Trojan Hippo：利用代理记忆进行数据外泄
Trojan Hippo Bench: A Dynamic Benchmark for Persistent Memory Attacks and Defenses in LLM Agents
AI总结：
研究提出Trojan Hippo攻击，通过单次不可信工具调用在代理长期记忆中植入潜伏载荷，当用户讨论敏感话题时激活并外泄数据。通过动态评估框架评估不同内存架构和防御措施，发现现有防御措施在安全性和实用性之间存在显著权衡。
摘要：
内存系统使原本无状态的LLM代理能够在会话间持久化用户信息，但也引入了新的攻击面。我们定义了Trojan Hippo攻击，这是一种持久化内存攻击，其威胁模型比先前的记忆污染工作更加现实：攻击者通过单次不可信工具调用（如伪造邮件）在代理的长期记忆中植入潜伏载荷，该载荷仅在用户后来讨论敏感话题（如财务、健康或身份）时激活，并将高价值个人数据外泄。尽管有关此类攻击的轶事演示已出现在部署系统中，但没有先前工作系统地在异构内存架构和防御上评估它们。我们引入了一个动态评估框架，包含两个组成部分：（1）基于OpenEvolve的自适应红队基准，通过持续优化的攻击测试防御和内存后端；（2）首个具备能力的保安/效用分析，用于持久化内存系统，使在不同使用配置下进行防御部署的原理性推理成为可能。在四个内存后端（显式工具记忆、代理记忆、RAG和滑动窗口上下文）上的电子邮件助手实例化中，Trojan Hippo在当前前沿模型（如OpenAI和Google）上实现了高达85-100%的攻击成功率，植入的记忆即使在100次良性会话后仍能成功激活。我们评估了四种受基本安全原则启发的内存系统防御措施，发现它们显著降低了攻击成功率（降至最低5%），但实用性成本因任务需求而异。由于这种显著的安全性-实用性权衡，防御的有效现实部署仍是一个开放挑战，而我们的评估框架正是为此而设计的。
英文摘要：
Memory systems enable otherwise stateless LLM agents to persist user information across sessions, but also introduce a new attack surface. The Trojan Hippo attack is a class of persistent memory attacks that operates under a more realistic threat model than prior memory poisoning work. The attacker plants a dormant payload into an agent's long-term memory via a single untrusted tool call (e.g., a crafted email), which activates only when the user later discusses sensitive topics such as finance, health, or identity, and exfiltrates high-value personal data to the attacker. While anecdotal demonstrations of such attacks have appeared against deployed systems, no prior work systematically evaluates them across heterogeneous memory architectures and defenses. We introduce Trojan Hippo Bench, a dynamic evaluation framework for persistent memory attacks and memory-layer defenses, comprising two components, (1) an OpenEvolve-based adaptive red-teaming benchmark that stress-tests defenses and memory backends against continuously refined attacks, and (2) a capability-aware security-utility analysis for persistent memory systems, enabling principled reasoning about defense deployment across different usage profiles. Instantiated on an email assistant across four memory backends (explicit tool memory, agentic memory, RAG, and sliding-window context), the undefended Trojan Hippo attack achieves up to 85-100% attack success rate (ASR) against current frontier models from OpenAI and Google, with planted memories successfully activating even after 100 benign sessions. We evaluate four memory-system defenses inspired by basic security principles; they reduce attack success to as low as 0-5%, but at utility costs that vary widely with the task mix. Effective real-world deployment thus remains an open challenge that Trojan Hippo Bench is built to study; we release it to support reuse and extension.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
