Understanding Stage-Wise Utility-Risk Trade-offs in LLM Agent Memory

Understanding Stage-Wise Utility-Risk Trade-offs in LLM Agent Memory Chuanchao Zang1 Zijian Cao1 Xiangtao Meng1 Jianing Wang1 Wenyu Chen1 Xinyu Gao1 Li Wang1 Zheng Li1,2,3* Shanqing Guo1,2,3* 1 School of Cyber Science and Technology, Shandong University

arXiv:2608.30177v1 [cs.CR] 31 Aug 2026

2 State Key Laboratory of Cryptography and Digital Economy Security, Shandong University 3 Shandong Key Laboratory of Artificial Intelligence Security, Shandong University

Abstract

Begin Memory Poisoned Memory

1

Begin Memory

Poisoned Memory

1.Controllable Memory System: sweep one stage at a time

Long-term memory is becoming a core capability of LLM agents, enabling personalization and long-horizon interaction. However, memory mechanisms that retain, transform, or expose more information can affect both benign utility and susceptibility to memory poisoning. Existing evaluations typically measure memory utility or attack risk in isolation under fixed configurations, providing limited insight into how stage-specific design choices reshape their tradeoff. We present M EM G AUGE, a controllable framework that separately varies writing admission, management policy, and retrieval exposure under matched clean and poisoned conditions. Across 11 LLMs and two long-term memory benchmarks, controlled evaluations reveal three distinct profiles: a threshold-like risk transition during writing, policydependent local decoupling during management, and coupled growth of utility and risk during retrieval. We further apply analogous stage-level measurements to four existing memory systems and observe diagnostic associations qualitatively consistent with these profiles. These results show that targeted poisoning risk varies across memory operations and motivate stage-aware evaluation and control of LLM-agent memory.

Management-Stage

Writing-Stage �� : Admission permissiveness

Memory System

�� : Retrieval Sensitivity

U

U R

2.Distinct stage-wise patterns

Risk (R)

R U

M2 M1

Why same R different U? Why same U different R?

M3

M4

Utility (U)

Points reveal what differs, not which stage produces it.

Writing-Stage

��

R

A-Mem

��

Management-Stage

3.Transfer to real memory systems Mem0

Retrival-Stage

�� : Management Strength

Hindsight

LangMem

Retrival-Stage

��

Stage-Wise Pattern Consistency

Figure 1: Overview of stage-wise utility-risk evaluation. Unlike point estimates, M EM G AUGE reveals stage-level patterns across memory systems.

stored information, and retrieval selects which memories are exposed as decision context [8, 9, 16]. Each stage can improve benign memory utility, but it also governs a distinct pathway through which poisoned information is admitted, resurfaced, or suppressed. Existing evaluations report aggregate benign utility or poisoning risk for end-to-end memory systems, but rarely examine how these outcomes change with specific memory stages [1, 2, 4, 10, 12, 18]. Because each result combines the effects of writing, management, and retrieval, it identifies a system’s operating point but not how its utility–risk response changes within a stage. Changes at different stages may move utility and risk differently: one may increase both, whereas another may reduce risk with little utility loss. Without this stage-level view, a design intended to improve memory performance may yield only marginal utility gains while sharply increasing risk, while efforts to balance the two may rely on unguided trial and error across stages. We therefore ask: How do controlled changes in writing admission, management policy, and retrieval exposure reshape memory utility and poisoning risk? Directly evaluating existing memory systems cannot readily answer this question. These systems tightly couple writing, management, and retrieval within end-to-end pipelines, expose only a small number of user-configurable interfaces, and differ in which controls they provide [2, 8]. Conse-

Introduction

Long-term memory enables LLM agents to support personalization, accumulate experience, and interact over long horizons by retaining information beyond the current context[11, 19]. Yet this persistence also creates security risks: once adversarially induced information enters memory, it can influence decisions across queries and sessions[1, 3, 4]. For example, Microsoft documented attempts to use hidden “remember” instructions to write promotional preferences into assistant memory, illustrating how a mechanism designed for personalization can also bias later recommendations [5]. Such utility–risk tensions may arise at different points in the memory lifecycle. We therefore organize memory operations into three functional stages: writing determines what information is stored, management transforms or reconciles 1

management, and retrieval, complementing prior separate or aggregate system-level evaluations.

