MemoryDojo benchmarks poisoning attacks on LLM agent memory
Original title: MemoryDojo: Benchmarking Poisoning Through LLM Agent Memory
Benchmark with 155 trajectories demonstrates all tested memory systems are susceptible to poisoning.
MemoryDojo traces the lifecycle of poisoned information through agent memory systems across long-horizon tasks. The benchmark includes 155 multi-session trajectories spanning four domains and supports five memory architectures. All systems proved vulnerable with substantial differences in downstream behavioral impact. A memory-aware poison optimization process further increased efficacy.
Unconfirmed: Proposed optimization is theoretical and requires empirical validation on additional architectures.
- 155 multi-session trajectories
- Four domains and five memory systems
- All architectures susceptible to poisoning
- Variation in downstream effects across systems
Impact: malicious instructions stored and propagated in memory
| Product | Affected |
|---|---|
| LLM agent memory systems | — |
- Products
- LLM agent memory systems
From the original article
1 min read at arxiv.orgLLM agents benefit from using memory systems to improve performance on long-horizon, multi-session tasks. However, memory introduces a critical attack surface. Malicious instructions encountered in one session may be stored and propagated through memory before being retrieved and acted upon in later sessions.
By David H. Yang · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.