MemPoison: Uncovering Persistent Memory Threats and Structural Blind Spots in LLM Agents

2026-07-16 · Source: Artificial Intelligence · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Robotics & Autonomous Systems · Depth: Expert, quick

Summary

MemPoison is a new benchmark and analysis framework designed to uncover persistent memory threats and structural blind spots within LLM agents. It addresses the critical security vulnerabilities introduced by external memory, where adversarial content can be injected through standard interaction channels, retained across turns, subsequently distorting downstream agent behavior. The framework comprises 1227 hand-validated cases, spanning four attack types, three injection channels, and three representative memory substrates, evaluated across seven open-weight and three closed-weight model families. MemPoison introduces a three-tier taxonomy: L1 direct single-record corruption, L2 compositional multi-record corruption, and L3 context-triggered dormant corruption. Evaluations reveal that while baseline write-time defenses effectively suppress L1 attacks, they consistently fail against L2 and L3 threats. Mechanistic influence decomposition (MID) highlights structural blind spots in these defenses, which permit seemingly benign records to become harmful through joint retrieval composition or trigger-conditioned activation.

Key takeaway

For AI Security Engineers developing LLM agents with external memory, you must move beyond static write-time defenses. Your current consistency checks are likely insufficient against compositional (L2) and context-triggered (L3) memory corruption, leaving agents vulnerable to persistent adversarial influence. Implement adaptive, context-sensitive memory defense strategies that account for joint retrieval composition and trigger-conditioned activation to secure your systems effectively.

Key insights

LLM agent external memory introduces persistent, complex vulnerabilities that static write-time defenses fail to address.

Principles

• External memory enables persistent adversarial influence.
• Static write-time defenses have structural blind spots.
• Adaptive, context-sensitive defense is needed.

Method

MemPoison benchmarks LLM agents using 1227 cases across 4 attack types and a 3-tier taxonomy, employing Mechanistic Influence Decomposition (MID) to reveal defense failures.

In practice

• Test LLM agents for L2/L3 memory corruption.
• Develop adaptive memory defense strategies.
• Apply MID to analyze defense vulnerabilities.

Topics

• LLM Agents
• External Memory Security
• Adversarial Attacks
• MemPoison Benchmark
• Write-Time Defenses
• Context-Sensitive Defenses

Best for: AI Architect, Research Scientist, CTO, AI Scientist, AI Security Engineer

Related on AIssential

• A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecycle — LLM agent memory's inherent malleability necessitates lifecycle-wide security governance for mnemonic sovereignty.
• When Embedding-Based Defenses Fail: Rethinking Safety in LLM-Based Multi-Agent Systems — Embedding-based MAS defenses fail when attackers craft near-benign messages, necessitating token-level confidence signals for robustness.
• Beyond Similarity: Trustworthy Memory Search for Personal AI Agents — Semantic similarity in AI agent memory retrieval creates critical trustworthiness failures; task-conditioned memory admission is essential.
• Remembering More, Risking More: Longitudinal Safety Risks in Memory-Equipped LLM Agents — Accumulated memory in LLM agents introduces longitudinal safety risks, increasing violation rates over time.
• CAMeR: Keyword-Gated Hybrid Activation for Adaptive Memory Retention in LLM Agents — Combining symbolic keyword overlap with sub-symbolic embedding similarity significantly improves LLM agent memory retention by filtering false positives.
• MemRefine: LLM-Guided Compression for Long-Term Agent Memory — LLM-guided memory compression, prioritizing factual content over surface similarity, effectively manages agent memory within fixed budgets.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Artificial Intelligence.