quently, their measurements correspond to sparse and nonaligned operating points: a control available in one system may be absent or defined differently in another, making stage-wise utility–risk responses difficult to compare systematically. To address this challenge, we introduce M EM G AUGE, which varies one stage at a time in a controlled environment to construct stage-wise utility–risk response profiles, and then applies analogous stage-level measurements to existing systems to examine whether their observed operating points are consistent with these profiles. Concretely, M EM G AUGE defines three intervention axes corresponding to the memory lifecycle. At the writing stage, it divides each trace into atomic units, ranks them using the agent’s own LLM, and varies the ranked prefix passed to the writer to produce nested admission levels. At the management stage, it applies alternative conflict-handling policies to the same pre-management memory state. At the retrieval stage, it varies a shared exposure rate for helpful and riskbearing records while keeping the retrieval budget fixed. At each operating point, paired clean and poisoned conditions hold the agent model, task, prompts, memory budget, and remaining memory operations fixed. Using M EM G AUGE, we conduct controlled evaluations of 11 LLMs across two long-term memory benchmarks. The resulting stage-wise utility–risk response profiles reveal three distinct patterns. (1) Writing stage exhibits a nonlinear transition: as admission coverage expands along each agent’s model-specific ranking, clean utility rises and gradually saturates, while attack success remains low at restrictive levels before increasing sharply. (2) Management stage exhibits policy-dependent local decoupling: changing the management policy can substantially shift attack success while leaving clean utility nearly unchanged, although the direction and magnitude of this shift depend on the policy. (3) Retrieval stage exhibits a coupled response: increasing the exposure of helpful and risk-bearing memories improves clean utility while simultaneously increasing attack success. These patterns show that utility and risk respond differently to changes at different stages of the memory lifecycle. We further examine whether these patterns appear in four existing memory systems (e.g., Mem0 [2]) using analogous stage-level measurements. For writing, we measure the fraction of trace units retained in memory; for management, we compare each system’s native mechanism when enabled and disabled on the same pre-management state; and for retrieval, we measure decision-relevant exposure across top-K budgets. Because these systems couple multiple stages, we interpret their operating points as diagnostic correspondence rather than controlled stage effects. The measurements align with the controlled profiles: greater information retention is associated with higher risk without reliable utility gains, management shifts attack success more than clean utility, and larger retrieval budgets raise both clean utility and attack success. These stage-level measurements help interpret aggregate end-to-end results. Our contributions are threefold:

• Controllable evaluation framework. We develop M EM G AUGE, which varies writing admission, compares management policies, and controls shared retrieval exposure under paired clean and poisoned conditions to construct stage-wise utility–risk response profiles. • Empirical pattern discovery. Across 11 LLMs and two benchmarks, we observe a nonlinear transition in writing, policy-dependent local decoupling in management, and a coupled response in retrieval. Measurements on four existing memory systems exhibit patterns consistent with these profiles and help interpret their end-to-end behavior.

2

Related Work

Prior work studies agent memory from both utility and security perspectives. LoCoMo [10], LongMemEval [16], and MemBench [15] evaluate long-term memory across multisession recall, temporal and cross-session reasoning, and knowledge updating. Systems such as Mem0 [2] and AMEM [17] further develop mechanisms for memory writing, retrieval, consolidation, and updating, typically evaluating the complete pipeline through task performance, retrieval quality, and efficiency. Meanwhile, AgentPoison [1], MINJA [4], MemoryGraft [14], Sleeper [13], and other studies [12, 18] show that poisoned memories or interactions can persistently influence downstream behavior, while MPBench [20] systematizes memory-writing channels and structural vulnerabilities. However, existing work largely evaluates either end-to-end utility or attack effectiveness. Our work isolates writing, management, and retrieval to characterize their individual effects on the utility-risk tradeoff.

3

M EM G AUGE Framework

We present M EM G AUGE, a controlled framework for constructing stage-wise utility–risk response profiles of memory. It separately varies writing admission, management policy, and retrieval exposure while holding the other stages fixed, then applies analogous measurements to existing systems. A summary of additional symbols, system prompts, and diagrams of methods and algorithms can be found in Section A of the Supplementary Materials.

3.1

Problem Setting

Let i ∈ {1, . . . , N} index an evaluation instance. Each instance contains a subsequent query xi , its correct answer y⋆i , an attacker-predefined target yadv ̸= y⋆i , and a pre-existing i memory bank Bi containing benign information irrelevant to the current query. We use s ∈ {c, p} to denote the clean and poisoned conditions, while the superscripts + and − denote helpful and risk-bearing information, respectively. The help+ ⋆ ful trace τ+ i contains information ei supporting yi , whereas

• Stage-wise utility–risk perspective. We introduce a stage-wise utility-risk perspective spanning writing, 2

− the risk-bearing trace τ− i contains information ei supportadv ing yi . The clean condition contains only the helpful trace, while the poisoned condition contains both traces. We consider interaction-based poisoning in which risk-bearing information enters memory through user- or tool-side interactions rather than direct memory edits. The writer W converts the two traces into memory records: ∆Mi+ = W (τ+ i ) and ∆Mi− = W (τ− i ). The pre-management memory states p are Mic = Bi ∪ ∆Mi+ and Mi = Bi ∪ ∆Mi+ ∪ ∆Mi− . For either condition s ∈ {c, p}, management G transforms the meme s = G(M s ), retrieval R selects the context for the ory state M i i s e s ), and the agent F produces the final outquery Xi = R(xi , M i put: ysi = F(xi , Xis ). At each operating point, M EM G AUGE changes one stagespecific intervention while keeping the agent model, query, prompts, background memory, and remaining memory operations fixed. The paired outputs are used to compute clean utility, poisoned utility, and attack success rate, as defined in Section 3.3. Figure 2 summarizes this workflow: M EM G AUGE first constructs controlled stage-wise response profiles and then compares them with analogous stage-level measurements from existing memory systems.

