MemPoison: Uncovering Persistent Memory Threats and Structural Blind Spots in LLM Agents
Jifeng Gao1
Kang Xia1 Yi Zhang1 Xiaobin Hong1 Mingkai Lin1 Xingshen Wei1,2 Wenzhong Li1 Sanglu Lu1 1 State Key Laboratory for Novel Software Technology, Nanjing University, China 2 NARI Group Corporation/State Grid Electric Power Research Institute, China
arXiv:2607.14651v1 [cs.CR] 16 Jul 2026
Abstract Persistent external memory enhances agent continuity but introduces persistent security vulnerabilities: adversarial content can be injected via standard interaction channels, retained across turns, and later distort downstream behavior. To address this challenge, we propose MemPoison, a comprehensive benchmark and analysis framework featuring 1,227 hand-validated cases across four attack types, three injection channels, and three representative memory substrates, evaluated on seven open-weight and three closed-weight model families. We introduce a three-tier taxonomy: (L1) direct single-record corruption, (L2) compositional multi-record corruption and (L3) context-triggered dormant corruption. Our evaluations reveal a distinct defense frontier: while baseline write-time defenses, such as consistency checks, substantially suppress direct L1 attacks, they fail to reliably suppress L2 and L3 attacks. Through mechanistic influence decomposition (MID), we demonstrate structural blind spots in write-time defenses, which admit seemingly benign records that later become harmful through joint retrieval composition or trigger-conditioned activation. Our findings advocate for shifting from static filtering to adaptive, context-sensitive memory defense strategies.
1
Introduction
Persistent memory has emerged as a fundamental capability in large language model (LLM) agents [46, 44, 24, 33]. Modern AI assistants now maintain external memory to record preferences, facts, summaries, task states, and handoff notes, enabling interactions to seamlessly resume with continuity over time [44, 46, 24]. However, this same persistence introduces a durable attack surface: malicious inputs injected through regular interaction channels can persist beyond their initial context, later distorting downstream behavior [63, 22, 11, 69]. While prior work has increasingly recognized the security risks introduced by persistent memory in agent systems [7, 11, 47, 66, 18, 62], existing evaluations remain fragmented and insufficient for systematic understanding. Most studies focus on simplified threat models, typically centered on isolated single record injections, and evaluate only a narrow range of memory abstractions, such as flat retrieval-based stores or specific systems [11, 47, 52, 43]. As a result, the field still lacks a unified benchmarking framework for characterizing how persistent memory poisoning varies across more realistic attack regimes, including compositional corruption and context-triggered dormant behaviors, as well as across heterogeneous memory architectures [11, 47, 52, 43, 12, 67, 19, 40, 34, 35]. At the same time, a common emerging defense strategy is write-time filtering or validation, which assesses candidate memory records for safety and consistency before storage [12, 67, 17, 2, 52]. Yet the effectiveness of such defenses remains poorly understood, especially beyond direct injection settings. Existing evaluations largely rely on top-line metrics such as attack success rate or task accuracy, providing limited visibility into how failures emerge and propagate across the memory lifecycle. Preprint.