later distort downstream behavior. To address this challenge, we propose MemPoison, a comprehensive benchmark and analysis framework featuring 1227 hand-validated cases across four attack types, three injection channels, and three representative memory substrates, evaluated on seven open-weight and three closed-weight model families. We introduce a three-tier taxonomy: (L1) direct single-record corruption, (L2) compositional multi-record corruption and (L3) context-triggered dormant corruption. Our evaluations reveal a distinct defense frontier: while baseline write-time defenses, such as consistency checks, substantially suppress direct L1 attacks, they fail to reliably suppress L2 and L3 attacks. Through mechanistic influence decomposition (MID), we demonstrate structural blind spots in write-time defenses, which admit seemingly benign records that later become harmful through joint retrieval composition or trigger-conditioned activation. Our findings advocate for shifting from static filtering to adaptive, context-sensitive memory defense strategies.
Abstract:Persistent external memory enhances agent continuity but introduces persistent security vulnerabilities: adversarial content can be injected via standard interaction channels, retained across turns, and later distort downstream behavior. To address this challenge, we propose MemPoison, a comprehensive benchmark and analysis framework featuring 1227 hand-validated cases across four attack types, three injection channels, and three representative memory substrates, evaluated on seven open-weight and three closed-weight model families. We introduce a three-tier taxonomy: (L1) direct single-record corruption, (L2) compositional multi-record corruption and (L3) context-triggered dormant corruption. Our evaluations reveal a distinct defense frontier: while baseline write-time defenses, such as consistency checks, substantially suppress direct L1 attacks, they fail to reliably suppress L2 and L3 attacks. Through mechanistic influence decomposition (MID), we demonstrate structural blind spots in write-time defenses, which admit seemingly benign records that later become harmful through joint retrieval composition or trigger-conditioned activation. Our findings advocate for shifting from static filtering to adaptive, context-sensitive memory defense strategies.
Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)
arXiv:2607.14651 [cs.CR]
(or arXiv:2607.14651v2 [cs.CR] for this version)
https://doi.org/10.48550/arXiv.2607.14651 Focus to learn more arXiv-issued DOI via DataCite
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 252 words
Related coverage
SATQuest: A Verifier for Logical Reasoning Evaluation and Reinforcement Fine-Tuning of LLMs
arXiv · Jul 21, 2026
Privacy Cost as Equity Input: A Group Fairness Criterion for Differentially Private Machine Learning
arXiv · Jul 21, 2026
Two Minds Better Than One: Collaborative Reward Modeling for LLM Alignment
arXiv · Oct 19, 2026
Beyond the Training Horizon: Mechanisms and Limits of Length Generalization in Looped Transformers
arXiv · Sep 30, 2026