3.2

poisoned memory states are Mic (θw ) = Bi ∪ ∆Mi+ (θw ),

(2)

Mi (θw ) = Bi ∪ ∆Mi+ (θw ) ∪ ∆Mi− (θw ).

(3)

p

Each source unit is processed by the writer once, and its resulting records are reused at every coverage level containing that unit. Thus, differences across θw arise from the admitted source units rather than repeated writer generation. (2) Management: Controlling Memory-State Transformation. Although memory systems implement management differently, these mechanisms share a common purpose: transforming stored information before retrieval by filtering, reconciling, or updating memory records. Unlike writing admission, these operations do not form a natural continuous axis. MemGauge therefore represents management using discrete policies applied to the same premanagement memory state. For each condition s ∈ {c, p}, a policy g transforms the memory state as eis (g) = Gg (Mis ), g ∈ G = {UM, PQ, NC, SC}. M

(4)

Here, quarantining a record means excluding it from subsequent retrieval while leaving the remaining memory state unchanged. Unmanaged Memory (UM) leaves all records unchanged and serves as the no-management reference. Provenance-Aware Quarantine (PQ) quarantines records written from sources marked as untrusted. Numeric-Conflict Resolution (NC) quarantines a newly written record when its numerical content conflicts with an existing trusted record. Strict Conflict Resolution (SC) retains records consistent with verified interaction outcomes, such as explicit user confirmations or tool-execution results, and quarantines those that are not. It represents an idealized setting in which such feedback is complete and reliable, and serves as an upper bound. Within each condition, all policies receive the same premanagement state Mis , while the subsequent retrieval configuration and agent remain fixed. The policies therefore represent separate management operating points rather than ordered levels of management capability. (3) Retrieval: Controlling Decision-Relevant Exposure. Retrieval determines which records from the memory are exposed to the agent for the current query. Although retrieval mechanisms differ in how they rank records, their decisionrelevant outcome is whether helpful or risk-bearing information enters the retrieved context under a fixed retrieval budget. M EM G AUGE therefore intervenes directly on record exposure rather than modifying any particular ranking algorithm. For each instance, the retriever returns a context containing exactly K records. At retrieval exposure probability θr ∈ [0, 1], we sample

Stage-Wise Interventions

M EM G AUGE constructs stage-wise response profiles within a controlled memory pipeline rather than by modifying existing systems. Within this pipeline, it defines one intervention axis for each stage and varies one stage at a time under paired clean and poisoned conditions. We present the interventions in execution order: writing, management, and retrieval. (1) Writing: Controlling Information Admission. Although memory systems implement writing differently, they share a common purpose: extracting helpful information from interaction traces that may support future decisions and storing it as persistent records. M EM G AUGE therefore represents writing in the controlled pipeline as admission followed by transformation. An admission controller selects the source units available at each operating point, while a fixed writer W converts the selected units into memory records. Holding W fixed ensures that differences across admission levels reflect changes in the available source information rather than changes in the writing mechanism itself. Let q ∈ {+, −} denote the helpful or risk-bearing inforq mation role. We divide each trace τi into a set of atomic q source units Zi . The same LLM used by the agent ranks the units within each trace by their estimated usefulness for fuq ture decisions, producing an ordering πi . The helpful and risk-bearing traces are ranked independently. At writing admission coverage θw ∈ [0, 1], the controller supplies the corresponding ranked prefix to W :

− a+ i ∼ Bernoulli(θr ), ai ∼ Bernoulli(θr ),

  q
q q  q q q bi (θw ) = θw |Zi | , Ai (θw ) = πi (1), . . . , πi bi (θw ) . (1) q / Because these admitted sets are nested, where Ai (0) = 0. increasing θw only adds lower-ranked units from the same trace. The writer converts the admitted units into memory S q records: ∆Mi (θw ) = z∈Aq (θw ) W (z). The resulting clean and

(5)

− + where a+ i and ai indicate whether the helpful record ei and − the risk-bearing record ei are included in the retrieved context, respectively. In particular, − Pr(a+ i = 1) = Pr(ai = 1) = θr .

i

3

(6)

�� :

...

�+ � :

Divide each trace ��� into atomic source units ��� :

... ... ...

�+ � :

�− � :

+ − Clean: �� + �+ � , Poisoned: �� + �� + ��

Clean Utility

�− � :

UM (Unmanaged)

Quarantine records that

values,e.g.,1 ≠ 2.

New Records: △ �+ , △ �−

Real Systems Mem0

A-Mem

Fixed ��� : �

SC(Strict Confict) Quarantine records

; preserve correct decisions.

�� :

Budge:

B

B

B

B

B

B

Retained-Unit Ratio

Mechanism Off/On

... B + ... B +

B -

Comon Exposure: ��

Retrived Records: ���

Managed State: ���

Attack Success Rate

...

Quarantine records from .

NC (Numeric-Confict)

Writing Coverage: ��

Poisoned Utility

PQ (Provenance-Aware)

Records unchanged. .

