提出首个可认证防御多轮记忆污染的系统SMSR，保障大模型持续记忆安全。
SMSR: Certified Defence Against Runtime Memory Poisoning in Persistent LLM Agent Systems
- 写入时加HMAC签名，阻止未授权记忆注入
- 查询时随机删减并投票过滤，将攻击成功率压至8%以下
- 适合需长期记忆的工业级大模型应用，如客服、金融助手
检索增强生成（RAG）代理越来越多地使用跨会话持续记忆，这带来新攻击面：攻击者仅通过正常交互即可注入伪造记忆，一旦被检索便影响后续用户响应，且不修改模型权重或代码。我们称此为多轮会话记忆污染（MSMP），并发现现有防御均无认证能力；静态语料库防御（RobustRAG、ReliabilityRAG）假设知识库固定，启发式过滤可被流畅的企业级文本绕过。本文提出签名记忆平滑检索（SMSR），首个在该场景下具备可认证鲁棒性边界的防御。组件1在写入时添加HMAC-SHA256溯源信息，阻断无签名注入；组件2在查询时引入随机记忆删减与基于判断的多数投票，限定已认证攻击者的影响力。我们证明，任何无溯源的检索期过滤器无法认证抵御自适应注入，推导出超几何分布证书用于组件2，并形式化一致少数效应——即一致的恶意回答在字符串投票中以数值少数胜出，而基于判断的投票可将其剔除。在15个企业场景（3,150次重复试验）中，组件1将未签名攻击成功率从93%-100%降至0%。对单次注入的认证攻击者，组件2将成功率控制在8.0%（95%置信区间[5.8, 10.9]，n=450），低于认证上限。在端到端仅查询攻击中（代理自身写入毒化记忆），SMSR将成功率从65.3%降至5.3%（n=150，非重叠置信区间），在真实代理栈上验证有效。干净查询性能保持90%（组件1）和85%（联合）。
原文摘要 · Abstract (English)
Retrieval-augmented generation (RAG) agents increasingly run with persistent memory that accumulates across user sessions. This creates a new attack surface: an adversary interacting only through normal channels can inject crafted memories that, once retrieved, steer the agent's responses for future users, without touching model weights or code. We call this Multi-Session Memory Poisoning (MSMP) and show that no existing defence certifies against it; static-corpus defences (RobustRAG, ReliabilityRAG) assume a fixed knowledge base, and heuristic filters are bypassed by fluent enterprise-style text. We present Signed Memory with Smoothed Retrieval (SMSR), the first defence with a certified robustness bound for this setting. Component 1 adds HMAC-SHA256 provenance at write time, blocking unsigned injection. Component 2 applies randomised memory ablation with verdict-based majority voting at query time, bounding the influence of authenticated adversaries. We prove that no provenance-free retrieval-time filter can certify against adaptive injection, derive a hypergeometric certificate for Component 2, and formalise the Consistent Minority Effect, whereby a consistent adversarial answer wins string-based voting as a numerical minority while verdict-based voting removes it. Across 15 enterprise scenarios (3,150 repeated trials), Component 1 cuts attack success from 93-100% to 0% for all unsigned variants. For an authenticated adversary with a single injection, Component 2 holds success to 8.0% (95% CI [5.8, 10.9], n=450), below the certified worst case. In an end-to-end query-only attack where the agent itself writes the poison rather than it being pre-seeded, SMSR reduces success from 65.3% to 5.3% (n=150, non-overlapping CIs) on a live agent stack. Clean-query utility is 90% (Component 1) and 85% (combined).
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。