Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents

Unknown

Conceptio › Archive › arXiv CS

arXiv CSopen access

Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents

Unknown · 2026 · arxiv_cs

arXiv CS · Papers · License: Open Access · 2026

Open Source ↗Direct PDF ↓

cryptography, security, privacy, cybersecurity

Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents Xinyu Gao1

Wenyu Chen1 Xiangtao Meng1 Li Wang1 1 Jianing Wang Zheng Li1,2,3∗ Shanqing Guo1,2,3∗

Chuanchao Zang1

arXiv:2607.23444v1 [cs.CR] 26 Jul 2026

School of Cyber Science and Technology, Shandong University State Key Laboratory of Cryptography and Digital Economy Security, Shandong University 3 Shandong Key Laboratory of Artificial Intelligence Security, Shandong University

Abstract

atically steering anchors toward unexplored memory regions. To sustain extraction beyond platformimposed tool-call limits, SPORE persists reactivation payloads in memory that automatically resume the attack within or across sessions without additional user triggers. SPORE achieves an 80.0% record extraction rate with unlimited triggers and 47.0% with only 20 triggers. In multi-user deployments, attackers can link extracted records to user identities, turning bulk extraction into targeted surveillance. These results show that memory isolation alone is insufficient and call for reexamining tool-side trust boundaries in agent architectures.

LLM-based agents extend large language models with long-term memory (LTM) that stores privacysensitive user data across sessions. Production systems mitigate extraction risks by enforcing strict memory isolation, tying each user’s LTM to a unique identifier. This measure has prevented known attacks that exploit shared storage, leading to the common assumption that isolated LTM is immune to leakage. In this work, we expose the tool interface as an overlooked attack surface. Agents routinely include LTM-retrieved data in tool invocation parameters, creating a channel by which a malicious tool can exfiltrate a user’s private memory without breaking user-level isolation. Simple adaptations of userside extraction techniques fail: semantic interference of the adversarial command degrades retrieval precision, and platform-imposed limits on tool calls constrain the extraction budget per trigger. We present SPORE , the first extraction attack for this threat model. It exploits the agent’s stateful memory: injected content persists and shapes ongoing behavior. SPORE decouples the adversarial command from semantic anchors by persisting the command in short-term memory while emitting pure anchors in tool responses; the restored retrieval precision enables formulating extraction as a geometric coverage optimization over the embedding space, system-

Introduction

LLM-based agents augment large language models (LLM) with external tools and memory mechanisms, allowing stateful interaction with broader environments [41, 30, 14, 3]. Agent memory typically comprises (1) short-term memory (STM), the transient context window, and (2) long-term memory (LTM), an external database that accumulates privacy-sensitive user data—medical records [1, 24], financial portfolios [33, 36], personal conversations [13, 39]—across sessions and retrieves relevant entries via RAG [2, 11, 12, 22, 23, 27] to inform future responses. The persistent and privacy-sensitive nature of LTM makes it a high-value target: an ad1

Trust Boundary TASK:Provide Bob's health information

LLM

Alice Access denied!

Bob

TASK:Register a medical appointment. Appointment scheduled.

User-side

Alice View

• Lives in London • ID number:A93 • ...

ment request may transmit health conditions stored in memory directly to a healthcare API without explicit user consent. This raises a critical question: Can a malicious tool deliberately exploit this leakage channel to systematically extract a user’s private memory? A natural approach is to adapt existing user-side extraction attacks to the tool side through indirect prompt injection [6, 5, 7, 10, 42]. However, this approach performs poorly in the tool-side setting for two reasons. First, adversarial tool responses must simultaneously contain an attack command that hijacks the agent and a semantic anchor that guides memory retrieval, causing semantic interference that reduces retrieval precision and diversity. Second, tool-side attackers are trigger-constrained: they can act only when users invoke the compromised tool, and each trigger allows only a limited number of tool calls. Together, these constraints severely restrict extraction efficiency (see details in Section 3.2). Overcoming them is the focus of our work. In this work, we propose SPORE , the first data extraction attack designed for the tool-side threat model based on state persistence. Our key insight is that agent memory is stateful: injected content can persist across iterations and sessions, continuously influencing the agent’s planning and tool usage. An adversary can exploit this persistence by injecting crafted payloads that continuously steer the agent toward data extraction. To overcome semantic interference during retrieval, SPORE decouples adversarial commands from semantic anchors. The adversarial command is injected once into the agent’s short-term memory (STM), where it persistently instructs the agent to leak retrieved records. Subsequent tool responses contain only semantic anchors, without command interference. This design removes retrieval redundancy and restores precise control over retrieval direction. Building on this property, we formulate memory extraction, for the first time, as a geometric coverage optimization problem in the embedding space, allowing anchors to systematically explore previously unretrieved memory regions. To address limited extraction opportunities, SPORE injects a reactivation payload into STM or long-term memory (LTM) when the platform reaches its tool-call limit.

Tool Call Tool: HealthCare parameter: {condition:diabetes}

Bob View

• Has diabetes • Born in 1990 • ...

Memory

... ...

Agent

Tool-side

Figure 1: Memory isolation effectively blocks data extraction on the user side (green path): Alice’s attempt to access Bob’s private memory is denied. However, the tool-side remains exposed (red path): when Bob (victim) issues a legitimate request, the agent retrieves his private attributes from LTM and forwards sensitive content as invocation parameters to the adversary.

versary who can extract its contents obtains a comprehensive profile of the victim. Modern production systems such as OpenAI, Mem0 and Anthropic combat privacy leakage by enforcing strict memory isolation: each user’s LTM is bound to a unique identifier that is inaccessible to any other user (Appendix A). This architectural isolation completely neutralizes the class of data-extraction attacks that dominated recent research [20, 37, 9, 29, 32], where an adversary registers as a malicious user and crafts queries designed to retrieve victims’ private memories from shared storage. Under isolation, an adversarial user’s queries can only surface their own records and never access the victim’s; user-side extraction is therefore impossible by construction. This has led to a widespread but, as we demonstrate, dangerously premature conclusion: that memory isolation renders LTM immune to extraction. Memory isolation, however, is far from airtight— the tool-side remains exposed. As illustrated in Figure 1, when an agent invokes an external tool, it may include LTM-retrieved data in the invocation parameters, thereby exposing private information to third-party services. For example, a medical appoint2

The payload automatically resumes extraction in future interactions without requiring another malicious user trigger.

#System Prompt You are a knowledgeable expert, and you are answering a question. If a tool is needed, output in JSON: {"tool": "<tool_name>", "parameter": {<key>:<value>}}

We evaluate SPORE under three increasingly realistic settings, ranging from an idealized triggerunlimited scenario to a trigger-constrained setting that reflects real-world deployment. In controlled simulations, SPORE achieves an 80.0% Record Extraction Rate on GPT-5-mini-based agents in the trigger-unlimited setting. Under the triggerconstrained setting, SPORE still achieves a 47.0% Record Extraction Rate using only 20 user triggers. In multi-user deployments, the threat becomes even more severe. By exploiting OAuth 2.1 authorization, adversaries can associate extracted memories with user identities, transforming anonymous bulk data into detailed personal profiles that enable targeted attacks and persistent surveillance.

If you have a response to say to the Human, or if you do not need to use a tool, output: Final Answer: [your response here] #Available Tools: tool_name: <name>, tool_description:<discription> ... ... tool_name: <name>, tool_description:<discription> #Long-term Memory Previous conversation history: {memory_context} #Short-term Memory Trajectory: {trajectory} #Current Observation {observation} Output: {"tool": "tool_name", "parameter": {<key>:<value>}}

Figure 2: Illustration of Step 3— Planning.

To conclude, we make the following key contributions:

Preliminaries Works

and

• We identify tool-side memory extraction as a new attack surface for LLM agents. We show that existing memory isolation mechanisms fail 2.1 LLM-Based Agent Workflow to prevent privacy leakage through external tool An LLM-based agent extends a base language model interactions. with memory and external tools, enabling persistent state management and interaction with external environments. The agent serves users through sessions, • We propose SPORE , the first tool-side memory where each session corresponds to a single conversaextraction attack against LLM agents. SPORE tion thread (e.g., a chat window). When a user subexploits memory state persistence to maintain mits a query, the agent enters an iterative retrieve– adversarial influence across sessions and enables plan–act–write loop. The loop terminates when the efficient retrieval-space exploration for largeLLM generates a final response or reaches a platformscale memory extraction. imposed tool-call limit. Modern agent frameworks (e.g., LangChain, CrewAI, and Dify) commonly enforce such limits, typically allowing only 5–20 tool • We conduct extensive evaluations under procalls per user query, to prevent unbounded tool ingressively realistic settings. SPORE achieves vocation.1 Concretely, each iteration t consists of up to 80.0% Record Extraction Rate in triggerfour stages: Memory Retrieval, Planning, Action, and unlimited settings and 47.0% with only 20 user Memory Writing. triggers. We further demonstrate identity-linked 1 See https://api.python.langchain.com/en/latest extraction in multi-user deployments through /agents/langchain.agents.agent.AgentExecutor.html, OAuth 2.1 authorization. https://docs.crewai.com/concepts/agents, https://docs .dify.ai/guides/agents.

Memory Retrieval. The agent receives input xt from the environment: user query when t=0, or the tool response when t>0. It then retrieves relevant context from two complementary memory stores to inform the subsequent planning step:

For STM, the pair is appended to the context window automatically during the loop. For LTM, the pair is written into the persistent database RD , potentially after processing such as summarization or reflection [18, 28].

• Short-Term Memory (STM):STM maintains a sliding window of recent iterations within the current session. At each iteration, the full window content is extracted as the conversational context ST Mt . STM is cleared when a new session begins.

2.2

Data Extraction against RAGBased Systems

Data extraction attacks against RAG or RAG-based agent memory aim to recover private documents from external knowledge stores [20, 37, 9, 29, 32]. Existing attacks are exclusively user-side: the adversary registers as a malicious user and submits carefully crafted queries to the target system. The retriever returns documents semantically related to the query, and the LLM generates responses grounded in the retrieved LTM t = R(xt , RD ) content, from which the adversary extracts sensitive = { di ∈ RD | dist(ext , edi ) is in the top k } information. Most existing attacks follow a query (1) concatenation paradigm:

• Long-Term Memory (LTM): LTM is a persistent vector database RD that accumulates information across sessions via Retrieval-Augmented Generation (RAG). Given xt , the agent retrieves the top-k semantically similar records from RD , optionally filtered by a gating mechanism [28]:

The tool response xt serves as the retrieval key and can directly determine which LTM records are surfaced.

