发现大模型记忆漏洞，揭示持久化攻击的三大隐蔽类型
MemPoison: Uncovering Persistent Memory Threats and Structural Blind Spots in LLM Agents
- 构建1227个验证案例的评测框架，覆盖四类攻击与三类记忆结构
- 实测显示现有防御对复合型攻击无效，存在结构性盲区
- 建议从静态过滤转向动态上下文感知的记忆防护策略
持久化外部记忆虽提升智能体连续性，却引入持久安全风险：攻击者可通过标准交互通道注入恶意内容，长期留存并干扰后续行为。为此，我们提出MemPoison，一个包含1227个人工验证案例的综合评测与分析框架，涵盖四种攻击类型、三种注入渠道及三种典型记忆底座，评估了七种开源与三种闭源模型家族。我们提出三层分类体系：(L1) 单条记录直接污染，(L2) 多条记录组合污染，(L3) 上下文触发的休眠污染。评估结果揭示明显防御边界：基础写入时防御（如一致性检查）虽能有效抑制L1攻击，但无法可靠抵御L2和L3攻击。通过机制影响分解（MID），我们揭示写入时防御存在结构性盲区，看似无害的记录可能通过联合检索组合或触发条件激活后产生危害。研究呼吁从静态过滤转向自适应、上下文敏感的记忆防御策略。
原文摘要 · Abstract (English)
Persistent external memory enhances agent continuity but introduces persistent security vulnerabilities: adversarial content can be injected via standard interaction channels, retained across turns, and later distort downstream behavior. To address this challenge, we propose MemPoison, a comprehensive benchmark and analysis framework featuring 1227 hand-validated cases across four attack types, three injection channels, and three representative memory substrates, evaluated on seven open-weight and three closed-weight model families. We introduce a three-tier taxonomy: (L1) direct single-record corruption, (L2) compositional multi-record corruption and (L3) context-triggered dormant corruption. Our evaluations reveal a distinct defense frontier: while baseline write-time defenses, such as consistency checks, substantially suppress direct L1 attacks, they fail to reliably suppress L2 and L3 attacks. Through mechanistic influence decomposition (MID), we demonstrate structural blind spots in write-time defenses, which admit seemingly benign records that later become harmful through joint retrieval composition or trigger-conditioned activation. Our findings advocate for shifting from static filtering to adaptive, context-sensitive memory defense strategies.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。