Exposure Across Top-K

Figure 2: Overview of M EM G AUGE. It varies one memory stage at a time under matched clean and poisoned conditions to construct utility-risk profiles and examine their diagnostic correspondence with existing memory systems.

The clean and poisoned conditions share the same helpfulrecord exposure decision a+ i , while the risk-bearing record is available only in the poisoned condition. The retrieved contexts are constructed as
+ + Xic (θr ) = a+ (7) i {ei } ∪ Fill Bi , K − ai ,
p − − − + + Xi (θr ) = a+ i {ei } ∪ ai {ei } ∪ Fill Bi , K − ai − ai . (8)

θw , θr , or the controlled management policies on these systems. Instead, we construct analogous stage-level measurements using the same helpful and risk-bearing traces, background memory, and subsequent queries. For writing, we measure the proportion of source units whose information is retained in the resulting memory records. For management, we compare the system’s native mechanism when enabled and disabled on the same pre-management state. For retrieval, we vary the top-K budget and measure the proportion of instances in which the risk-bearing record appears in the retrieved context. We then examine whether the resulting utility and ASR patterns qualitatively correspond to the controlled profiles. Because these measurements come from coupled system pipelines, they are treated as diagnostic associations rather than controlled stage effects.

Here, a{e} denotes {e} when a = 1 and the empty set otherwise. The function Fill(Bi , k) selects k task-irrelevant records from Bi according to a fixed ordering. When the risk-bearing record is exposed, it replaces an irrelevant background record rather than the helpful record. The two conditions use the same helpful-record exposure decision, background-record ordering, and record positions, and both always contain exactly K records. We use balanced sampling schedules so that the empirical exposure frequency at each operating point matches θr .

3.3

4 4.1

Constructing Stage-Wise Utility-Risk Profiles

Experimental Setup

Agent and LLMs. We implement a common LangGraph agent (38.4K GitHub stars) with 11 LLMs, including GPT5.4, GPT-5.4-Mini, Gemini 3.1 Flash, Gemini 2.5 Flash, Grok 4.3 High, Grok 4.2 Fast, DeepSeek-V4-Flash, GLM5.1, Qwen 3.5 397B, MiniMax-M3, and Doubao Seed 2.0 Pro. For each configuration, the same LLM serves as the agent’s reasoning model and the writing-stage ranker. Datasets and trace construction. We construct evaluation instances from LongMemEval [16] and LoCoMo [10], selecting 100 test questions from each dataset and identifying the information required to answer them. This information is introduced through a benign agent interaction, producing the helpful trace τ+ i . The background memory bank Bi is constructed from analogous interactions generated using information from the corresponding dataset that is unrelated to the subsequent query. For the poisoned condition, MINJA [4] and Sleeper [13] generate user-side and tool-side risk-bearing interactions, respectively, producing τ− i . The attacker can influence the corresponding interaction content but cannot directly edit the memory bank. Helpful and riskbearing traces are generated in separate sessions, and the test query is issued in a subsequent session. In the controlled experiments, traces are processed by the fixed writer W ; in the existing-system evaluation, they are processed by each system’s native writing mechanism.

At each operating point, we evaluate the same instances under matched clean and poisoned conditions while holding the model, queries, prompts, decoding settings, and remaining memory operations fixed. From the paired outputs, we compute clean utility, poisoned utility, and attack success rate (ASR). Clean utility measures correct decisions under the clean condition, poisoned utility measures correct decisions after risk-bearing information is introduced, and ASR measures decisions redirected to the attacker-predefined target. Poisoned utility and ASR are not complementary because an output may match neither target. Varying θw or θr produces the writing- and retrieval-stage response profiles, respectively. Because management policies do not form an ordered scale, each policy is represented as a separate utilityrisk point. These profiles characterize responses along stagespecific intervention axes and do not place writing, management, and retrieval on a shared capability scale.

3.4

Experiments

Applying M EM G AUGE to Memory Systems

Existing memory systems couple writing, management, and retrieval and do not expose the same intervention parameters as M EM G AUGE. We therefore do not directly impose 4

Existing memory systems. We consider four existing memory system: Mem0 (61.8K GitHub stars) [2], Hindsight (18.8K GitHub stars) [8], LangMem (1.6K GitHub stars) [7], and A-Mem (1.1K GitHub stars) [17]. Metrics. We report clean utility, poisoned utility, and ASR as defined in Section 3.3. AgentEvals [6] judges whether each trajectory supports the correct answer or the attackerpredefined target. Its agreement with human annotations is evaluated in Section 4.5. Parameters. Unless otherwise specified, we set the retrieval budget to K = 5, and the background memory size |Bi | = 100. Matched clean and poisoned evaluations use the same configuration (e.g., model, system prompt, query). When evaluating one stage, the other stages are fixed at θw = 0.6, UM, and θr = 0.8, respectively. Research questions. Our experiments address the following research questions. RQ1: What utility–risk profiles emerge under controlled writing, management, and retrieval interventions? RQ2: How stable are the observed stage-wise profiles across evaluation conditions? RQ3: Do analogous stage-level measurements on existing memory systems exhibit qualitative correspondence with the controlled profiles?