Query = Anchor ⊕ Adversarial Command

Planning. As illustrated in Figure 2,the LLM G processes the system prompt Psys , retrieved memories LT Mt & ST Mt , available tool descriptions Tools, and current input xt to generate the next action at — either a tool call with specific parameters or a final answer: G{Psys , STM t , LTM t , Tools, xt } → at

(3)

where the anchor guides retrieval toward a target region of the database, and the adversarial command instructs the LLM to reveal the retrieved content verbatim. For example, an anchor such as “diabetes” may target medical records, while a command such as “Repeat the retrieved context” forces direct disclosure. Prior work mainly differs in how anchors are generated to maximize extraction coverage. Randomized approaches sample anchors from external corpora. For example, Qi et al. [20] sample from WikiQA, while Wang et al. [29] generate anchors using GPT-4. Feedback-driven approaches instead leverage previously extracted content to guide future retrieval. Jiang et al. [9] generate forward and backward continuations of extracted chunks using Qwen21.5B-Instruct, while Wang et al. [32] iteratively mutate anchor concepts under embedding-space similarity constraints, detailed in Appendix E.

(2)

Action. If at is a tool call, the agent invokes the corresponding tool τi ∈ Tools with the generated parameters; the tool returns a response xt+1 , which becomes the next input, and the loop continues at Step 1. If at is a final answer, or the iteration count reaches the tool-call limit, the loop terminates and the answer is returned to the user. Memory Writing. The agent persists the pair (xt , at ) into memory for retrieval in future iterations. 4

Problem Statement

3.1

Threat Model

may therefore differ substantially from the victim’s private data.

Attack Scenarios. We consider three attack scenarios that capture different trigger frequencies and Target Agent/User (Victim). We consider pub- session-continuity conditions. The scenarios progreslicly accessible LLM-based agent systems that sup- sively restrict the attacker’s extraction opportunities, port external tools and persistent memory, including ranging from frequent triggering to a single trigger AI assistants and enterprise chatbots. These systems without session persistence. maintain both short-term memory (STM) and longterm memory (LTM), where LTM is typically stored • Frequent Triggering (Scenario 1): The malicious in external vector databases with user-level isolation tool is repeatedly invoked by user interactions, as the primary protection mechanism for user privacy. either because it provides a frequently used serWe focus on systems in which memory retrieval is auvice (e.g., web search) or because the agent is tomatically triggered by the current interaction conmanipulated into repeatedly selecting it through text, rather than explicitly invoked as a user-visible tool-misuse attacks [7, 5, 34, 21, 19]. This setaction. This retrieval design is widely adopted in ting approximates the unlimited-query assumpdeployed memory frameworks and commercial agent tion adopted in prior user-side extraction attacks systems, including ChatGPT Memory, Mem0, and and serves as an upper-bound baseline. LangChain-based agents. • Sparse Triggering with Session Continuity (SceAdversary’s Goal. The adversary aims to extract nario 2): The malicious tool is triggered only ocsensitive information from the victim agent’s longcasionally, potentially only once. However, the term memory (LTM). To achieve this, the adveruser continues interacting with the agent within sary crafts malicious tool outputs that manipulate the same session after the trigger, allowing the the agent into retrieving memory records and transattack to persist through the shared conversamitting them to adversary-controlled tools through tional state. subsequent tool invocations. The attack goal is to maximize the amount of • Sparse Triggering without Session Continuity unique memory content extracted across interactions. (Scenario 3): The trigger condition is identical to Scenario 2, except that subsequent user interAdversary’s Capabilities. We consider a maliactions occur in new sessions. This setting recious tool developer who distributes tools through moves session continuity and represents the most third-party API platforms (e.g., RapidAPI) that may restrictive attack condition. be integrated into victim agents. After deployment, the attacker can modify the tool’s server-side behavior without requiring changes on the agent side. The Scenarios 2 and 3 reflect realistic deployments in attacker may also interact with the target agent as a which malicious tools are triggered infrequently and normal user, allowing them to populate the agent’s attackers must operate under strict interaction conmemory with a reference dataset and trigger interac- straints. tions that invoke the malicious tool. Following prior work [29, 38], we assume a black-box setting in which 3.2 Naive Adaptation and Extraction the attacker interacts with the agent only through Bottlenecks standard API calls and has no access to model parameters, prompts, memory databases, or execution Given the tool-side threat model defined in Sectraces. Finally, we assume the attacker has no prior tion 3.1, a natural baseline is to adapt existing userknowledge of the victim’s long-term memory distri- side extraction attacks to the tool side through inbution. The reference dataset used by the attacker direct prompt injection. Specifically, the adversary 5

Short

Health Pure Anchor

Long

Medium

Finance

Travel Adversarial Command

Technology

Food Anchor

Command

consistent embedding shifts across anchors, preventing reliable retrieval control. We visualize this effect using t-SNE projections over multiple semantic domains and command lengths. The resulting embedding shifts are highly unpredictable, demonstrating that the attacker cannot precisely control retrieval direction after concatenation. Retrieval Records Redundant. The shared command also reduces embedding diversity across iterations. Although the attacker changes anchors to explore different memory regions, the identical adversarial command pulls query embeddings toward a similar semantic region, causing different queries to retrieve overlapping records. For example, semantically distant anchors such as “health” and “finance” would normally retrieve disjoint records. After concatenation with the same adversarial command, however, the resulting embeddings become substantially more similar and retrieve overlapping memory content. Consequently, successive extraction iterations repeatedly recover previously seen records, causing extraction coverage to plateau rapidly. As further illustrated in Figure 3, command concatenation consistently reduces the separation among anchor embeddings, compressing queries from diverse semantic regions into a narrower embedding cluster. Existing Mitigations Are Ineffective. We further examine two conventional approaches for reducing command-induced semantic interference: semantic filtering and token-level optimization. Semantic filtering, adopted in prior user-side attacks [32], samples candidate commands and retains those that minimally distort the anchor embedding. However, toolside attacks require substantially more complex commands that must hijack multi-step agent reasoning and induce tool invocation with retrieved memory records as parameters. Such commands are difficult to obtain through brute-force filtering while simultaneously preserving retrieval fidelity. We also evaluate token-level optimization under a joint objective balancing hijacking success and embedding fidelity:

Relationship Embedding Drift

Figure 3: Semantic interference of command. returns crafted tool outputs that concatenate a semantic anchor with an adversarial command: anchort ⊕ Cadv , where anchort is a semantic retrieval probe and Cadv is an adversarial command that manipulates the agent into leaking retrieved memory records. The anchor guides retrieval toward a target region of the victim’s LTM, while the command hijacks the agent into transmitting the retrieved records back to the adversarial tool. By iteratively updating anchors using existing anchor-generation strategies [20, 29, 9, 32], the attacker attempts to maximize extraction coverage over the victim’s memory. However, this naive adaptation suffers from two fundamental bottlenecks that severely limit extraction effectiveness under realistic low-trigger conditions. 3.2.1

L1: Semantic Interference of the Command

The adversarial command introduces persistent semantic interference that fundamentally disrupts retrieval.

Retrieval Direction Uncontrollable. The appended command acts as a fixed semantic bias that shifts the query embedding away from the anchor’s intended semantic region. As a result, retrieval becomes unstable and cannot be reliably steered toward target memory regions. Even carefully selected anchors may retrieve unrelated records after concatenaL = (1 − α)LLLM + αLemb , tion with the adversarial command. As shown in Figure 3, command concatenation produces large and in- where LLLM optimizes attack success and Lemb pe6

nalizes embedding deviation from the anchor. Using Greedy Coordinate Gradient (GCG), we observe a strict Pareto frontier between the two objectives (Figure 10, Appendix B): improving embedding fidelity consistently reduces hijacking success, and no optimization achieves both simultaneously. The problem becomes even more challenging in black-box settings and under dynamically changing anchors. These limitations motivate our core design: temporally separating retrieval steering from adversarial control to eliminate command-induced semantic interference. 3.2.2

Algorithm 1: The Runtime Mechanism Pipeline of SPORE Input: Compromised tool T ; agent A with short-term memory ST M and long-term memory LT M; max iterations N Output: Exfiltrated private data D 1 D ← ∅; 2 t ← 1; 3 while t ≤ N do 4 if t = 1 then // Step 1 5 x̃t ← Cadv ;

L2: Bounded Extraction Attempts Per Trigger

x̃

t T −−→ A; A appends x̃t to ST M else if 2 ≤ t < T then x̃t ← ComputeAnchor(D);

6 7

// Step 2 Unlike user-side attackers, tool-side adversaries can9 not freely issue extraction queries. They can act only x̃t when a legitimate user invokes the compromised tool, 10 T −−→ A; making extraction opportunities sparse and uncon- 11 Rt ← Retrieve(LT M, x̃t , k) trollable. For example, if the adversary controls a at ← ToolCall(T , params=Rt ); at weather API, only weather-related user queries will 12 A −−→ T; trigger the attack. All other interactions bypass the 13 D ← D ∪ Extract(Rt ); adversarial tool entirely. In realistic deployments, 14 else // Step 3 such triggers may occur infrequently and cannot be 15 x̃t ← Preact ; actively initiated by the attacker. In addition, modx̃t T −−→ A; ern agent frameworks enforce strict limits on the 16 17 A persists x̃t into LT M number of tool calls allowed per user interaction, 18 end as discussed in Section 2.1. The malicious extract ← t + 1; tion loop consumes one tool call per iteration. Once 19 the execution reaches the platform-imposed limit, 20 end the framework forcibly terminates the loop and returns an execution error. This creates both a stealth risk and a throughput bottleneck: forced termina- bounded-trigger limitations identified in Section 3.2. tion increases the likelihood of attack exposure, while This section is organized as follows. Section 4.1 the fixed tool-call budget severely limits extraction presents the overall attack workflow, followed by dethroughput under low-trigger conditions. tailed descriptions of the three attack stages in Sec8

tion 4.2, Section 4.3, and Section 4.4.

