共享状态的LLM代理会因用户间信息混淆导致错误，无需攻击者
No Attacker Needed: Unintentional Cross-User Contamination in Shared-State LLM Agents
- 在共享状态中，用户间良性交互会残留信息并被误用
- 无攻击情况下，错误率高达57%至71%
- 仅文本清理不够，需针对执行体进行防护
基于LLM的代理越来越多地在重复会话中运行，通过维护任务状态以保证连续性。在许多部署中，单个代理为团队或组织内的多个用户服务，跨用户身份复用共享知识层。这种共享持久性扩大了故障面：对某一用户局部有效的信息，在代理未考虑作用范围的情况下重新应用时，会悄然损害另一用户的结果。我们称此故障模式为无意的跨用户污染（UCC）。与对抗性记忆投毒不同，UCC无需攻击者；它源于良性交互产生的作用域限定产物持续存在并被后续误用。我们通过受控评估协议形式化了UCC，提出三种污染类型的分类，并在两种共享状态机制中评估该问题。在原始共享状态下，仅良性交互即导致57%–71%的污染率。写入时净化在对话式共享状态中有效，但在包含可执行产物的共享状态中仍残留显著风险，污染常表现为无声错误回答。结果表明，共享状态代理需要超越文本级净化的产物级防御，以防止无声的跨用户失败。
原文摘要 · Abstract (English)
LLM-based agents increasingly operate across repeated sessions, maintaining task states to ensure continuity. In many deployments, a single agent serves multiple users within a team or organization, reusing a shared knowledge layer across user identities. This shared persistence expands the failure surface: information that is locally valid for one user can silently degrade another user's outcome when the agent reapplies it without regard for scope. We refer to this failure mode as unintentional cross-user contamination (UCC). Unlike adversarial memory poisoning, UCC requires no attacker; it arises from benign interactions whose scope-bound artifacts persist and are later misapplied. We formalize UCC through a controlled evaluation protocol, introduce a taxonomy of three contamination types, and evaluate the problem in two shared-state mechanisms. Under raw shared state, benign interactions alone produce contamination rates of 57--71%. A write-time sanitization is effective when shared state is conversational, but leaves substantial residual risk when shared state includes executable artifacts, with contamination often manifesting as silent wrong answers. These results indicate that shared-state agents need artifact-level defenses beyond text-level sanitization to prevent silent cross-user failures.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。