Memory poisoning and secure multi-agent systems

• URL: http://arxiv.org/abs/2603.20357v1
• Date: Fri, 20 Mar 2026 14:27:46 GMT
• Title: Memory poisoning and secure multi-agent systems
• Abstract summary: Memory poisoning attacks for Agentic AI and multi-agent systems (MAS) have recently caught attention.<n>We first present the main types of memory systems, we then discuss the feasibility of memory poisoning attacks in these different types of memory systems, and we propose mitigation strategies.<n>We propose to implement local inference based on private knowledge retrieval as an example of mitigation strategy for memory poisoning for semantic memory.
• Score: 5.987250983212102
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: Memory poisoning attacks for Agentic AI and multi-agent systems (MAS) have recently caught attention. It is partially due to the fact that Large Language Models (LLMs) facilitate the construction and deployment of agents. Different memory systems are being used nowadays in this context, including semantic, episodic, and short-term memory. This distinction between the different types of memory systems focuses mostly on their duration but also on their origin and their localization. It ranges from the short-term memory originated at the user's end localized in the different agents to the long-term consolidated memory localized in well established knowledge databases. In this paper, we first present the main types of memory systems, we then discuss the feasibility of memory poisoning attacks in these different types of memory systems, and we propose mitigation strategies. We review the already existing security solutions to mitigate some of the alleged attacks, and we discuss adapted solutions based on cryptography. We propose to implement local inference based on private knowledge retrieval as an example of mitigation strategy for memory poisoning for semantic memory. We also emphasize actual risks in relation to interactions between agents, which can cause memory poisoning. These latter risks are not so much studied in the literature and are difficult to formalize and solve. Thus, we contribute to the construction of agents that are secure by design.

