Tag
The paper introduces CAPTURE, a method to distinguish between genuine user preference changes and malicious memory poisoning in personalized language agents using neural differential equations and causal auditing.
FARMA is a novel memory-poisoning attack that targets an agent's own decision logs rather than retrieved facts, achieving 100% attack success against undefended and defended systems, with the authors' defense SENTINEL reducing success to 0% but remaining vulnerable to adaptive attackers.
This paper introduces GhostWriter, a novel attack vector that exploits memory subsystems in LLM-powered personal agents to poison their memory store, achieving high injection and activation rates. The authors propose AM-Sentry, a defense that significantly reduces attack success while maintaining agent utility.
Google DeepMind's paper provides the first clear taxonomy of six attack types on autonomous AI agents, revealing that harmful websites can hide content like instructions in HTML comments or steganography that agents parse but humans never see, achieving up to 86% agent commandeering in benchmarks.
This paper presents ElephantAgent, a protocol that enforces Contextual State Continuity to defend against contextual state poisoning in agentic systems, using replicated trusted hardware and historical traceability.
Two papers published this week address agent memory poisoning and privacy leaks, but no readily usable library or tool has been released to implement these fixes.
This paper audits LangChain, AutoGPT, and OpenAI Agents SDK for architectural safety guarantees and finds no native compliance with containment principles, demonstrating that memory poisoning can cause persistent failures; it introduces lightweight mechanisms to eliminate such attacks.
This paper identifies a structural failure in multi-agent AI pipelines where memory-layer attacks can be misattributed as model misalignment, formalizing Semantic Norm Drift (SND) and proposing Counterfactual Composition Testing and Memory-Persistent Information-Flow Control as defenses.
MemAudit is a post-hoc auditing framework for memory-augmented LLM agents that identifies poisoned memories by combining counterfactual influence scores and structural anomaly detection, reducing attack success rates from over 70% to 0% in realistic scenarios.