Hidden in Memory: Sleeper Memory Poisoning in LLM Agents

• URL: http://arxiv.org/abs/2605.15338v2
• Date: Mon, 18 May 2026 07:05:25 GMT
• Title: Hidden in Memory: Sleeper Memory Poisoning in LLM Agents
• Abstract summary: We study sleeper memory poisoning, a delayed attack in which an adversary manipulates external context to cause the assistant to store a fabricated memory about the user.<n>Unlike conventional prompt injection, the attack can remain dormant and re-emerge across multiple later conversations.<n>Across stateful LLM assistants, poisoned memories were added up to 99.8% on GPT-5.5 and 95% on Kimi-K2.6.
• Score: 39.7102258719441
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Large language models are increasingly augmented with persistent memory, allowing assistants to store user-specific information across sessions for personalization and continuity. This statefulness introduces a new security risk: adversarial content can corrupt what an assistant remembers and thereby influence future interactions. We propose and study sleeper memory poisoning, a delayed attack in which an adversary manipulates external context, such as a document, webpage, or repository, to cause the assistant to store a fabricated memory about the user. Unlike conventional prompt injection, the attack can remain dormant and re-emerge across multiple later conversations. We evaluate the full attack pipeline: whether poisoned memories are written, later retrieved, and ultimately used to steer the following conversations. Across stateful LLM assistants, poisoned memories were added up to 99.8% on GPT-5.5 and 95% on Kimi-K2.6. Crucially, among successful retrievals, poisoned memories cause attacker-intended agentic actions in 60-89% of evaluations across models. These results show that persistent memory can act as a long-term attack surface across multiple future conversations.