Related papers

• Harness the Memory: A Holistic Evaluation of Memory Substrates in Memory Agents [97.19033877543522]
  We present a controlled harness evaluation of memory substrates for memory-augmented agents.<n>We instrument 26 performance and efficiency metrics under a unified harness.<n>These findings motivate substrate routing as a necessary component of adaptive agent memory systems.
  arXiv  Detail & Related papers  (2026-08-15T03:29:48Z)
• MemVenom: Triggered Poisoning of Multimodal Memories in Web Agents [74.64265314956441]
  We propose a unified black-box attack framework that poisons graph-structured external memory with coordinated text-image evidence.<n>MemVenom achieves strong end-to-end attack success with minimal impact on benign performance, reaching up to 99.15% on GPT-5-family web agents.
  arXiv  Detail & Related papers  (2026-06-09T11:53:25Z)
• From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents [3.3489120273076876]
  Memory is a core component of AI agents, enabling them to accumulate knowledge across interactions and improve performance.<n>We present a systematic study of memory poisoning in LLM-based agents.<n>We identify four memory write channels and nine structural vulnerabilities in model capabilities, system prompt design, and agent system architecture.
  arXiv  Detail & Related papers  (2026-06-03T01:04:13Z)
• Hijacking Agent Memory: Stealthy Trojan Attacks Through Conversational Interaction [3.809725488301918]
  Large language model (LLM) agents increasingly leverage long term memory to support persistent and autonomous task execution.<n>Existing memory poisoning attacks assume that injected content can be stored directly in memory, overlooking the selective extraction and rewriting stages.<n>Mechanistic analysis indicates that the attack exploits embedding-space anisotropy and shifts attention patterns.
  arXiv  Detail & Related papers  (2026-05-28T14:02:00Z)
• MemGuard: Preventing Memory Contamination in Long-Term Memory-Augmented Large Language Models [56.31411457917676]
  We introduce MemGuard, a type-aware memory framework that preserves functional memory boundaries during memory construction and retrieval.<n>Across hallucination and long-horizon conversation benchmarks, MemGuard improves memory reliability by up to 28.27% while retrieving up to 5.8x fewer memory tokens than prior methods.
  arXiv  Detail & Related papers  (2026-05-27T06:04:19Z)
• Remembering More, Risking More: Longitudinal Safety Risks in Memory-Equipped LLM Agents [18.83666486835137]
  In deployment, a single agent serves many independent tasks over a long horizon, and memory accumulated during earlier tasks can affect behavior on later, unrelated ones.<n>We introduce a trigger-probe protocol that evaluates a fixed probe set against read-only memory snapshots at varying prefix lengths.<n>We apply this protocol across three deployment scenarios spanning records, memos, forms, and email correspondence and eight memory architectures.
  arXiv  Detail & Related papers  (2026-05-18T04:06:34Z)
• The Trap of Trajectory: Towards Understanding and Mitigating Spurious Correlations in Agentic Memory [7.707732051915869]
  Diagnosing agentic memory systems reveals that memory improves reasoning on clean inputs but amplifies reliance on spurious patterns when they are present.<n>We propose CAMEL, a plug-and-play calibration method that operates across diverse memory architectures at both write and retrieval time.<n>Overall, CAMEL offers a principled and lightweight solution toward more reliable agentic memory deployment.
  arXiv  Detail & Related papers  (2026-05-10T05:04:13Z)
• Contextual Agentic Memory is a Memo, Not True Memory [3.939241105154204]
  We argue that treating lookup as memory is a category error with provable consequences for agent capability, long-term learning, and security.<n>We show that biological intelligence solved this problem by pairing fast hippocampal storage with slow neocortical weight consolidation.
  arXiv  Detail & Related papers  (2026-04-30T10:54:56Z)
• MemEvoBench: Benchmarking Memory MisEvolution in LLM Agents [78.95081012334116]
  Large Language Models (LLMs) with persistent memory enhances interaction continuity and personalization but introduces new safety risks.<n> contaminated or biased memory accumulation can trigger abnormal agent behaviors.<n>MemeEvoBench is the first benchmark evaluating memory safety in LLM agents against adversarial memory injection, noisy tool outputs, and biased feedback.
  arXiv  Detail & Related papers  (2026-04-17T07:29:52Z)
• The AI Hippocampus: How Far are We From Human Memory? [77.04745635827278]
  Implicit memory refers to the knowledge embedded within the internal parameters of pre-trained transformers.<n>Explicit memory involves external storage and retrieval components designed to augment model outputs with dynamic, queryable knowledge representations.<n>Agentic memory introduces persistent, temporally extended memory structures within autonomous agents.
  arXiv  Detail & Related papers  (2026-01-14T03:24:08Z)
• Memory Matters More: Event-Centric Memory as a Logic Map for Agent Searching and Reasoning [55.251697395358285]
  Large language models (LLMs) are increasingly deployed as intelligent agents that reason, plan, and interact with their environments.<n>To effectively scale to long-horizon scenarios, a key capability for such agents is a memory mechanism that can retain, organize, and retrieve past experiences.<n>We propose CompassMem, an event-centric memory framework inspired by Event Theory.
  arXiv  Detail & Related papers  (2026-01-08T08:44:07Z)
• Beyond Heuristics: A Decision-Theoretic Framework for Agent Memory Management [49.71055327567513]
  We argue that memory management should be viewed as a sequential decision-making problem under uncertainty.<n>Our contribution is not a new algorithm, but a principled reframing that clarifies the limitations of approaches.
  arXiv  Detail & Related papers  (2025-12-25T08:23:03Z)
• Memory in the Age of AI Agents [217.9368190980982]
  This work aims to provide an up-to-date landscape of current agent memory research.<n>We identify three dominant realizations of agent memory, namely token-level, parametric, and latent memory.<n>To support practical development, we compile a comprehensive summary of memory benchmarks and open-source frameworks.
  arXiv  Detail & Related papers  (2025-12-15T17:22:34Z)
• Agentic Learner with Grow-and-Refine Multimodal Semantic Memory [50.81667005063605]
  ViLoMem is a dual-stream memory framework that constructs compact, schema-based memory.<n>It encodes visual distraction patterns and logical reasoning errors, enabling MLLMs to learn from their successful and failed experiences.
  arXiv  Detail & Related papers  (2025-11-26T18:55:08Z)
• Evaluating Long-Term Memory for Long-Context Question Answering [100.1267054069757]
  We present a systematic evaluation of memory-augmented methods using LoCoMo, a benchmark of synthetic long-context dialogues annotated for question-answering tasks.<n>Our findings show that memory-augmented approaches reduce token usage by over 90% while maintaining competitive accuracy.
  arXiv  Detail & Related papers  (2025-10-27T18:03:50Z)
• A Machine with Short-Term, Episodic, and Semantic Memory Systems [9.42475956340287]
  Inspired by the cognitive science theory of the explicit human memory systems, we have modeled an agent with short-term, episodic, and semantic memory systems. Our experiments indicate that an agent with human-like memory systems can outperform an agent without this memory structure in the environment.
  arXiv  Detail & Related papers  (2022-12-05T08:34:23Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.