记忆中的隐患：LLM代理中的潜伏记忆污染
Hidden in Memory: Sleeper Memory Poisoning in LLM Agents
AI总结：
研究探讨了LLM代理中由于持久化内存带来的安全风险，提出并研究了潜伏记忆污染攻击，该攻击通过操控外部上下文使代理存储伪造的记忆，影响后续交互，实验显示攻击可跨多次对话持续生效。
摘要：
大型语言模型越来越多地集成了持久化内存，使助手能够在不同会话中存储用户特定信息以实现个性化和连续性。这种状态性引入了新的安全风险：对抗性内容可以腐蚀助手所记住的信息，从而影响未来的交互。我们提出并研究了潜伏记忆污染，这是一种延迟攻击，攻击者通过操控外部上下文，如文档、网页或仓库，使助手存储关于用户的伪造记忆。与传统的提示注入不同，这种攻击可以保持潜伏并在多次后续对话中重新出现。我们评估了完整的攻击流程：被污染的记忆是否被写入、后来被检索，并最终用于引导后续对话。在状态化的LLM助手上，被污染的记忆在GPT-5.5上达到高达99.8%，在Kimi-K2.6上达到95%。关键的是，在成功的检索中，被污染的记忆导致攻击者期望的代理行为在60-89%的评估中出现。这些结果表明，持久化内存可以在多个未来对话中充当长期的攻击面。
英文摘要：
Large language models are increasingly augmented with persistent memory, allowing assistants to store user-specific information across sessions for personalization and continuity. This statefulness introduces a new security risk: adversarial content can corrupt what an assistant remembers and thereby influence future interactions. We propose and study sleeper memory poisoning, a delayed attack in which an adversary manipulates external context, such as a document, webpage, or repository, to cause the assistant to store a fabricated memory about the user. Unlike conventional prompt injection, the attack can remain dormant and re-emerge across multiple later conversations. We evaluate the full attack pipeline: whether poisoned memories are written, later retrieved, and ultimately used to steer the following conversations. Across stateful LLM assistants, poisoned memories were added up to 99.8% on GPT-5.5 and 95% on Kimi-K2.6. Crucially, among successful retrievals, poisoned memories cause attacker-intended agentic actions in 60-89% of evaluations across models. These results show that persistent memory can act as a long-term attack surface across multiple future conversations.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