Related papers

• Salami Attack: Stealthy Collusive Memory Poisoning against OpenClaw [15.739441864484098]
  We introduce MemCollusion, an automated framework for constructing collusive memory poisoning attacks.<n>MemCollusion constructs memory coalitions using four design constraints, five theory-informed strategies, and a fine-tuned generator.<n>MemCollusion achieves an average Memory Save Rate of 81.3% and an Attack Success Rate of 75.0%, and remains effective under both benign memory dilution and memory-level defenses.
  arXiv  Detail & Related papers  (2026-08-03T03:17:26Z)
• MAPLE-Guard: Memory-Aware Link Enforcement Against Memory-Link Poisoning in Multi-Agent Systems [38.58713997316864]
  MAPLE-Guard is a memory-link guard for memory-enabled multi-agent systems.<n>It monitors the memory lifecycle and places gates at write, retrieval, promotion, and cross-agent reuse.<n>Results suggest that memory-aware link enforcement covers a gap left by prompt-level and topology-level defenses.
  arXiv  Detail & Related papers  (2026-08-01T03:55:13Z)
• When Agents Remember Too Much: Memory Poisoning Attacks on Large Language Model Agents [0.6563429475229776]
  We introduce the novel attack vector, GhostWriter, which exploits current memory subsystems in tool-using personal agents to poison their memory store.<n>We show that GhostWriter achieves near-universal injection rates of approximately 98% and a high average activation rate of approximately 60% against state-of-the-art agents.<n>We propose Agentic Memory Sentry, which leverages two mitigation techniques: a memory-saving policy and a memory-retrieval screen.
  arXiv  Detail & Related papers  (2026-07-06T19:30:53Z)
• When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents [55.87577638514179]
  We study the threat as stealth memory injection, in which a remote black-box delivers a single email payload that must induce the agent to poisoned memory.<n>We propose MemGhost, a one-shot payload generation framework.<n>Across 56 held-out test cases, MemGhost achieves 87.5% end-to-end success on OpenClaw with GPT-5.4 and 71.4% on Claude Code SDK with Sonnet 4.6.
  arXiv  Detail & Related papers  (2026-07-06T15:08:58Z)
• MemVenom: Triggered Poisoning of Multimodal Memories in Web Agents [74.64265314956441]
  We propose a unified black-box attack framework that poisons graph-structured external memory with coordinated text-image evidence.<n>MemVenom achieves strong end-to-end attack success with minimal impact on benign performance, reaching up to 99.15% on GPT-5-family web agents.
  arXiv  Detail & Related papers  (2026-06-09T11:53:25Z)
• From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents [3.3489120273076876]
  Memory is a core component of AI agents, enabling them to accumulate knowledge across interactions and improve performance.<n>We present a systematic study of memory poisoning in LLM-based agents.<n>We identify four memory write channels and nine structural vulnerabilities in model capabilities, system prompt design, and agent system architecture.
  arXiv  Detail & Related papers  (2026-06-03T01:04:13Z)
• Hijacking Agent Memory: Stealthy Trojan Attacks Through Conversational Interaction [3.809725488301918]
  Large language model (LLM) agents increasingly leverage long term memory to support persistent and autonomous task execution.<n>Existing memory poisoning attacks assume that injected content can be stored directly in memory, overlooking the selective extraction and rewriting stages.<n>Mechanistic analysis indicates that the attack exploits embedding-space anisotropy and shifts attention patterns.
  arXiv  Detail & Related papers  (2026-05-28T14:02:00Z)
• From Recall to Forgetting: Benchmarking Long-Term Memory for Personalized Agents [38.52713500119118]
  We introduce Memora, a long-term memory benchmark spanning weeks to months long user conversations.<n>The benchmark evaluates three memory-grounded tasks: remembering, reasoning, and recommending.<n>Forgetting-Aware Memory Accuracy (FAMA) is a metric that penalizes reliance on obsolete or invalidated memory.
  arXiv  Detail & Related papers  (2026-04-21T21:31:01Z)
• MemEvoBench: Benchmarking Memory MisEvolution in LLM Agents [78.95081012334116]
  Large Language Models (LLMs) with persistent memory enhances interaction continuity and personalization but introduces new safety risks.<n> contaminated or biased memory accumulation can trigger abnormal agent behaviors.<n>MemeEvoBench is the first benchmark evaluating memory safety in LLM agents against adversarial memory injection, noisy tool outputs, and biased feedback.
  arXiv  Detail & Related papers  (2026-04-17T07:29:52Z)
• MemoryArena: Benchmarking Agent Memory in Interdependent Multi-Session Agentic Tasks [55.145729491377374]
  Existing evaluations of agents with memory typically assess memorization and action in isolation.<n>We introduce MemoryArena, a unified evaluation gym for benchmarking agent memory in multi-session Memory-Agent-Environment loops.<n> MemoryArena supports evaluation across web navigation, preference-constrained planning, progressive information search, and sequential formal reasoning.
  arXiv  Detail & Related papers  (2026-02-18T09:49:14Z)
• Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injections [57.64370755825839]
  Self-evolving agents update their internal state across sessions, often by writing and reusing long-term memory.<n>We study this risk and formalize a persistent attack we call a Zombie Agent.<n>We present a black-box attack framework that uses only indirect exposure through attacker-controlled web content.
  arXiv  Detail & Related papers  (2026-02-17T15:28:24Z)
• PersistBench: When Should Long-Term Memories Be Forgotten by LLMs? [4.657424818207681]
  We introduce PersistBench to measure the extent of long-term memory-specific safety risks.<n>We identify two long-term memory-specific risks: cross-domain leakage and memory-induced sycophancy.<n>Our benchmark encourages the development of more robust and safer long-term memory usage in frontier conversational systems.
  arXiv  Detail & Related papers  (2026-02-01T10:44:58Z)
• OP-Bench: Benchmarking Over-Personalization for Memory-Augmented Personalized Conversational Agents [55.27061195244624]
  We formalize over-personalization into three types: Irrelevance, Repetition, and Sycophancy.<n>Agents tend to retrieve and over-attend to user memories even when unnecessary.<n>Our work takes an initial step toward more controllable and appropriate personalization in memory-augmented dialogue systems.
  arXiv  Detail & Related papers  (2026-01-20T08:27:13Z)
• MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval [5.734678752740074]
  MemoryGraft is a novel indirect injection attack that compromises agent behavior not through immediate jailbreaks, but by implanting malicious successful experiences into the agent's long-term memory.<n>We demonstrate that an attacker who can supply benign ingestion-level artifacts that the agent reads during execution can induce it to construct a poisoned RAG store.<n>When the agent later encounters semantically similar tasks, union retrieval over lexical templates and embedding similarity reliably surfaces these grafted memories, and the agent adopts the embedded unsafe patterns, leading to persistent behavioral drift across sessions.
  arXiv  Detail & Related papers  (2025-12-18T08:34:40Z)
• Evaluating Long-Term Memory for Long-Context Question Answering [100.1267054069757]
  We present a systematic evaluation of memory-augmented methods using LoCoMo, a benchmark of synthetic long-context dialogues annotated for question-answering tasks.<n>Our findings show that memory-augmented approaches reduce token usage by over 90% while maintaining competitive accuracy.
  arXiv  Detail & Related papers  (2025-10-27T18:03:50Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.