Research map / Adversarial robustness and security / Attacks on text and graphs

MemPoison: Uncovering Persistent Memory Threats and Structural Blind Spots in LLM Agents

NeurIPS 2026 · Adversarial robustness and security › Attacks on text and graphs · approach: LLM jailbreak and injection defense · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Introduces MemPoison, a 1,227-case benchmark and Mechanistic Influence Decomposition (MID) diagnostic for persistent memory poisoning in LLM agents, showing write-time defenses suppress single-record (L1) attacks but leave compositional (L2) and context-triggered (L3) attacks largely unsuppressed.

Problem

Persistent external memory in LLM agents creates durable attack surfaces; existing evaluations focus on single-record injection and top-line metrics, leaving unclear why write-time defenses fail under compositional and dormant poisoning.

Approach

A three-tier taxonomy (L1 direct, L2 compositional, L3 context-triggered dormant) with a hand-validated benchmark across memory substrates and channels, plus counterfactual influence decomposition (single-record influence, pairwise interaction, activation shift) to explain defense blind spots.

Key results

• Undefended agents show 62.55% overall BCR on average while keeping 94.40% clean accuracy across ten models.
• The MIXed defense reduces overall BCR to 10.70% with 93.77% CleanAcc, but L3 BCR remains 14.16% and L2 11.64%.
• Write-time consistency check cuts L1 BCR to 4.77% yet leaves L2 at 22.54% and L3 at 27.80%.

Surprising findings

• Perplexity-based filtering (PPL) drops clean accuracy to 61.28% while barely reducing BCR (59.14%), so it is ineffective and harmful.
• Fact-store substrate is more robust than flat chunk because decomposition dilutes injected content.

Limitations

• Focuses only on three memory substrates and text-based poisoning via standard channels.
• L2 case count is small (253) due to construction difficulty; many L2 candidates were rejected.
• Parametric poisoning, side-channel attacks and weight tampering are excluded from scope.

Experimental setup

Datasets: ToolBench BFCL SWE-bench Terminal-Bench TheAgentCompany tau-bench AssistantBench OSWorld

Benchmarks: MemPoison-Bench

Metrics: Clean Accuracy Behavioral Corruption Rate Ambiguous Rate Unclear Rate P2C rate poisoned-match score reduction

Baselines: Source Reliability Retrieval Write-time consistency check Memory novelty anomaly filter MIXed PromptGuard LLMJudge Write EraseAndCheck SmoothLLM PPL Input Moderation Memory Sanitization

Builds on: PromptGuard SmoothLLM EraseAndCheck

Closest papers by meaning

• A-MemGuard: A Proactive Defense Framework For LLM-Based Agent Memory (ICML 2026 · similarity 0.92)
• Bits Leaked per Query: Information-Theoretic Bounds for Adversarial Attacks on LLMs (NeurIPS 2025 · similarity 0.87)
• Memory Injection Attacks on LLM Agents via Query-Only Interaction (NeurIPS 2025 · similarity 0.87)
• SafeHarbor: Defining Precise Decision Boundaries via Hierarchical Memory-Augmented Guardrail for LLM Agent Safety (ICML 2026 · similarity 0.87)
• Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security (NeurIPS 2026 · similarity 0.86)
• Forgetting is Not Always Bad: A Neuro-Inspired Memory Repair Mechanism for Poisoned LLM Agents (NeurIPS 2026 · similarity 0.86)