CAPTURE: Disentangling Preference Drift from Memory Poisoning in Personalized LLM Agents

• URL: http://arxiv.org/abs/2609.02265v1
• Date: Wed, 02 Sep 2026 08:10:26 GMT
• Title: CAPTURE: Disentangling Preference Drift from Memory Poisoning in Personalized LLM Agents
• Abstract summary: CAPTURE is a continuous-time partially observable decision process over a latent user state.<n>It achieves a 71.5% win rate, compared with 69.3% for an identically supervised baseline.<n>It limits fixed-policy poisoning success to 11.5% while accepting 83.5% of genuine preference updates.
• Score: 0.15293427903448023
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Personalized language agents use persistent memory to adapt to users over time, but the same mechanism creates an attack surface. When new information conflicts with stored preferences, an agent must distinguish genuine preference drift from temporary context shifts, ambiguity, or adversarial memory poisoning. We formulate this problem as a continuous-time partially observable decision process over a latent user state and show why rules based only on recency and provenance are insufficient. CAPTURE addresses this ambiguity with a neural differential-equation belief tracker, a multi-timescale memory ledger, uncertainty-triggered clarification, and counterfactual auditing of cited memories. On 480 held-out episodes from 96 users, CAPTURE achieves a 71.5% win rate, compared with 69.3% for an identically supervised baseline and 66.1% for the strongest heuristic baseline. It limits fixed-policy poisoning success to 11.5% while accepting 83.5% of genuine preference updates. Under an adaptive attacker with access to the released weights, attack success rises to 24.7%, exposing a real adaptation-security tradeoff. We further evaluate the frozen system zero-shot on an independently constructed benchmark and replay longitudinal interaction histories from 40 users collected over two to three weeks. These results suggest that modeling preference authenticity explicitly can improve both personalization and robustness in memory-augmented LLM agents.

Related papers

• Chameleon: An Adaptive AI-Driven Honeypot Architecture Using Threat-Calibrated Particle Swarm Optimization and Semantic Deception Rapidly-Exploring Random Trees [0.0]
  High-cost commercial deception products share a related weakness in that their response engines are not coupled to real-time model-driven feedback.<n>Mechanism is an openly distributed adaptive honeypot platform introduced here to address both shortcomings.
  arXiv  Detail & Related papers  (2026-08-15T20:30:14Z)
• When Does Trace-Driven Evaluation Mislead MoE Expert Caching? Replay Semantics, Workload Contamination, and Operating Regimes [3.471896896439183]
  Mixture-of-Experts (MoE) models have outgrown accelerator memory.<n>Policy that raised the hit rate would cut expert traffic per token.<n>We evaluate three evaluation axes that change conclusions, not just numbers.
  arXiv  Detail & Related papers  (2026-08-08T04:29:20Z)
• Self-Aware Vector Embeddings for Retrieval-Augmented Generation: A Neuroscience-Inspired Framework for Temporal, Confidence-Weighted, and Relational Knowledge [0.0]
  Modern retrieval-augmented generation (RAG) systems treat vector embeddings as static, context-free artifacts.<n>We propose Smart, a framework that augments dense embeddings with three explicit properties -- temporal awareness, confidence decay, and relational awareness.
  arXiv  Detail & Related papers  (2026-04-22T14:13:50Z)
• ImplicitMemBench: Measuring Unconscious Behavioral Adaptation in Large Language Models [60.14219417402433]
  Existing memory benchmarks for LLM agents evaluate explicit recall of facts, yet overlook implicit memory where experience becomes automated behavior without conscious retrieval.<n>We introduce ImplicitMemBench, the first systematic benchmark evaluating implicit memory through three constructs drawn from standard cognitive-science accounts of non-declarative memory.<n>Our 300-item suite employs a unified Learning/Priming-Interfere-Test protocol with first-attempt scoring.
  arXiv  Detail & Related papers  (2026-04-09T10:26:32Z)
• MemPO: Self-Memory Policy Optimization for Long-Horizon Agents [52.00646524941419]
  Existing methods typically introduce the external memory module and look up the relevant information from the stored memory.<n>We propose the self-memory policy optimization algorithm (MemPO), which enables the agent to autonomously summarize and manage their memory.<n>MemPO achieves absolute F1 score gains of 25.98% over the base model and 7.1% over the previous SOTA baseline, while reducing token usage by 67.58% and 73.12%.
  arXiv  Detail & Related papers  (2026-02-28T14:43:02Z)
• MemoPhishAgent: Memory-Augmented Multi-Modal LLM Agent for Phishing URL Detection [15.810091292280584]
  MemoPhishAgent (MPA) is a memory-augmented multi-modal LLM agent that orchestrates phishing-specific tools.<n>MPA outperforms three state-of-the-art (SOTA) baselines, improving recall by 13.6%.<n>MPA is deployed in production, processing 60K targeted high-risk URLs weekly, and achieving 91.44% recall.
  arXiv  Detail & Related papers  (2026-02-24T21:50:46Z)
• When Personalization Legitimizes Risks: Uncovering Safety Vulnerabilities in Personalized Dialogue Agents [49.341830745910194]
  In this paper, we reveal intent legitimation, a previously underexplored safety failure in personalized agents.<n>Our work provides the first systematic exploration and evaluation of intent legitimation as a safety failure mode.
  arXiv  Detail & Related papers  (2026-01-25T15:42:01Z)
• PersonaMem-v2: Towards Personalized Intelligence via Learning Implicit User Personas and Agentic Memory [56.81126490418336]
  Personalization is one of the next milestones in advancing AI capability and alignment.<n> PersonaMem-v2 simulates 1,000 realistic user-chatbot interactions on 300+ scenarios, 20,000+ user preferences, and 128k-token context windows.<n>We train Qwen3-4B to outperforms GPT-5, reaching 53% accuracy in implicit personalization.
  arXiv  Detail & Related papers  (2025-12-07T06:48:23Z)
• CausalDiff: Causality-Inspired Disentanglement via Diffusion Model for Adversarial Defense [61.78357530675446]
  Humans are difficult to be cheated by subtle manipulations, since we make judgments only based on essential factors.<n>Inspired by this observation, we attempt to model label generation with essential label-causative factors and incorporate label-non-causative factors to assist data generation.<n>For an adversarial example, we aim to discriminate perturbations as non-causative factors and make predictions only based on the label-causative factors.
  arXiv  Detail & Related papers  (2024-10-30T15:06:44Z)
• AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases [73.04652687616286]
  We propose AgentPoison, the first backdoor attack targeting generic and RAG-based LLM agents by poisoning their long-term memory or RAG knowledge base. Unlike conventional backdoor attacks, AgentPoison requires no additional model training or fine-tuning. On each agent, AgentPoison achieves an average attack success rate higher than 80% with minimal impact on benign performance.
  arXiv  Detail & Related papers  (2024-07-17T17:59:47Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.