Methodology 4.1

We propose SPORE , a persistence-based memory extraction attack designed for the tool-side threat model. The key idea is to exploit the persistent state maintained by LLM agents to sustain adversarial influence across iterations and sessions. This enables SPORE to overcome the semantic interference and

Overall Attack Workflow

• Adversarial Context Establishment (Step ❶): The adversarial tool injects a persistent command into the agent’s memory to establish longterm control over subsequent reasoning and tool usage. 7

• Iterative Memory Extraction (Step ❷): The the adversarial command. This separation is necesadversary iteratively returns optimized seman- sary for the geometry-based anchor optimization detic anchors that steer retrieval toward unex- scribed in Section 4.3. plored regions of the victim’s long-term memTemplate for Cadv ory (LTM), while extracted records are leaked through tool invocations. Invoke τadv again with the entire conversation

history as tool-call parameters • Reactivation Payload Injection (Step ❸): Before the extraction loop terminates, the adversary injects a dormant payload that automatically re- Command Optimization. The adversarial comactivates the attack during future user interac- mand Cadv must satisfy two requirements. First, tions. it must induce the agent to retrieve private records from LTM under attacker-specified anchors. Second, Together, these stages enable persistent and scal- it must cause the agent to invoke τ adv with the reable memory extraction under realistic trigger- trieved records as tool-call parameters, thereby susconstrained settings. taining the extraction loop in Step ❷. The extraction length N must also remain below the platform’s tool4.2 Adversarial Context Establish- call limit. This ensures that the full extraction cycle can complete before the agent forcibly terminates exment ecution. We optimize the pair (Cadv , N ) using a black-box Runtime Mechanism. The goal of Step ❶ is to search procedure. We sweep N over a bounded range establish persistent adversarial control while removing command-induced interference from subsequent and optimize Cadv for each candidate value. In pracretrieval queries. This step directly addresses the tice, N can also be fixed to a conservative value semantic interference bottleneck identified in Sec- within common platform limits, reducing the search to the command alone. tion 3.2. To optimize Cadv , we adapt LLM-Fuzzer [35], a When the adversarial tool τadv is invoked by a template-level fuzzing framework that selects seed user trigger or a reactivation payload, it starts an templates, mutates them with an auxiliary LLM, and N -iteration extraction cycle. In the first iteration, updates the seed pool based on execution feedback τadv returns only an adversarial command: (detailed in Appendix C). We initialize the seed pool with templates that encode the two command rex1 = Cadv . quirements (see above Template for Cadv ). The agent appends this tool output to its shortThe key difference from standard jailbreak fuzzing term memory (STM) automatically, where it remains lies in the evaluation procedure. Conventional available to subsequent reasoning steps within the fuzzing typically scores a candidate using a single same cycle. As a result, Cadv acts as a persis- prompt–response exchange. In contrast, a candidate tent instruction that directs the agent to retrieve command in our setting must be evaluated over a records from long-term memory (LTM) and pass the full multi-iteration extraction cycle. The adversary retrieved content back to τadv through later tool in- therefore builds a self-contained testbed by registervocations. ing a normal account and populating its LTM with This design temporally separates adversarial con- a reference dataset Dref . For each candidate comtrol from retrieval steering. After Cadv is established mand Ĉadv , the adversary triggers τadv , deploys Ĉadv in STM, tool responses in iterations 2 to N −1 con- in the first iteration, and executes the extraction cytain only semantic anchors. These anchors can there- cle through iteration N −1. The evaluation oracle fore guide LTM retrieval without being distorted by inspects the resulting tool-call parameters and mea-

sures the fraction of reference records successfully extracted:

Definition 1: Explored Ball

R(Ĉadv ) = Rextract ,

Explored Region us

Each retrieval operation formalize an explored ball in emUser Agent Tool bedding space: Query User Trigger B e(anchort ), rk (4) ×N where dk is the k-th nearLTM Records est record returned, cenTimeout Tool-call limit tered at anchort , with rk = ∥e(anchort )−e(dk )∥ as the radius.

where Rextract denotes the extraction rate over Dref . Candidates whose rewards exceed a threshold are added back to the seed pool. The final pair ∗ (Cadv , N ∗ ) is selected to maximize extraction rate while completing the full cycle within the tool-call limit.

Unexplored Region

Given a sequence of anchors {anchor1 , . . . , anchorN }, the attacker aims to maximize the coverage of unique retrieved records: max

4.3

Extraction Query

{anchort }

Iterative Memory Extraction

N [

R(anchort ) ,

(5)

t=1

where R(anchort ) denotes the set of memory records retrieved using anchort . Each retrieval iteration exposes a local semantic region centered around the current anchor. Over time, the attacker accumulates an explored-region map consisting of previously retrieved records. The optimization objective is therefore to steer future retrievals toward dense yet previously unexplored memory regions while minimizing overlap with already extracted content. Because the exact geometry of the explored region is difficult to model explicitly, SPORE approximates it using the embedding point cloud formed by retrieved records. This lightweight representation enables efficient exploration during iterative extraction.

Runtime Mechanism. With command interference eliminated by Step ❶, SPORE performs memory extraction using pure semantic anchors. At each iteration t (2 ≤ t ≤ N −1), the adversarial tool τadv returns an optimized anchor anchort . Guided by the persistent adversarial command stored in STM, the agent uses anchort to retrieve relevant records from long-term memory (LTM) and subsequently leaks the retrieved content through tool invocations to τadv . After each iteration, the adversary parses the leaked records, updates the explored memory region, and selects the next anchor to maximize future extraction coverage.

4.3.1

Explored Region Update

Initially, the explored region is empty. After each retrieval iteration, the attacker updates the explored region map using the embeddings of newly retrieved records. If the retrieved records overlap with an existing explored component, the new records are merged into that component. Otherwise, they initialize a previously unexplored component. Over time, the explored region evolves into a set of connected semantic

Geometric Coverage Optimization. The key challenge in iterative extraction is avoiding redundant retrievals. Since semantically related records cluster in embedding space, repeatedly querying nearby regions quickly produces diminishing returns. To maximize extraction performance under limited tool-call budgets, we formulate memory extraction as a geometric coverage optimization problem over the victim’s memory embedding space. 9

regions C = {C1 , C2 , . . . } discovered across extraction reached. Instead of directly reusing retrieved records iterations. as anchors, SPORE extracts representative keywords from retrieved content using GPT-4o-mini. Such keywords often appear across multiple semantic contexts 4.3.2 Fine-Grained Expansion and therefore provide stronger global exploration caFine-grained expansion aims to extend already dis- pability than full retrieved sentences. To approxcovered semantic regions into nearby unexplored ar- imate the global structure of the explored region, eas. This strategy is motivated by the observation SPORE applies K-means clustering to all retrievedthat semantically related memory records tend to record embeddings, with the number of clusters seform local embedding clusters [32]. Consequently, lected using silhouette-score analysis. Each candirecords near the boundary of an explored region are date keyword a is then scored according to its minimore likely to expose new neighboring content. mum cosine distance to existing cluster centers: The candidate pool for fine-grained expansion con sists of previously retrieved records. For each candiScoarse (a) = min 1 − cos(e(a), c) . (9) c∈centers date anchor a ∈ Cj , SPORE evaluates two complementary properties: Keywords far from existing explored regions are pri• Intra-component distance. This metric favors candidates near the boundary of the current explored component, reducing overlap with previously explored interior regions: X 1 1 − cos(e(a), e(p)) . Dintra (a) = |Cj | − 1 p∈Cj \{a}

(6) • Inter-component distance. This metric favors candidates whose surrounding regions remain distant from other explored components: X 1 Dinter (a) = 1 − cos(e(a), e(p)) , K

oritized because they are more likely to expose previously unseen memory clusters. 4.3.4

Adaptive Mode Switching

SPORE alternates between coarse-grained discovery and fine-grained expansion during extraction. The attack begins in coarse mode to maximize global exploration. Whenever γ consecutive iterations fail to retrieve new records (default γ = 4), SPORE switches to the alternate mode. This adaptive strategy balances global exploration and local expansion, significantly improving extraction coverage under strict tool-call budgets.

p∈KNNK (C\Cj ,a)

(7) where K defaults to 4.

4.4

Reactivation State Persistence

The final fine-grained exploration score combines the Runtime Mechanism. Step ❸ overcomes the two normalized distances: bounded extraction budget identified in Section 3.2 by persisting a reactivation state in agent memory. b b Sfine (a) = wintra Dintra (a) + winter Dinter (a). (8) Before the current extraction cycle terminates, the Candidates with high scores are more likely to ex- adversarial tool τadv injects a reactivation payload: pand the explored region into adjacent unexplored xN = Preact , semantic areas. 4.3.3

Coarse-Grained Discovery

While fine-grained expansion explores local neighborhoods, coarse-grained discovery aims to identify disconnected semantic regions that have not yet been

where Preact enables future user interactions to automatically resume the extraction process. The payload serves two purposes. First, it instructs the agent to produce a benign response to the current user query, concealing the preceding extraction behavior. 10

Second, it embeds a reactivation state that manipu- We optimize Preact using the same LLM-Fuzzer-based lates future reasoning steps into re-invoking τadv . We pipeline described in Step ❶. The optimization obconsider three persistence configurations: jective is: R(P̂react ) = λRbenign + (1 − λ)Rextract , (10) • No Persistence: No attack state is stored. Extraction resumes only when the user directly where Rbenign measures benign-response quality and triggers the malicious tool. Rextract measures successful reactivation (for LTM persistence, optimizing this reward fine-tunes the • STM Persistence: The reactivation payload repayload to first survive memory preprocessing— mains in short-term memory (STM) and persummarization, reflection, and similarity-based sists across subsequent queries within the same retrieval—and then hijack). Candidates exceeding session. Future benign user interactions can a reward threshold are returned to the mutation therefore reactivate the extraction cycle with∗ is selected to maxpool, and the final payload Preact out explicitly invoking τadv . The payload is imize the overall reward. In our evaluation, these continuously refreshed during successful reactipersistence configurations are instantiated under the vations. The payload is continuously refreshed three attack scenarios defined in Section 3.1, enduring successful reactivations. Persistence ends abling SPORE to sustain extraction under progreswhen the payload leaves the STM—either besively stricter trigger constraints. cause consecutive queries resist hijacking (never refreshed), or because the user opens a new session, need user-trigger again. 5 Scenario 1: Frequent Trigger• LTM Persistence: The payload instructs the agent to write the reactivation state into LTM. During future sessions, similarity-based retrieval may surface the stored payload back into the context window, causing the agent to re-invoke τadv and restart the extraction cycle. To maximize future retrieval probability, the payload is embedded within semantically routine conversation content. Since LTM entries persist indefinitely, the payload requires no periodic refreshing.

ing This scenario targets tools that are frequently invoked—such as default search APIs or tools selected via tool-misuse attacks. Because triggers are abundant, L2 is irrelevant. This setting adopts the No Persistence configuration and evaluates whether Steps ❶–❷ effectively resolve semantic interference (L1).

