记忆中的个性偏见会悄悄影响大模型工具调用，导致错误决策。
Memory-Induced Tool-Drift in LLM Agents
- 通过自动化对抗生成105个场景，构建了评估记忆偏见影响的基准
- 7个前沿模型在有偏记忆下工具调用偏离度最高升3.6分（满分为5）
- 现有防御手段无法根治，尤其在真实工具服务中广泛存在
现代大模型智能体结合长期记忆实现个性化，同时通过工具调用与外部世界交互——这一组合支撑了当前主流生产系统。本文首次揭示该组合的隐藏缺陷：存储于记忆中的个性偏见（如成本敏感、急躁、风险偏好等）会在不适用的情境下悄然影响工具调用。我们将其称为记忆诱导的工具漂移（Memory-Induced Tool-Drift），并构建了涵盖五个偏见维度和七个专业领域的105个场景的基准测试集MEMDRIFT，由自动化对抗流水线生成。在七个前沿模型上，带有偏见的记忆使判官评分的参数偏离度（deflection score）最高上升3.6分（1–5分制）。即使采用三种生产级记忆架构，该现象仍持续存在。在对288个已验证MCP服务器的6,062个工具扫描中，发现608个工具存在易受漂移影响的参数，并在验证子集中确认了实际漂移。机制上，偏见记忆作为隐式引导向量，推动激活沿与显式指令相同的潜在方向；同时将注意力从任务相关上下文转移至与目标参数表面关键词重合的记忆条目。标准防御措施（基于提示的相关性指令与记忆过滤）虽能缓解但无法消除漂移。随着智能体代用户执行越来越关键的任务，这种系统性漏洞尚未被现有防护覆盖，亟需在记忆管理与工具调用生成交汇处发展专用防御机制。
原文摘要 · Abstract (English)
Modern LLM agents combine long-term memory for personalization with tool-calling interfaces for taking actions in the world -- a combination underpinning contemporary production systems. We study a previously unexamined failure of this combination: when personality-driven biases stored in memory (cost-consciousness, impatience, risk tolerance, etc.) silently affect tool calls in contexts where they are not applicable. We call this memory-induced tool-drift and operationalize it through MEMDRIFT, a benchmark of 105 scenarios spanning five bias dimensions and seven professional domains, generated through an automated adversarial pipeline. Across seven frontier models -- including those with extended reasoning -- biased memories raise deflection scores (a judge-scored measure of parameter deviation from unbiased baselines) by up to $+3.6$ points on a 1--5 scale. Tool-drift persists when memory management is handled by three production memory architectures. The phenomenon affects real-world tools: scanning 6{,}062 tools across 288 verified MCP servers, we flag 608 with susceptible parameters and confirm tool-drift on a validated subset. Mechanistically, biased memories act as implicit steering vectors, pushing activations along the same latent directions as explicit behavioral instructions. They also redistribute attention from task-relevant context toward memory entries with surface-level keyword overlap to the target parameter. Standard defenses -- prompt-based relevance instructions and memory filters -- reduce drift but do not eliminate it. As agents take increasingly consequential actions on a user's behalf, memory-induced tool-drift represents a systematic vulnerability that current safeguards do not address, motivating dedicated defenses at the intersection of memory management and tool-call generation.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。