4.2

64%. At high exposure, clean utility begins to saturate, whereas ASR remains high and poisoned utility falls to approximately 4%-31%. This coupling is expected because retrieval ranks records by their relevance to the query rather than determining whether their content is benign or riskbearing; a sufficiently relevant risk-bearing record can therefore receive exposure comparable to a helpful record. Key Finding 1. Writing exhibits a threshold-like risk transition, management enables mechanism-dependent local decoupling, and retrieval couples utility with risk. Effective control therefore requires calibrating writing coverage to avoid the high-risk region, adopting mechanism-matched management policies, and constraining retrieval exposure rather than expecting relevance-based ranking to distinguish helpful from risk-bearing records.

4.3

RQ2: Profile Stability

We examine how selected workload and implementation factors affect the stage-wise profiles. Unless otherwise specified, all experiments in this section use DeepSeek-V4-Flash, LongMemEval, and MINJA. Trace-Load stability. As shown in Figure 4, we vary the number of source units in each trace to 0.75×, 1.0×, and 1.25× the default size while preserving the core helpful or risk-bearing information. Across all three settings, ASR remains near zero at low writing coverage and increases more sharply at higher coverage. At full coverage, ASR reaches 58%-63%, while poisoned utility falls to 1%-4%. Larger trace loads shift the rise in risk toward lower coverage levels but preserve the overall writing-stage response. Ranker stability. As shown in Figure 5, we compare four source-unit orderings: the agent’s own LLM, an external LLM, random ordering, and chronological ordering. At θw = 0.5, the self-LLM and external-LLM rankers achieve 43%–47% clean utility with 2%-8% ASR, whereas random ordering reaches only 16% clean utility. Chronological ordering achieves 33% clean utility but raises ASR to 27%. All orderings converge at θw = 1 because full coverage includes the same source units by construction. Thus, ranker choice shifts the utility-risk trajectory and the onset of risk without changing the full-coverage endpoint. Retrieval-budget stability. Because K directly controls the amount of memory returned to the agent, we evaluate its effect primarily at the retrieval stage. As shown in Figure 6, across all budgets, increasing θr raises both clean utility and ASR under matched helpful and risk-bearing exposure. The differences are most visible at low and intermediate exposure levels, while the profiles converge at high exposure. Thus, K shifts the utility-risk operating points but does not remove the coupled response induced by matched exposure. Distractor-fill stability. Under a fixed retrieval budget of K = 5, we replace random background filling with similaritybased filling. After excluding records that support either the correct answer or the attacker-predefined target, we use the most query-similar remaining records to fill unused retrieval

RQ1: Stage-Wise Utility-Risk Profiles

Figure 3 presents the controlled stage-wise profiles across 11 LLMs. Each column varies one memory stage while holding the remaining operations fixed, and each row represents a dataset–attack combination. Lines report the median across models, with shaded regions and box plots showing the interquartile range. Per-model results are in Supplementary Material Section B.1. Writing-Stage Profile. At low coverage (θw < 0.3), clean and poisoned utility increase almost synchronously to approximately 15%-20%, while ASR remains near zero. Between θw = 0.3 and 0.5, both utility measures continue to rise, reaching roughly 20%-42%, but ASR generally remains below 10%. Beyond this range, the profiles diverge sharply: clean utility continues increasing, whereas poisoned utility reverses its trend and declines from its peak to 3%-34% at full coverage. Meanwhile, ASR rises rapidly to 37%-64%. This delayed but sharp divergence reveals a threshold-like nonlinearity: additional risk-bearing information has little downstream effect at low coverage but becomes increasingly influential once sufficient content is retained. Management-Stage Profile. Management can effectively mitigate memory risks, but its effectiveness differs substantially across attack types. Across the evaluated policies, clean utility varies by only 3%-5%, whereas ASR changes by up to 62%, indicating that management can locally decouple risk from clean performance. However, the extent of this decoupling is mechanism-specific. PQ reduces Sleeper ASR to nearly zero with little utility change but provides limited protection against MINJA, whereas SC achieves more consistent risk reductions across both attacks. Retrieval-Stage Profile. Retrieval exhibits a coupled utilityrisk response. As retrieval exposure increases, clean utility rises from approximately 10%–25% to 43%-70%, while ASR simultaneously increases from about 5%-18% to 34%5

(a) Writing

80%

0%

20% 0%

(e) Management

80%

60%

60%

60%

40%

20%

20%

0%

0%

(g) Writing

40% 20%

20% 0%

0.00

0.25

0.50

0.75

40% 20%

20% 0%

40% 20%

UM

PQ

(i) Retrieval

40%

(k) Management

0%

1.00

0%

Rate

40%

40%

(h) Management

0%

(j) Writing

(f) Retrieval

20%

Rate

40%

Rate

80%

Rate

Rate

40%

80%

0%

LoCoMo Sleeper

Rate

Rate

0%

Rate

Rate

20%

(d) Writing

60%

40%

20%

(c) Retrieval

80%

60%

40%

Rate

LoCoMo MINJA

Rate

LongMemEval Sleeper

Rate

60%

LongMemEval MINJA

(b) Management

80%

NC

(l) Retrieval

40% 20% 0%

SC

0.25

Memory policy

Writing coverage θw Clean utility

0.4

0.6

0.75

1.0

Exposure strength θr (low → high)