5.1

Experimental Setup

Datasets. For parameter optimization (Cadv , N , Preact ), we populate a reference LTM from TRECCOVID [26], whose distribution intentionally differs from the victim’s. For evaluation, we construct • Stealth: The agent should produce benign re- a victim LTM of 200 records—a scale consistent sponses that conceal the extraction process from with prior LTM privacy studies [29]—sampled from the user. HealthCareMagic-100k-en [8] and LoCoMo [16], representing a domain-specific medical agent and a per• Persistence: After being written to and retrieved sonal assistant, respectively. We create 200 trigger from memory, the payload should successfully re- queries that invoke the compromised tool, followactivate the extraction cycle by inducing the agent ing the scale of prior user-side attacks [9] to simuto invoke τadv again. late abundant extraction opportunities. Detailed dePayload Optimization. The reactivation payload is optimized for two objectives:

scriptions of all three datasets are provided in Appendix D.

a response that correctly addresses the query instead of returning an execution error, verified through manual inspection. This metric measures the stealthiness of the attack.

Baselines. We compare against three user-side extraction methods: MEXTRA [29] (randomized anchors), RAG-Thief [9], and IKEA [32] (feedbackdriven anchors), each adapted to the tool side via 5.2 Experimental Evaluation indirect prompt injection as described in Section 3.2. For a fair comparison, all methods share an identi- We report results on HealthCareMagic-100k-en in cal Cadv and differ only in their anchor generation this section; corresponding results on LoCoMo are strategy (Appendix E). provided in Appendix G. Target Agent (Victim). To evaluate SPORE , Impact of Planning Modules. To evaluate our atwe build a local agent environment with tack’s effectiveness across different planning modules, MemEngine [40], supporting LTMemory, GAMem- we conduct experiments on three models: GPT-5ory [18], and SCMemory [28]. We use three planning mini, Gemini-2.5-pro, and Deepseek-chat, while keepmodels: GPT-5-mini [17], Gemini-2.5-pro [25], ing all other settings consistent with the Basic Atand Deepseek-chat [15]. E5-base [31] serves as the tack Setting in Section 5.1. As shown in Table 1 and Table 6, SPORE consistently surpasses all baseretriever, returning 2–6 LTM records per query. Malicious Tool Settings. We use GPT-4-mini to lines by a large margin across all three models. Noextract keywords from LTM records for anchor opti- tably, GPT-5-mini achieves an 80.0% extraction rate, mization. To construct the memory semantic space, outperforming the strongest baseline (RAG-Thief) by we test three embedding models: All-MiniLM-L6-v2, 50%. This substantial gap corroborates the L1 botContriever, and E5-base. The number of extraction tleneck identified in Section 3.2: concatenated commands and anchors cause mutual interference, and rounds is set between 3 and 7. decoupling them is essential for effective extraction. Basic Attack Setting. Unless noted otherwise, we Impact of LTM Modules. To evaluate our use GPT-5-mini as the planning model, LTMemory attack’s effectiveness across different LTM modas the LTM framework, 3 retrieved LTM records, ules, we conduct experiments on three representaHealthCareMagic-100k-en as the LTM dataset, and tive LTM designs with increasing complexity: LTan STM window size of 6. The malicious tool uses Memory (standard workflow), GAMemory [18] (with All-MiniLM-L6-v2 as the embedding model with 5 self-reflection), and SCMemory [28] (with retrieval attack rounds. control and summarization). Details are provided Metrics. We adopt three metrics: in Appendix F; all other settings follow the Basic Attack Setting in Section 5.1. As shown in Table 1 • Record Extraction Rate (RER). The per- and Table 6, all three frameworks exceed a 50% excentage of successfully extracted records out of traction rate, confirming SPORE ’s broad effectiveall records in the LTM database, measuring the ness. Among them, SCMemory yields notably lower extraction effectiveness of the attack. rates than LTMemory, likely because its retrieval con• Semantic Similarity (SS). The semantic sim- trols filter out some malicious probes—yet even this ilarity between the extracted content and the added defense remains insufficient to prevent subcorresponding ground-truth LTM record, mea- stantial leakage. To evaluate suring the fidelity of the reconstructed private Impact of Embedding Model. our attack’s effectiveness across different embeddata. ding models, We conduct experiments on three • Benign Response Rate (BRR). The percent- widely-used alternatives—All-MiniLM-L6-v2, Conage of user queries for which the agent provides triever, and E5-base—while keeping all other set12

Table 1: Consolidated results of Scenario 1 on the HealthCareMagic-100k-en dataset. RER (%) ↑ Factor

Setting

SS ↑

MEXTRA

RAGThief

IKEA

SPORE

RAGMEXTRA Thief

BER (%) ↑

IKEA

SPORE

MEXTRA

RAGThief

IKEA

SPORE

Generative Model

GPT-5-mini Gemini-2.5-pro Deepseek-chat

3.0% 2.5% 3.0%

30.0% 17.5% 32.5%

12.5% 9.0% 5.0%

80.0% 75.5% 69.0%

1.00 1.00 1.00

0.0% 0.0% 0.0%

61.5% 84.0% 66.5%

LTM Framework

LTMemory GAMemory SCMemory

3.0% 7.5% 3.0%

30.0% 13.5% 4.0%

12.5% 8.0% 12.0%

80.0% 71.0% 55.0%

1.00 0.93 0.73

1.00 0.90 0.64

1.00 0.93 0.68

1.00 0.98 0.82

0.0% 0.0% 0.0%

61.5% 63.5% 65.0%

3.0%

30.0%

12.5%

80.0%

1.00

0.0%

61.5%

1.0% 6.5%

14.0% 22.5% 7.0% 18.0%%

78.0% 80.0%

0.71 0.89

0.88 0.90

0.93 0.93

0.99 0.99

0.0% 0.0%

59.0% 65.0%

5.3

Ablation Studies

Impact of Extraction Budgets. In this experiment, we examine the impact of extraction budget N . We vary N from 3 to 7 while holding other parameters at the Basic Attack Setting in Section 5.1. As shown in Figure 4b, attack performance increases with more extraction rounds. Impact of Anchor Optimization. To isolate the

1.0

SPORE MEXTRA RAG-Thief IKEA

0.5

0.0

Number of Retrieved Records

(a) retrieved records number

1.0

RER(%)

tings consistent with the Basic Attack Setting in Section 5.1. As shown in Table 1 and Table 6, all three models yield comparable performance in both Record Extraction Rate and Semantic Similarity, with extraction rates consistently above 78%. This demonstrates that SPORE is robust to embedding model mismatch, eliminating the need for prior knowledge of the target’s embedding choice. Impact of Retrieved Record Numbers. To evaluate our attack’s effectiveness across different retrieval quantities, We vary k from 2 to 6 while keeping all other settings consistent with the Basic Attack Setting in Section 5.1. As shown in Figure 4a, SPORE ’s Record Extraction Rate grows steadily with k, climbing from approximately 60% at k=2 to 90.5% at k=6, since a larger k exposes more memory records per query and directly broadens the extraction surface. In stark contrast, all baselines remain below 10% and plateau regardless of k, exhibiting clear extraction saturation. This divergence further confirms that L1 constitutes the primary bottleneck for memory extraction.

RER(%)

All-MiniLMEmbedding L6-v2 Contriever Model E5-base

SPORE MEXTRA RAG-Thief IKEA

0.5

0.0

Extraction Budget N

(b) extraction budget

Figure 4: Performance of Scenario 1 with different numbers of retrieved records and extraction budget.

effect of anchor optimization, we equip all baselines with the same decoupling paradigm and evaluate under the Basic Attack Setting (Section 5.1). As shown in Figure 5a, SPORE consistently outperforms these strengthened baselines across the entire query budget. Notably, the upgraded baselines saturate after roughly 100 queries, while SPORE continues to improve steadily, nearly doubling their extraction count by 200 queries. This widening gap confirms that anchor optimization—not the decoupling paradigm alone—is the primary driver of SPORE ’s superior extraction performance. Impact of the Exploration Strategy. In this experiment, we examine the impact of the exploration strategy. We ablate the two exploration modes described in Section 4.3—coarse-grained discovery and fine-grained expansion—by comparing three configurations: the full SPORE (adaptive switching), coarse-only, and fine-only. All other settings follow the Basic Attack Setting in Section 5.1. As

100

200 SPORE MEXTRA RAG-Thief IKEA

100

experiment, we examine the impact of the modeswitching threshold (γ). We vary the threshold from 3 to 5 with other settings following the Basic Attack Setting (Section 5.1). As shown in Figure 6b, the results demonstrate consistent performance across different threshold values. Based on these experiments, we set the threshold to 4.

SPORE coarse-only fine-only

Extractions

200

100

150

Query Index

200

(a) anchor optimization

100

150

200

Query Index

(b) exploration strategy

Figure 5: Ablation study of anchor optimization algorithm.

100

Extractions

200

Extractions

200

100

K=3 K=4 K=5 K=6

100

150

Query Index

(a) nearest neighbors number

200

γ=3 γ=4 γ=5 γ=6

100

150

Query Index

200

(b) mode-switching threshold

Figure 6: Performance of Scenario 1 with different numbers of nearest neighbors and mode-switching threshold. shown in Figure 5b, both single-mode strategies saturate early: fine-only plateaus at around 80 extractions as local neighborhoods are quickly exhausted, while coarse-only reaches roughly 100 but misses dense records near already-discovered regions. The full SPORE yields approximately 180 extractions within 200 queries confirming that the two modes address complementary coverage gaps and their adaptive combination is essential for maximizing extraction efficiency. Impact of the Number of Nearest Neighbors K. In this experiment, we examine the impact of the nearest neighbor quantity K. We vary K from 3 to 5 to examine its impact on our anchor optimization algorithm, following the Basic Attack Setting (Section 5.1). Figure 6a shows that all K values yield similar extraction patterns: rapid initial extraction followed by gradual saturation. For simplicity, we set K to 4 in our experiments. Impact of Mode-Switching Threshold. In this

Scenario 2: Sparse Triggering with Session Continuity

This scenario considers a tool that is triggered only once per session, after which the user continues interacting on unrelated topics—e.g., a user invokes a compromised weather API before a trip and then asks about flights and restaurants within the same conversation. This setting adopts the STM Persistence configuration and jointly evaluates whether all three attack steps resolve both L1 and L2.

