攻击者可植入虚假记忆，长期影响大模型助手行为。
Hidden in Memory: Sleeper Memory Poisoning in LLM Agents
- 通过伪造外部内容诱导模型存储虚假用户记忆。
- 99.8%成功率将恶意记忆写入GPT-5.5，60%-89%被调用后引发攻击意图行为。
- 适用于研究模型安全、隐私保护的开发者与研究人员。
大型语言模型正越来越多地引入持久化记忆，以在会话间保存用户信息，实现个性化和连续性。这种状态特性引入了新安全风险：攻击者可通过恶意内容污染模型所记住的信息，从而影响未来交互。本文提出并研究了“沉睡记忆投毒”攻击——攻击者操纵外部上下文（如文档、网页或代码库），使助手在不经意间存储关于用户的虚构记忆。该攻击具有延迟性，可在多个后续对话中潜伏并重现。我们评估了完整攻击链：中毒记忆是否被写入、是否被召回，以及是否用于引导后续对话。在多个具备状态的大模型助理中，对GPT-5.5的中毒记忆写入率高达99.8%，对Kimi-K2.6为95%；成功召回后，60%-89%的评估中，中毒记忆导致攻击者期望的智能体行为。结果表明，持久记忆可能成为跨多次对话的长期攻击面。
原文摘要 · Abstract (English)
Large language models are increasingly augmented with persistent memory, allowing assistants to store user-specific information across sessions for personalization and continuity. This statefulness introduces a new security risk: adversarial content can corrupt what an assistant remembers and thereby influence future interactions. We propose and study sleeper memory poisoning, a delayed attack in which an adversary manipulates external context, such as a document, webpage, or repository, to cause the assistant to store a fabricated memory about the user. Unlike conventional prompt injection, the attack can remain dormant and re-emerge across multiple later conversations. We evaluate the full attack pipeline: whether poisoned memories are written, later retrieved, and ultimately used to steer the following conversations. Across stateful LLM assistants, poisoned memories were added up to 99.8% on GPT-5.5 and 95% on Kimi-K2.6. Crucially, among successful retrievals, poisoned memories cause attacker-intended agentic actions in 60-89% of evaluations across models. These results show that persistent memory can act as a long-term attack surface across multiple future conversations.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。