Poisoned utility

ASR

IQR

Figure 3: Stage-wise utility-risk profiles across 11 LLMs. Blue, green, and red denote clean utility, poisoned utility, and ASR; lines show the median, while shaded bands and box plots indicate the IQR. (c) Attack Success Rate

40%

20%

40%

0%

0

0.25

0.50

0.75

1.00

0%

0

0.25

0.50

0.75

Writing Coverage θw 0.75 ×

1.00

0%

0

0.25

0.50

0.75

0.8

1.0

(b) Poisoned Utility

40%

40%

Rate

40%

20%

0.75

1.00

0%

Other LLM

K = 5, Random

(a) Clean Utility

0.8

1.0

0%

K = 7, Random

0.2

0.4

0.6

0.8

1.0

K = 5, Similarity

(b) Poisoned Utility

(c) Attack Success Rate

0

0.25

0.50

0.75

Writing Coverage

Admission Ranker Self-LLM Random

1.00

0%

0

0.25

0.50

0.75

1.00

60%

Rate

0.50

0.6

20%

Rate

0.25

0.4

Figure 6: Retrieval-stage profiles across retrieval budgets and distractor-filling strategies.

60%

0

20%

0.2

Retrieval Exposure θr

(c) Attack Success Rate 60%

0%

0%

40%

1.25 ×

60%

Rate

Rate

0.6

K = 3, Random

Trace Units 1.0 ×

60%

20%

0.4

1.00

Figure 4: Writing-stage profiles across different trace loads. (a) Clean Utility

40%

40%

20%

Chronological

0%

Figure 5: Writing-stage profiles under different unit rankers.

60%

Rate

0%

60%

20%

0.2

(c) ASR

80%

60%

20%

20%

(b) Poisoned Utility

80%

60%

Rate

40%

20%

(a) Clean Utility

80%

Rate

40%

Rate

60%

Rate

(b) Poisoned Utility 60%

Rate

Rate

(a) Clean Utility 60%

40%

20%

50

100

300

500

0%

20%

50

100

300

500

Background Memory Size || Management Policy UM PQ NC

slots. As shown in Figure 6, the composition of background memories shifts the utility-risk operating point but does not remove the coupled retrieval-stage response. Asymmetric-exposure stability. We fix the helpful-record exposure probability at θ+ r = 0.8 and vary the risk-bearing exposure probability θ− r from 0.2 to 1.0. ASR increases steadily from 0.13 to 0.63, indicating that greater riskbearing exposure consistently amplifies attack risk even when helpful-record exposure remains fixed. Detailed results are provided in Section B.2 of the supplementary material. Memory-scale stability. Changing the memory-bank size primarily affects management and retrieval. Increasing |B| intensifies retrieval competition, resembling a tighter effective budget. Since retrieval sensitivity is examined above, we focus here on management and vary |B| from 50 to 500. As shown in Figure 7, when the memory bank grows, retrieval competition reduces both clean utility and ASR under

40%

0%

50

100

300

500

SC

Figure 7: Management-stage profiles across memory sizes.

UM. Nevertheless, management continues to produce distinct utility–risk shifts. At |Bi | = 500, PQ reduces ASR from 52% to 37% without changing clean utility, while NC and SC achieve larger ASR reductions with clean-utility decreases of 8 and 6 percentage points, respectively.

Key Finding 2. Within the evaluated model-datasetattack setting, the selected trace, ranking, retrieval, distractor, and memory-scale factors shift the onset and magnitude of the responses while preserving broadly similar qualitative stage-wise patterns.

6

4.4

Table 2: Retrieval results under different retrieval budgets.

RQ3: Correspondence in Existing Systems

We examine whether analogous stage-level measurements on Mem0, Hindsight, LangMem, and A-MEM exhibit qualitative correspondence with the controlled profiles. Table 1 reports the writing and management results. WR denotes the proportion of source units retained by the system’s writer, U0 denotes utility without memory, and M0 and M1 denote native management disabled and enabled, respectively. Unless otherwise specified, we use |Bi | = 100 and K = 5. Table 1: Writing and management results on real-world memory systems. WR is reported as mean ± standard deviation over 500 writing trials.