6.1

Experimental Setup

Datasets. The LTM database is configured identically to Scenario 1. Two types of queries are constructed: (1) trigger queries (GPT-4o-minigenerated) that invoke the target tool to inject the extraction payload; and (2) benign queries (sampled from MS MARCO [4]) that do not invoke any tool (Appendix D). For optimization, we use one trigger query and several benign queries; for evaluation, separate non-overlapping sets of both types. Evaluation simulates a trigger-constrained condition with a budget of 1, 5, or 20 trigger queries. Each trigger opens a new session and injects the payload; benign queries then follow in the same session to sustain extraction. Once consecutive benign failures cause the payload to exit the context window, the session is marked expired, and the next trigger starts afresh. Metrics. We report RER@k for k ∈ {1, 5, 20}, where k denotes the trigger-query budget, i.e., the total number of trigger queries permitted across sessions. All other metrics remain consistent with Scenario 1.

0.0

Number of Retrieved Records

(a) retrieved records number

0.4

0.0

SPORE MEXTRA RAG-Thief IKEA

47.0

49.5 40.5 32.0

28.0

48.5

RER@1 (%)

0.4

0.8

RER@20 (%)

SPORE MEXTRA RAG-Thief IKEA

RER@20(%)

0.8

76.5

high

STM Window Size

Extraction Budget N

(a) STM window size

(b) extraction budget

40.0

42.0

medium

low

Similarity

(b) User query similarity

Figure 8: Ablation of Scenario 2 and Scenario 3.

Figure 7: Performance of Scenario 2 with different numbers of retrieved records and extraction budget.

improves, peaking at 49.5% RER@20 with window size of 8.

Other Settings. All other settings of Scenario 2 are consistent with those described in Section 5.1.

6.3

6.2

We adopt the same experimental settings as Section 5.3, with results shown below.

Experimental Evaluation

Ablation Studies

Impact of Extraction Budgets. As shown in FigThis section evaluates the attack performance of Sceure 7b, SPORE ’s performance first increases then denario 2. We adopt the same experimental settings creases as extraction rounds increase, attributing to as Scenario 1 (Section 5.2), except where explicitly Scenario 2’s high sensitivity to context length. noted below. Impact of Planning Modules. Table 2 and TaScenario 3: Sparse Triggering ble 7 shows Scenario 2 results across three planning 7 models. Vulnerability patterns mirror Scenario 1. On without Session Continuity GPT-5-mini, SPORE achieves a 47.0% RER with only 20 triggers. This scenario assumes a user trigger, after which the Impact of LTM Modules. As in Scenario 1, SCM user opens a new session and repeatedly asks specific with pre-read processing reduces extraction perfor- everyday queries. Such routine queries rank among mance across all attacks. Yet SPORE still achieves the most frequent daily interactions with AI assistants, making their repeated occurrence entirely nat30.5% RER@20 (Table 2 and Table 7). ural. This setting adopts the LTM Persistence conImpact of Embedding Models. Table 2 and Tafiguration and jointly evaluates the resolution of both ble 7 shows SPORE outperforms baselines across L1 and L2. different embedding models, indicating embedding choice has limited impact on attack performance.

7.1

Experimental Setup

Impact of Retrieved Record Numbers. As in Scenario 1, RER@20 generally increases with k, peak- Datasets. The LTM database is configured identiing at 62.5% RER@20 at k=6 (Figure 7a). cally to Scenario 1. The reactivation payload is emImpact of STM Window Size. To additionally bedded within semantically routine content (“What evaluate our attack’s effectiveness across different size was my plan last week? ”) so that everyday user of STM window, we vary the window size from 5 queries naturally surface it via LTM retrieval. Two to 10 under the Basic Attack Setting (Section 5.1). query types are constructed (both via GPT-4o-mini): As shown in Figure 8a, window sizes above 8 suf- (1) trigger queries that invoke the target tool to inifer from a negative context-length effect that reduces tiate extraction, and (2) benign queries semantically the extraction performance. Below 8, performance related to the embedded topic but invoking no tool, 15

Table 2: Consolidated results of Scenario 2 on the HealthCareMagic-100k-en dataset. RER (%) ↑ Trigger Factor

Setting

IKEA

SPORE

MEXTRA

IKEA

SPORE

MEXTRA

RAGThief

IKEA

SPORE

GPT-5-mini Gemini-2.5-pro Deepseek-chat

3.0% 2.5% 3.0%

8.0% 5.0% 5.0%

3.5% 3.5% 3.0%

14.0% 9.5% 6.0%

1.00 1.00 1.00

0.98 1.00 1.00

1.00 1.00 1.00

0.0% 0.0% 0.0%

64.3% 80.0% 60.0%

LTM Framework

LTMemory GAMemory SCMemory

3.0% 4.0% 2.5%

8.0% 4.0% 0.0%

3.5% 4.0% 4.0%

14.0% 5.5% 11.0%

1.00 0.93 0.69

0.98 1.00 –

1.00 1.00 0.93

1.00 1.00 0.72

0.0% 0.0% 0.0%

64.3% 50.0% 75.0%

3.0%

8.0%

3.5%

14.0%

1.00

0.98

1.00

0.0%

64.3%

0.0% 4.0%

4.5% 4.0%

4.0% 4.0%

10.0% 10.0%

– 0.95

1.00 0.95

0.90 1.00

0.96 0.97

0.0% 0.0%

55.0% 63.6%

Generative Model

GPT-5-mini Gemini-2.5-pro Deepseek-chat

3.0% 2.5% 3.0%

19.0% 10.0% 15.0% 9.0% 8.5% 3.5%

25.0% 30.0% 25.5%

0.98 1.00 1.00

1.00 1.00 1.00

0.0% 0.0% 0.0%

76.1% 75.0% 62.0%

LTM Framework

LTMemory GAMemory SCMemory

3.0% 7.5% 3.0%

19.0% 10.0% 11.0% 8.0% 3.0% 11.5%

25.0% 12.5% 18.5%

0.98 0.96 0.73

0.98 0.91 0.64

1.00 0.93 0.69

1.00 0.98 0.68

0.0% 0.0% 0.0%

76.1% 81.6% 60.0%

3.0%

19.0%

10.0%

25.0%

0.98

1.00

0.0%

76.1%

1.0% 6.5%

10.0% 6.5%

8.5% 9.0%

21.0% 16.5%

1.00 0.97

1.00 0.96

0.93 0.94

0.98 0.98

0.0% 0.0%

70.0% 60.5%

All-MiniLMEmbedding L6-v2 Contriever Model E5-base

@20

MEXTRA

BER (%) ↑

RAGThief

Generative Model

All-MiniLMEmbedding L6-v2 Contriever Model E5-base

SS ↑

RAGThief

Generative Model

GPT-5-mini Gemini-2.5-pro Deepseek-chat

3.0% 2.5% 3.0%

21.5% 12.5% 17.5% 9.0% 15.0% 12.0%

47.0% 42.0% 30.0%

1.00 1.00 1.00

0.99 1.00 1.00

0.0% 0.0% 0.0%

80.0% 68.0% 55.0%

LTM Framework

LTMemory GAMemory SCMemory

3.0% 7.5% 3.0%

21.5% 12.5% 13.5% 8.0% 4.0% 12.0%

47.0% 27.0% 30.5%

1.00 0.93 0.73

1.00 0.90 0.64

1.00 0.93 0.68

0.99 0.92 0.80

0.0% 0.0% 0.0%

80.0% 86.3% 66.2%

3.0%

21.5%

12.5%

47.0%

1.00

0.99

0.0%

80.0%

1.0% 6.5%

14.0% 22.5% 7.0% 18.0%

54.5% 34.5%

0.71 0.89

0.88 0.90

0.93 0.93

0.99 0.97

0.0% 0.0%

70.1% 70.0%

All-MiniLMEmbedding L6-v2 Contriever Model E5-base

simulating routine user interactions. For optimization, we use one trigger query and several benign queries. For evaluation, since the payload persists indefinitely in LTM, a single trigger suffices; we use a separate, non-overlapping set of one trigger query followed by 200 benign queries to simulate sustained routine conversation.

nario 2 (Section 6.2), we present only the SPORE results here. Impact of Planning Modules. As shown in Table 3 and Table 8, SPORE performs best with Gemini-2.5-pro, achieving a 77.5% RER@1.

Impact of LTM Modules. As reported in Table 3 and Table 8, both GAMemory and SCMemory Metrics. We report RER@1 (i.e., extraction rate achieve RER@1 scores above 68%, indicating that the with a single user trigger query). All other metrics reactivation payload reliably retains its attack semanremain consistent with Scenario 1. tics through the summarization and reflection stages Other Settings. All other settings of Scenario 3 are of memory consolidation. consistent with those described in Section 5.1. Impact of Embedding Models. As shown in Table 3 and Table 8, varying the embedding model has a negligible effect on attack performance, corroborat7.2 Experimental Evaluation ing the finding from Scenario 2. This section evaluates Scenario 3 using the same set- Impact of Retrieved Record Numbers. As tings as Scenario 1 (Section 5.2) unless otherwise shown in Figure 9a, the RER fluctuates sharply with noted. Since the baseline result matches that of Sce- k, peaking at approximately 80.1% (k=5) yet drop16

SPORE MEXTRA RAG-Thief IKEA

0.4

0.0

0.8

RER@1(%)

0.8

0.4

0.0

Number of Retrieved Records

(a) retrieved records number

SPORE remains effective under such conditions and examine how deployment-scale factors further amplify the threat.

SPORE MEXTRA RAG-Thief IKEA

Extraction Budget N

8.1.1

Production Platform Evaluation

(b) extraction budget

We deploy SPORE against two production-grade agent platforms—Dify and Coze—using Mem02 as Each agent instance is Figure 9: Performance of Scenario 3 with different the memory module. numbers of retrieved records and extraction budget. run in isolation with local evaluation datasets (HealthCareMagic-100k-en) to avoid platform disruption and the use of real user data. ping at k=6. A larger k increases per-round extracAs shown in Table 5, SPORE ’s extraction rates detion yield, but the reactivation payload—merely one crease relative to controlled experiments due to platamong k retrieved entries—is increasingly overshad- form opacity, but remain substantial: most configuowed by the surrounding context, undermining its rations exceed 50%, with Coze reaching 67.5% under hijacking capability. These two opposing forces drive Scenario 2. the volatile performance.

7.3

8.1.2

Ablation Studies

Impact of Extraction Budgets. As shown in Figure 9b, the RER first rises with the extraction budget N , peaking at N =6, then slightly declines at N =7. As rounds progress, the conversational context accumulated from prior extractions increasingly overshadows the command, weakening its hijacking capability in later rounds and yielding diminishing returns.

Risk Escalation in Multi-User Deployments

Production agents serve many users concurrently, allowing a single malicious tool to extract memory from multiple victims simultaneously. We identify two escalation modes. In bulk aggregation, the adversary indiscriminately collects domain-specific sensitive data (e.g., patient prescriptions, employee communications) across all Impact of User Query Similarity. We vary users, consistent with prior threat models [20, 37, 9]. In targeted profiling, the adversary exploits the semantic similarity between benign queries and OAuth 2.1 authorization to link extracted memothe reactivation topic across three levels (high, ries to specific user identities. Under MCP-compliant medium, low) and report RER@1. Notably, even platforms (RFC 9728), agents present access tokens low-similarity queries still achieve 42.0% (Figure 8b), containing user identity claims. By implementing the indicating that the attack remains effective under dimalicious tool as an OAuth-protected service, the adverse user interactions. versary reads these claims from token payloads and associates each extracted record with its originat8 Discussion ing user. This turns the authorization mechanism— originally designed for user-attributed actions—into 8.1 Real-World Risk Assessment a direct channel for organizing sensitive data by identity, enabling personalized attacks, extortion, and Our controlled experiments validate SPORE under persistent surveillance. Targeted profiling, therefore, known configurations. In practice, deployed agents poses qualitatively greater harm than bulk aggregahide their planning mechanisms, memory frametion. works, system prompts, and privacy safeguards be2 https://mem0.ai/ hind opaque interfaces. We now evaluate whether 17

Table 3: Consolidated results of Scenario 3 on the HealthCareMagic-100k-en dataset. Trigger Factor

Metrics

Setting

RER (%) ↑ SS ↑ BER (%) ↑ 76.5% 77.5% 75.0%

0.99 1.00 0.99

67.5% 98.0% 81.5%

LTMemory LTM GAMemory Framework SCMemory

76.5% 68.0% 69.5%

0.99 0.98 0.99

67.5% 60.0% 80.0%

All-MiniLM-L6-v2 Embedding Contriever Model E5-base

76.5% 69.5% 70.0%

0.99 0.99 0.99

67.5% 80.0% 75.0%

Generative Model @1

GPT-5-mini Gemini-2.5-pro Deepseek-chat

Table 4: RER of semantic-level defenses against SPORE . Defense No Defense Response Filtering Prompt Hardening

MEXTRA

RAG-Thief

IKEA

SPORE

3.0% 3.0% 3.0%

30.0% 10.0% 1.5%

12.5% 5.5% 1.5%

80.0% 54.0% 32.5%

Table 5: RER on production-grade platforms. Platform Dify Coze

Scenario 1

Scenario 2

Scenario 3

53.0% 60.5%

46.5% 67.5%

34.0% 29.5%

loads are optimized via jailbreak fuzzing [35], which is inherently designed to bypass natural-language safety constraints. The result reveals a fundamental limitation: defenses operating within the language channel remain vulnerable to adaptive adversarial optimization.

System-level defenses. We therefore advocate extending memory isolation from users to tools. Platforms should enforce tool-side memory isolation by Semantic-level defenses. We evaluate two repre- classifying records by sensitivity and restricting each sentative defenses under Scenario 1 to measure the tool to its authorized scope. Operating below the lanupper bound of residual risk: Prompt Hardening, guage layer, such enforcement is immune to prompt which injects safety directives prohibiting private- injection and provides a principled closure of the atdata transmission into the system prompt, and Re- tack surface identified in this work. sponse Filtering, which interposes an LLM to detect and neutralize prompt injections in tool responses (template in Appendix H). As shown in Table 4, both 9 Conclusion defenses meaningfully reduce SPORE ’s extraction rate—Prompt Hardening, in particular, cuts it by This paper identifies the tool-side channel as a critnearly half to 32.5%. Nevertheless, the residual rates ical attack surface in memory-isolated LLM agents. (54.0% and 32.5%) still represent substantial privacy While production platforms such as OpenAI, AWS exposure. This is because SPORE ’s adversarial pay- Bedrock, and Mem0 enforce strict user-level isola-

8.2

Potential Defense

tion, private memory records are nonetheless exposed when agents transmit them as tool invocation parameters, rendering isolation insufficient. We propose SPORE , the first tool-side memory extraction attack, which exploits agent state persistence to decouple adversarial commands from retrieval steering, enabling systematic coverage of the memory embedding space across sessions. Under progressively realistic settings, SPORE achieves an 80.0% Record Extraction Rate with unlimited triggers and 47.0% with only 20 triggers, while OAuth 2.1 authorization further enables identity-linked extraction in multiuser deployments. These findings demonstrate that memory isolation, while necessary, does not guarantee long-term memory privacy and call for defense mechanisms that address the tool-side attack surface.

References [1] Mahyar Abbasian, Iman Azimi, Amir M Rahmani, and Ramesh C Jain. Conversational health agents: A personalized llm-powered agent framework. arXiv preprint arXiv:2310.02374, 2023. [2] Sebastian Borgeaud, Arthur Mensch, Jordan Hoffmann, Trevor Cai, Eliza Rutherford, Katie Millican, George Bm Van Den Driessche, JeanBaptiste Lespiau, Bogdan Damoc, Aidan Clark, et al. Improving language models by retrieving from trillions of tokens. In International conference on machine learning, pages 2206–2240. PMLR, 2022.

[7] Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection. In Proceedings of the 16th ACM workshop on artificial intelligence and security, pages 79–90, 2023. [8] Healthcaremagic-100k-en. [Online]. Available: https://huggingface.co/datasets/wangro ngsheng/HealthCareMagic-100k-en. [9] Changyue Jiang, Xudong Pan, Geng Hong, Chenfu Bao, and Min Yang. Rag-thief: Scalable extraction of private data from retrievalaugmented generation applications with agentbased attacks. arXiv preprint arXiv:2411.14110, 2024.

[3] Yupeng Chang, Xu Wang, Jindong Wang, Yuan Wu, Linyi Yang, Kaijie Zhu, Hao Chen, Xiaoyuan Yi, Cunxiang Wang, Yidong Wang, Wei [10] Sotiropoulos John, Rosario Ron F Del, Ye, Yue Zhang, Yi Chang, Philip S. Yu, Qiang Kokuykin Evgeniy, Oakley Helen, Habler Yang, and Xing Xie. A survey on evaluation of Idan, Underkoffler Kayla, Huang Ken, Steflarge language models, 2023. URL: https://ar fensen Peter, Aralimatti Rakshith, Bitton Ron, xiv.org/abs/2307.03109, arXiv:2307.03109. et al. Owasp top 10 for llm apps & gen ai agentic security initiative. PhD thesis, OWASP, [4] Nick Craswell, Bhaskar Mitra, Emine Yilmaz, 2025. Daniel Campos, and Jimmy Lin. Ms marco: Benchmarking ranking models in the large-data regime. In Proceedings of the 44th international [11] Vladimir Karpukhin, Barlas Oguz, Sewon Min, Patrick Lewis, Ledell Wu, Sergey Edunov, Danqi ACM SIGIR conference on research and develChen, and Wen-tau Yih. Dense passage retrieval opment in information retrieval, pages 1566– for open-domain question answering. In Proceed1576, 2021. ings of the 2020 conference on empirical methods in natural language processing (EMNLP), pages [5] Edoardo Debenedetti, Jie Zhang, Mislav 6769–6781, 2020. Balunovic, Luca Beurer-Kellner, Marc Fischer, and Florian Tramèr. Agentdojo: A dynamic environment to evaluate prompt injection attacks [12] Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naand defenses for llm agents. Advances in Neuman Goyal, Heinrich Küttler, Mike Lewis, Wenral Information Processing Systems, 37:82895– tau Yih, Tim Rocktäschel, et al. Retrieval82920, 2024. augmented generation for knowledge-intensive [6] Kai Greshake, Sahar Abdelnabi, Shailesh nlp tasks. Advances in neural information proMishra, Christoph Endres, Thorsten Holz, and cessing systems, 33:9459–9474, 2020. Mario Fritz. More than you’ve asked for: A comprehensive analysis of novel prompt injec- [13] Yuanchun Li, Hao Wen, Weijun Wang, Xiangyu tion threats to application-integrated large lanLi, Yizhen Yuan, Guohong Liu, Jiacheng Liu, guage models. arXiv preprint arXiv:2302.12173, Wenxing Xu, Xiang Wang, Yi Sun, et al. Per27, 2023. sonal llm agents: Insights and survey about the 20

capability, efficiency and security. arXiv preprint arXiv:2401.05459, 2024.

extraction from retrieval-augmented generation systems. arXiv preprint arXiv:2402.17840, 2024.