System

Metric

K=1 K=3 K=5 K=7

Mem0

RSR Clean U Poisoned U ASR

0.510 0.287 0.246 0.047

0.790 0.417 0.245 0.249

0.920 0.533 0.213 0.326

0.970 0.586 0.194 0.361

Hindsight

RSR Clean U Poisoned U ASR

0.460 0.293 0.241 0.086

0.730 0.472 0.224 0.359

0.880 0.563 0.165 0.475

0.930 0.642 0.134 0.537

RSR Clean U LangMem Poisoned U ASR

0.470 0.287 0.225 0.094

0.720 0.463 0.193 0.328

0.840 0.528 0.158 0.473

0.910 0.613 0.147 0.526

RSR Clean U Poisoned U ASR

0.420 0.246 0.213 0.122

0.650 0.395 0.176 0.313

0.790 0.483 0.130 0.403

0.860 0.527 0.095 0.478

A-MEM System

WR (%)

Mem0

36.5 ± 6.1 0.008

U0

Hindsight 69.4 ± 5.4 0.015 LangMem 74.5 ± 8.7 0.011 A-MEM

55.7 ± 7.7 0.008

Mode Clean U Poisoned U ASR M0 M1 M0 M1 M0 M1 M0 M1

0.533 0.541 0.563 0.524 0.528 0.523 0.483 0.460

0.213 0.343 0.165 0.240 0.158 0.325 0.130 0.218

0.326 0.176 0.475 0.293 0.473 0.225 0.403 0.297

gain is accompanied by a substantial increase in ASR, from 4.7%-12.2% to 36.1%-53.7%, and a decrease in poisoned utility from 21.3%-24.6% to 9.5%-19.4%. The strength of this response varies across systems: Hindsight gains 34.9% in clean utility but also increases ASR by 45.1%, whereas Mem0 shows a smaller ASR increase of 31.4% alongside a 29.9% utility gain. Nevertheless, the direction is consistent across implementations. This behavior is expected because retrieval ranks records by query relevance rather than distinguishing benign from risk-bearing content; increasing K therefore raises the exposure of both helpful and wellmatched risk-bearing records.

Writing-stage correspondence. Writing exposure varies substantially across the four systems, from 36.5% in Mem0 to 74.5% in LangMem. Meanwhile, U0 remains only 0.8%1.5%, confirming that the evaluated tasks largely depend on information supplied through memory. Under M0, higher writing exposure broadly coincides with greater risk. Mem0 has both the lowest WR and ASR (36.5% and 32.6%), whereas Hindsight and LangMem exhibit high WR (69.4%74.5%) and ASR (47.3%-47.5%). However, clean utility does not increase correspondingly: Mem0 achieves 53.3% clean utility despite its substantially lower WR, comparable to LangMem at 52.8%. These results suggest that greater writing exposure expands risk exposure without guaranteeing additional clean utility. Management-stage correspondence. Enabling native management reduces observed ASR in all four systems by 10.624.8 percentage points and increases poisoned utility by 7.5-16.7 percentage points. The corresponding clean-utility changes range from a 0.8-percentage-point increase to a 3.9percentage-point decrease. LangMem shows the largest ASR reduction, from 47.3% to 22.5%, with only a 0.5-percentagepoint decrease in clean utility. These results qualitatively correspond to the policy-dependent utility–risk shifts observed in the controlled management profiles. To evaluate retrieval, we vary the retrieval budget K as a proxy for increasing memory exposure; all experiments are conducted under M0 with |Bi | = 100, and RSR denotes the proportion of instances in which the target record (helpful or risk) appears in the top-K retrieved context. Retrieval-stage correspondence. Increasing the retrieval budget produces a consistent coupled utility-risk response across all four systems. As K increases from 1 to 7, RSR rises from 42%-51% to 86%-97%, while clean utility increases from 24.6%-29.3% to 52.7%-64.2%. This utility

Key Finding 3. The four existing systems exhibit qualitative correspondence with the controlled profiles: writing exposure raises risk without reliable utility gains, native management shifts the observed operating points toward lower ASR, and larger retrieval budgets are accompanied by increases in both clean utility and ASR. These results are diagnostic associations rather than controlled stage effects.

4.5

Human Evaluation

We validate AgentEval using 200 clean and 200 poisoned trajectories annotated independently by five human experts. Annotators judge whether each output is correct or, for poisoned trajectories, matches the attacker-predefined target; the final label is determined by majority vote. AgentEval achieves 91% agreement with the human labels, while interannotator agreement is κ = 0.78, supporting its use for evaluation.

5

Conclusion

This paper introduced M EM G AUGE, a paired, stage-wise framework for evaluating utility and risk in long-term memory systems. Across the evaluated settings, writing shows a threshold-like risk transition, management enables mechanism-dependent local decoupling, and retrieval cou7

ples utility gains with increased risk. These profiles persist across configurations and four existing memory systems, although their onset and magnitude vary. The results show that end-to-end metrics alone are insufficient and motivate stagespecific controls.