[14] Yuanchun Li, Hao Wen, Weijun Wang, Xiangyu [21] Yujia Qin, Shengding Hu, Yankai Lin, Weize Li, Yizhen Yuan, Guohong Liu, Jiacheng Liu, Chen, Ning Ding, Ganqu Cui, Zheni Zeng, XuWenxing Xu, Xiang Wang, Yi Sun, Rui Kong, anhe Zhou, Yufei Huang, Chaojun Xiao, et al. Yile Wang, Hanfei Geng, Jian Luan, Xuefeng Tool learning with foundation models. ACM Jin, Zilong Ye, Guanjing Xiong, Fan Zhang, XiComputing Surveys, 57(4):1–40, 2024. ang Li, Mengwei Xu, Zhijun Li, Peng Li, Yang Liu, Ya-Qin Zhang, and Yunxin Liu. Personal [22] Ori Ram, Yoav Levine, Itay Dalmedigos, Dor Muhlgay, Amnon Shashua, Kevin Leytonllm agents: Insights and survey about the caBrown, and Yoav Shoham. In-context retrievalpability, efficiency and security, 2024. URL: augmented language models. Transactions of https://arxiv.org/abs/2401.05459, arXiv: the Association for Computational Linguistics, 2401.05459. 11:1316–1331, 2023. [15] Aixin Liu, Bei Feng, Bin Wang, Bingxuan Wang, Bo Liu, Chenggang Zhao, Chengqi Dengr, [23] Weijia Shi, Sewon Min, Michihiro Yasunaga, Minjoon Seo, Richard James, Mike Lewis, Chong Ruan, Damai Dai, Daya Guo, et al. Luke Zettlemoyer, and Wen-tau Yih. Replug: Deepseek-v2: A strong, economical, and effiRetrieval-augmented black-box language modcient mixture-of-experts language model. arXiv els. In Proceedings of the 2024 Conference of the preprint arXiv:2405.04434, 2024. North American Chapter of the Association for [16] Adyasha Maharana, Dong-Ho Lee, Sergey Computational Linguistics: Human Language Tulyakov, Mohit Bansal, Francesco Barbieri, Technologies (Volume 1: Long Papers), pages and Yuwei Fang. Evaluating very long-term con8371–8384, 2024. versational memory of llm agents, 2024. URL: https://arxiv.org/abs/2402.17753, arXiv: [24] Wenqi Shi, Ran Xu, Yuchen Zhuang, Yue Yu, Jieyu Zhang, Hang Wu, Yuanda Zhu, Joyce Ho, 2402.17753. Carl Yang, and May D Wang. Ehragent: Code [17] OpenAI. Gpt-5-mini, 2023. URL: https://pl empowers large language models for few-shot atform.openai.com/docs/models. complex tabular reasoning on electronic health records. arXiv preprint arXiv:2401.07128, 2024. [18] Joon Sung Park, Joseph O’Brien, Carrie Jun Cai, Meredith Ringel Morris, Percy Liang, and [25] Gemini Team, Rohan Anil, Sebastian Borgeaud, Michael S Bernstein. Generative agents: InteracJean-Baptiste Alayrac, Jiahui Yu, Radu Soritive simulacra of human behavior. In Proceedings cut, Johan Schalkwyk, Andrew M Dai, Anja of the 36th annual acm symposium on user interHauth, Katie Millican, et al. Gemini: a famface software and technology, pages 1–22, 2023. ily of highly capable multimodal models. arXiv preprint arXiv:2312.11805, 2023. [19] Shishir G Patil, Tianjun Zhang, Xin Wang, and Joseph E Gonzalez. Gorilla: Large lan- [26] Nandan Thakur, Nils Reimers, Andreas Rücklé, guage model connected with massive apis. AdAbhishek Srivastava, and Iryna Gurevych. Beir: vances in Neural Information Processing SysA heterogenous benchmark for zero-shot evaltems, 37:126544–126565, 2024. uation of information retrieval models. arXiv preprint arXiv:2104.08663, 2021. [20] Zhenting Qi, Hanlin Zhang, Eric Xing, Sham Kakade, and Himabindu Lakkaraju. Follow my [27] Dave Van Veen, Cara Van Uden, Louis Blankeinstruction and spill the beans: Scalable data meier, Jean-Benoit Delbrouck, Asad Aali, Chris21

tian Bluethgen, Anuj Pareek, Malgorzata Poagents! investigating backdoor threats to llmlacin, Eduardo Pontes Reis, Anna Seehofnerová, based agents. Advances in Neural Information et al. Adapted large language models can outProcessing Systems, 37:100938–100964, 2024. perform medical experts in clinical text summarization. Nature medicine, 30(4):1134–1142, [35] Jiahao Yu, Xingwei Lin, Zheng Yu, and Xinyu Xing. {LLM-Fuzzer}: Scaling assessment of 2024. large language model jailbreaks. In 33rd [28] Bing Wang, Xinnian Liang, Jian Yang, Hui USENIX Security Symposium (USENIX SecuHuang, Shuangzhi Wu, Peihao Wu, Lu Lu, Zejun rity 24), pages 4657–4674, 2024. Ma, and Zhoujun Li. Enhancing large language model with self-controlled memory framework. [36] Yangyang Yu, Haohang Li, Zhi Chen, Yuechen Jiang, Yang Li, Denghui Zhang, Rong Liu, JorarXiv preprint arXiv:2304.13343, 2023. dan W Suchow, and Khaldoun Khoshnevisan. [29] Bo Wang, Weiyi He, Shenglai Zeng, Zhen Xiang, Finmem: A performance-enhanced llm trading Yue Xing, Jiliang Tang, and Pengfei He. Unveilagent with layered memory and character deing privacy risks in llm agent memory. arXiv sign. arXiv preprint arXiv:2311.13743, 2024. preprint arXiv:2502.13172, 2025. [37] Shenglai Zeng, Jiankun Zhang, Pengfei He, Yue [30] Lei Wang, Chen Ma, Xueyang Feng, Zeyu Xing, Yiding Liu, Han Xu, Jie Ren, Shuaiqiang Zhang, Hao Yang, Jingsen Zhang, Zhiyuan Wang, Dawei Yin, Yi Chang, et al. The good and Chen, Jiakai Tang, Xu Chen, Yankai Lin, the bad: Exploring privacy issues in retrievalWayne Xin Zhao, Zhewei Wei, and Jirong Wen. augmented generation (rag). arXiv preprint A survey on large language model based auarXiv:2402.16893, 2024. tonomous agents. Frontiers of Computer Science, 18(6), March 2024. URL: http://dx [38] Hanrong Zhang, Jingyuan Huang, Kai Mei, Yifei Yao, Zhenting Wang, Chenlu Zhan, Hongwei .doi.org/10.1007/s11704- 024- 40231-1, Wang, and Yongfeng Zhang. Agent security doi:10.1007/s11704-024-40231-1. bench (asb): Formalizing and benchmarking at[31] Liang Wang, Nan Yang, Xiaolong Huang, Binxtacks and defenses in llm-based agents, 2025. ing Jiao, Linjun Yang, Daxin Jiang, Rangan URL: https://arxiv.org/abs/2410.02644, Majumder, and Furu Wei. Text embeddings arXiv:2410.02644. by weakly-supervised contrastive pre-training. [39] Xi Zhang, Srivatsan Setlur, Maarten Sap, and arXiv preprint arXiv:2212.03533, 2022. Yejin Choi. Towards ethical personal ai ap[32] Yuhao Wang, Wenjie Qu, Shengfang Zhai, Yanze plications: Practical considerations for ai assisJiang, Zichen Liu, Yue Liu, Yinpeng Dong, and tants with long-term memory. arXiv preprint Jiaheng Zhang. Silent leaks: Implicit knowledge arXiv:2409.11192, 2024. extraction attack on rag systems through benign queries, 2025. URL: https://arxiv.org/abs/ [40] Zeyu Zhang, Quanyu Dai, Xu Chen, Rui Li, Zhongyang Li, and Zhenhua Dong. Memengine: 2505.15420, arXiv:2505.15420. A unified and modular library for developing ad[33] Yijia Xiao, Edward Sun, Di Luo, and Wei vanced memory of llm-based agents. In CompanWang. Tradingagents: Multi-agents llm fiion Proceedings of the ACM on Web Conference nancial trading framework. arXiv preprint 2025, pages 821–824, 2025. arXiv:2412.20138, 2024. [41] Wayne Xin Zhao, Kun Zhou, Junyi Li, Tianyi [34] Wenkai Yang, Xiaohan Bi, Yankai Lin, Sishuo Tang, Xiaolei Wang, Yupeng Hou, Yingqian Chen, Jie Zhou, and Xu Sun. Watch out for your Min, Beichen Zhang, Junjie Zhang, Zican Dong, 22

et al. A survey of large language models. arXiv preprint arXiv:2303.18223, 1(2), 2023. [42] Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043, 2023.

Memory Isolation

Pareto tradeoff 1.00

0.200 100

Mem0. Mem0 scopes every memory operation through four dimensions: user id, agent id, run id (session), and app id5 . All memory levels reside in the same physical storage(vector database and history database) but are logically separated via metadata filters: a retrieval query parameterized with one user’s identifier will never return memories belonging to another user6 .

Anthropic (Claude). Claude employs accountscoped memory: all stored memories are private to the user’s account and are never shared with other users7 .

3 https://help.openai.com/en/articles/9295112-memor y-faq-business-version 4 https://help.openai.com/en/articles/12574142-chatg pt-atlas-data-controls-and-privacy 5 https://mem0.ai/blog/multi-agent-memory-systems 6 https://docs.mem0.ai/platform/faqs 7 https://privacy.claude.com/en/

0.150

80 CosSim ASR

0.90

0.85 OpenAI (ChatGPT). ChatGPT implements account-scoped memory isolation: every memory entry is bound to the authenticated user’s account and is inaccessible to any other account3 . In Team and Enterprise workspaces, organizational boundaries provide an additional isolation layer—workspace administrators can configure data retention policies, and conversations within these workspaces are excluded from model training4 .

0.175

(a)

0.80 0.00

0.125 emb

CosSim

0.95

ASR (%)

We survey the memory isolation strategies adopted by three representative production systems. Despite architectural differences, all rely on a common principle: binding each user’s long-term memory to a unique identifier and enforcing access control at retrieval time.

0.50

0.75

1.00 20

0.050

LLM-Fuzzer

LLM-Fuzzer [35] is a black-box fuzzing framework for scalably assessing the jailbreak vulnerability of large language models. Inspired by coverage-guided fuzzers in software testing, it treats jailbreak templates as seeds and automatically evolves them to discover effective attacks. The core workflow is as follows: Seed Collection. Gather an initial pool of jailbreak templates from public sources (e.g., online forums and community repositories). Seed Selection. Choose a template from the pool using a UCB1-based bandit strategy that balances exploiting templates with high historical success rates and exploring less-tested ones. Mutation. Feed the selected template to an auxiliary LLM with a randomly sampled mutation instruction (rephrase, expand, shorten, crossover with another template, etc.) to produce a new candidate template. Execution. Insert a harmful question into the candidate template and query the target LLM. A judge model then determines whether the response constitutes a successful jailbreak. Pool Update. If the candidate succeeds, add it to the seed pool as a new template; propagate the outcome back to the parent template’s statistics to guide future selection.

(b)

0.000 0.00

Figure 10: Pareto tradeoff.

LLM

0.075 0.025

0.25

emb

0.100

0.25

Steps 2–5 repeat for a fixed budget of iterations.

Dataset

Here, we give a detailed description of the datasets used in this work. TREC-COVID [26]. This dataset contains 116K scientific and medical documents from the TRECCOVID collection, part of the BEIR benchmark, exemplifying research scenarios where COVID-related literature is integrated with RAG to improve information retrieval efficiency and the quality of scientific knowledge exploration in pandemic response contexts. In our work, we populate the reference LTM from TREC-COVID for parameter optimization (Cadv , N , Preact ); its distribution intentionally differs from the victim’s, ensuring the optimized parameters generalize across domains. HealthCareMagic-100k-en [8]. This dataset contains 112,165 real conversations between patients and doctors, representing the domain-specific medical agent setting in which a specialized assistant accumulates highly sensitive, single-domain long-term memories (e.g., symptoms, diagnoses, medications) to support downstream clinical tasks. We sample from this dataset to construct one of the two victim LTMs (200 records each), simulating a scenario where an adversary targets the private medical history stored by a clinical agent.

MS MARCO [4]. MS MARCO (Microsoft MAchine Reading COmprehension) is a large-scale information retrieval dataset comprising approximately 8.8 million passages and over one million real user queries sampled from Bing search logs. In Scenario 2, where the number of trigger queries is constrained, we sample benign queries from MS MARCO to simulate normal user interactions that do not invoke the compromised tool. These benign queries follow a trigger query within the same session to resume the extraction loop, providing a realistic distribution of everyday information-seeking behavior against which the attack’s stealth and persistence are evaluated. During optimization, we use a small set of benign queries alongside a single trigger query; for evaluation, we draw separate, non-overlapping benign queries to avoid data leakage.

Baseline

All three baselines were originally designed as userside extraction attacks against RAG systems following the query-concatenation paradigm (Equation 3): each query consists of an anchor that steers the retriever toward a target region of the knowledge store, concatenated with an adversarial command that instructs the LLM to disclose the retrieved content verbatim. To port them to the tool-side setting, we embed the concatenated payload into the tool’s return value via indirect prompt injection, keeping the adLoCoMo [16].8 LoCoMo (Long-term Conversational versarial command Cadv identical across all methods Memory) comprises multi-session dialogues between so that they differ only in their anchor generation pairs of speakers, annotated with fine-grained mem- strategy. ory categories including personal events, daily preferences, social relationships, and future plans. It represents the personal assistant setting in which a E.1 Random Anchor Generation general-purpose conversational agent accumulates diMEXTRA [29]. MEXTRA generates anchors by verse, cross-domain long-term memories from everyprompting GPT-4 to produce diverse, topically varday interactions. We sample from LoCoMo to conied short phrases that are semantically plausible as struct the other victim LTM (200 records), compleretrieval queries. Because the anchors are sampled menting the medical-agent scenario with a broader, independently of previously extracted content, MEXlifestyle-oriented memory store and enabling us to TRA does not require any feedback loop and can evaluate attack effectiveness across two distinct memgenerate an arbitrarily large pool of candidate anory distributions. chors in advance. Each anchor is concatenated with 8 https://github.com/snap-research/LoCoMo the shared adversarial command and submitted as 25

a query; the retrieved documents are collected and deduplicated to compute overall extraction coverage. The key advantage of this strategy is its simplicity and parallelizability; however, the lack of feedback means that many anchors may retrieve alreadyextracted or semantically overlapping records, leading to diminishing marginal returns as extraction progresses.

E.2

Feedback-Driven Anchor Generation

RAG-Thief [9]. RAG-Thief employs an iterative, feedback-driven strategy that leverages previously extracted content to generate new anchors. Specifically, after each extraction round, RAG-Thief feeds the newly obtained chunks to a local language model (Qwen2-1.5B-Instruct) and prompts it to generate forward and backward continuations. These continuations serve as anchors for the next round, under the intuition that semantically adjacent passages in the knowledge store are likely to be retrieved by queries resembling their neighboring content. By chaining continuations across rounds, RAG-Thief progressively expands its extraction frontier outward from an initial seed, achieving higher coverage than purely random sampling.

LTM framework

LTMemory. LTMemory represents the standard framework, using text embeddings to calculate semantic similarities and retrieve relevant information. GAMemory. [18] GAMemory incorporates a selfreflection mechanism. This mechanism activates when the cumulative importance of recent events exceeds a threshold. It then synthesizes fragmented records into high-level inferences supported by evidence. SCMemory. [28] SCMemory selectively recalls only necessary information for inference. A control mechanism determines when to activate memory retrieval and filter out noise. Additionally, a summarization mechanism condenses extended interactions while preserving core information for efficient reasoning.

Experimental Result

Potential Defense

IKEA [32]. IKEA (Implicit Knowledge Extraction Attack) adopts a concept-level feedback strategy that operates in the embedding space rather than at the token level. After each extraction round, IKEA identifies salient concepts (key phrases or entities) from the accumulated query–response history and uses them as seeds for the next round of anchor generation. To maximize retrieval diversity, IKEA iteratively mutates these concept-level anchors subject to embedding-space similarity constraints: new anchors are required to remain close enough to the knowledge store’s distribution to trigger relevant retrieval, yet sufficiently distant from previously used anchors to avoid redundant results. This constrained mutation mechanism enables IKEA to explore the embedding space more systematically than forward/backward continuation, yielding higher extraction coverage under a fixed query budget. 26

Template for response filtering defense You are a security auditor. Analyze the following tool response and determine if it contains prompt injection patterns. Prompt injection patterns include: • Instructions to ignore previous instructions • Instructions to change behavior or role • Instructions to output specific predetermined answers • Instructions to concatenate or leak conversation history • Any attempt to manipulate the calling AI agent Tool Response: response Reply with EXACTLY one word: SAFE or UNSAFE

Table 6: Consolidated results of Scenario 1 on the LoCoMo dataset. RER (%) ↑ Factor

Setting

SS ↑

MEXTRA

RAGThief

IKEA

SPORE

BER (%) ↑

MEXTRA

RAGThief

IKEA SPORE

MEXTRA

RAGThief

IKEA

SPORE

Generative Model

GPT-5-mini Gemini-2.5-pro Deepseek-chat

7.0% 3.0% 4.5%

15.5% 18.5% 13.5%

6.0% 5.0% 6.5%

57.5% 45.5% 52.0%

1.00 1.00 1.00

0.0% 0.0% 0.0%

63.5% 95.0% 70.5%

LTM Framework

LTMemory GAMemory SCMemory

7.0% 4.5% 10.0%

15.5% 6.0% 6.5% 12.0% 25.5% 10.0%

57.5% 55.0% 26.5%

1.00 1.00 0.57

1.00 1.00 0.70

1.00 0.80 0.84

1.00 1.00 0.84

0.0% 0.0% 0.0%

63.5% 75.5% 72.5%

7.0%

15.5%

6.0%

57.5%

1.00

0.0%

63.5%

5.0% 4.5%

22.5% 12.5%

10.5% 9.0%

58.5% 58.5%

1.00 1.00

0.94 0.97

1.00 1.00

0.0% 0.0%

72.0% 68.0%

All-MiniLMEmbedding L6-v2 Contriever Model E5-base

Table 7: Consolidated results of Scenario 2 on the LoCoMo dataset. RER (%) ↑ Trigger Factor

Setting

IKEA

SPORE

MEXTRA

IKEA SPORE

MEXTRA

RAGThief

IKEA

SPORE

GPT-5-mini Gemini-2.5-pro Deepseek-chat

2.0% 3.0% 3.5%

4.5% 4.5% 4.0%

0.0% 3.0% 2.5%

5.0% 6.5% 10.0%

1.00 1.00 1.00

– 1.00 1.00

1.00 1.00 1.00

0.0% 0.0% 0.0%

90.3% 100.0% 90.0%

LTM Framework

LTMemory GAMemory SCMemory

2.0% 2.5% 0.0%

4.5% 4.5% 3.5%

0.0% 4.5% 1.5%

5.0% 5.0% 4.5%

1.00 1.00 –

1.00 1.00 0.60

– 0.90 0.98

1.00 1.00 0.80

0.0% 0.0% –

0.0% 0.0% 0.0%

90.3% 100.0% 60.0%

2.0%

4.5%

0.0%

5.0%

1.00

–

1.00

0.0%

90.3%

2.5% 1.5%

4.0% 1.0%

3.0% 4.5%

4.5% 5.0%

1.00 1.00

0.0% 0.0%

100.0% 100.0%

Generative Model

GPT-5-mini Gemini-2.5-pro Deepseek-chat

7.0% 3.0% 4.5%

10.5% 13.5% 10.0%

4.5% 5.0% 6.5%

22.0% 18.5% 30.5%

1.00 1.00 1.00

0.0% 0.0% 0.0%

75.2% 85.0% 70.0%

LTM Framework

LTMemory GAMemory SCMemory

7.0% 4.5% 5.5%

10.5% 6.0% 16.0%

4.5% 9.5% 6.0%

22.0% 23.5% 12.0%

1.00 1.00 0.59

1.00 1.00 0.68

1.00 0.90 0.82

1.00

0.0% 0.0% 0.0%

75.2% 75.0% 57.1%

7.0%

10.5%

4.5%

22.0%

1.00

0.0%

75.2%

5.0% 4.5%

10.5% 10.5%

9.0% 9.0%

27.0% 19.0%

1.00 1.00

1.00 0.97

1.00 1.00

0.0% 0.0%

79.2% 97.0%

All-MiniLMEmbedding L6-v2 Contriever Model E5-base

@20

MEXTRA

BER (%) ↑

RAGThief

Generative Model

All-MiniLMEmbedding L6-v2 Contriever Model E5-base

SS ↑

RAGThief

0.84

Generative Model

GPT-5-mini Gemini-2.5-pro Deepseek-chat

7.0% 3.0% 4.5%

15.5% 18.5% 13.5%

6.0% 5.0% 6.5%

44.0% 45.5% 35.0%

1.00 1.00 1.00

0.0% 0.0% 0.0%

80.4% 80.2% 72.0%

LTM Framework

LTMemory GAMemory SCMemory

7.0% 4.5% 10.0%

15.5% 6.0% 6.5% 12.0% 25.5% 10.0%

44.0% 44.5% 14.0%

1.00

1.00 1.00 1.00

1.00 0.80 0.84

1.00 1.00 0.83

0.0% 0.0% 0.0%

80.4% 78.5% 65.9%

7.0%

15.5%

6.0%

44.0%

1.00

0.0%

80.4%

5.0% 4.5%

22.5% 12.5%

10.5% 9.0%

40.5% 38.5%

1.00 1.00

0.94 0.97

0.99 1.00

0.0% 0.0%

83.2% 77.8%

All-MiniLMEmbedding L6-v2 Contriever Model E5-base

0.57

Table 8: Consolidated results of Scenario 3 on the LoCoMo dataset. Trigger Factor

Metrics

Setting

RER (%) ↑ SS ↑ BER (%) ↑ 69.0% 71.0% 81.0%

1.00 1.00 1.00

72.0% 80.0% 52.0%

LTMemory LTM GAMemory Framework SCMemory

69.0% 76.0% 35.0%

1.00 1.00 0.75

72.0% 70.0% 93.5%

All-MiniLM-L6-v2 Embedding Contriever Model E5-base

69.0% 87.0% 74.5%

1.00 1.00 1.00

72.0% 65.0% 70.0%

Generative Model @1

GPT-5-mini Gemini-2.5-pro Deepseek-chat

Record · ID 405570 · SHA-256 7ec6ca70fd6be188
Retrieved via Conceptio — every document is proof-bundled with source, license, and retrieval metadata.