[11] Joon Sung Park, Joseph O’Brien, Carrie Jun Cai, Meredith Ringel Morris, Percy Liang, and Michael S Bernstein. Generative agents: Interactive simulacra of human behavior. In Proceedings of the 36th annual acm symposium on user interface software and technology, pages 1–22, 2023. 1

References

[12] Mitchell Piehl, Zhaohan Xi, Zuobin Xiong, Pan He, and Muchao Ye. Er-mia: Black-box adversarial memory injection attacks on long-term memory-augmented large language models. arXiv preprint arXiv:2602.15344, 2026. 1, 2

[1] Zhaorun Chen, Zhen Xiang, Chaowei Xiao, Dawn Song, and Bo Li. Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases. Advances in Neural Information Processing Systems, 37:130185– 130213, 2024. 1, 2

[13] Sidharth Pulipaka, Stanislau Hlebik, Leonidas Raghav, Sahar Abdelnabi, Vyas Raina, Ivaxi Sheth, and Mario Fritz. Hidden in memory: Sleeper memory poisoning in llm agents. 2026. 2, 4

[2] P Chhikara, D Khant, S Aryan, T Singh, and D Yadav. Mem0: Building production-ready ai agents with scalable long-term memory. arxiv 2025. arXiv preprint arXiv:2504.19413, 2025. 1, 2, 5

[14] Saksham Sahai Srivastava and Haoyu He. Memorygraft: Persistent compromise of llm agents via poisoned experience retrieval. arXiv preprint arXiv:2512.16962, 2025. 2

[3] Pritam Dash, Tongyu Ge, Aditi Jain, Tanmay Shah, and Zhiwei Shang. From untrusted input to trusted memory: A systematic study of memory poisoning attacks in llm agents. arXiv preprint arXiv:2606.04329, 2026. 1 [4] Shen Dong, Shaochen Xu, Pengfei He, Yige Li, Jiliang Tang, Tianming Liu, Hui Liu, and Zhen Xiang. Memory injection attacks on llm agents via query-only interaction. Advances in Neural Information Processing Systems, 38:46697–46731, 2026. 1, 2, 4

[15] Haoran Tan, Zeyu Zhang, Chen Ma, Xu Chen, Quanyu Dai, and Zhenhua Dong. Membench: Towards more comprehensive evaluation on the memory of llm-based agents. In Findings of the Association for Computational Linguistics: ACL 2025, pages 19336–19352, 2025. 2

[5] Noam Kochavi, Shaked Ilan, Sarah Wolstencroft, and Microsoft Defender Security Research Team. Manipulating AI memory for profit: The rise of AI recommendation poisoning. Microsoft Security Blog, February 2026. Accessed: July 28, 2026. 1

[16] Di Wu, Hongwei Wang, Wenhao Yu, Yuwei Zhang, Kai-Wei Chang, and Dong Yu. Longmemeval: Benchmarking chat assistants on long-term interactive memory. arXiv preprint arXiv:2410.10813, 2024. 1, 2, 4

[6] LangChain AI. Agentevals: Readymade evaluators for agent trajectories, 2025. Software repository, accessed 2026-07-28. 5

[17] Wujiang Xu, Zujie Liang, Kai Mei, Hang Gao, Juntao Tan, and Yongfeng Zhang. A-mem: Agentic memory for llm agents. Advances in Neural Information Processing Systems, 38:17577–17604, 2026. 2, 5

[7] LangChain AI. LangMem: Tools for building longterm memory in llm applications, 2025. Software repository, accessed July 28, 2026. 5

[18] Xianglin Yang, Yufei He, Shuo Ji, Bryan Hooi, and Jin Song Dong. Zombie agents: Persistent control of self-evolving llm agents via self-reinforcing injections. arXiv preprint arXiv:2602.15654, 2026. 1, 2

[8] Chris Latimer, Nicoló Boschi, Andrew Neeser, Chris Bartholomew, Gaurav Srivastava, Xuan Wang, and Naren Ramakrishnan. Hindsight is 20/20: Building agent memory that retains, recalls, and reflects. arXiv preprint arXiv:2512.12818, 2025. 1, 5

[19] Wanjun Zhong, Lianghong Guo, Qiqi Gao, He Ye, and Yanlin Wang. Memorybank: Enhancing large language models with long-term memory. In Proceedings of the AAAI conference on artificial intelligence, volume 38, pages 19724–19731, 2024. 1

[9] Zehao Lin, Xixuan Hao, Renyu Fu, Shaobo Cui, Kai Chen, Chunyu Li, Zhiyu Li, and Feiyu Xiong. A survey on long-term memory security in llm agents: Attacks, defenses, and governance across the memory lifecycle. arXiv preprint arXiv:2604.16548, 2026. 1

[20] Pengfei Zhou, Jiaxin Ai, Wangbo Zhao, Kai Wang, Xiaojiang Peng, Wenqi Shao, Hongxun Yao, Kaipeng Zhang, et al. Mpbench: A comprehensive multimodal reasoning benchmark for process errors identification. In Findings of the Association for Computational Linguistics: ACL 2025, pages 21586–21606, 2025. 2

[10] Adyasha Maharana, Dong-Ho Lee, Sergey Tulyakov, Mohit Bansal, Francesco Barbieri, and Yuwei Fang. Evaluating very long-term conversational memory of llm agents. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 13851–13870, 2024. 1, 2, 4 8

Related documents

• PSD: Pseudo Self-Distillation of Memory Representation Capabilities for LLM Agents#1049190
• Coupling Planning with Episodic Memory in LLM Agents for Software Issue Resolution#440442
• Optimal Skill Selection for LLM Agents with Provable Bicriteria Guarantees#1129365
• Creativity in LLM-based Multi-Agent Systems: A Survey#612784
• Creativity in LLM-based Multi-Agent Systems: A Survey#611307