arXiv:2607. 27080v1 Announce Type: cross Abstract: Memory systems allow agents to retain and reuse information from past interactions, but they can also let malicious content persist.
The paper introduces CAPTURE, a system designed to help personalized language agents distinguish genuine preference changes from temporary context shifts or malicious memory poisoning. CAPTURE employs a neural differential-equation belief tracker, a multi-timescale memory ledger, uncertainty-triggered clarification, and counterfactual auditing to resolve ambiguity. Experiments on 480 episodes from 96 users show CAPTURE outperforms baseline methods, limiting poisoning success while accepting most real preference updates.
arXiv:2605.01970v4 Announce Type: replace-cross Abstract: Memory systems enable otherwise stateless LLM agents to persist user information across sessions, but also introduce a new attack surface. Th...
Memory is becoming a default subsystem in deployed LLM agents to provide persistent personalization and continuity. This naturally prompts a question: will memory system introduce new vulnerabilities...
arXiv:2606. 06054v1 Announce Type: new Abstract: Personal AI agents increasingly rely on long-term memory to provide persistent personalization across sessions.
arXiv:2605. 08442v3 Announce Type: replace-cross Abstract: Persistent memory attacks against LLM agents achieve high attack success rates against open-source models.
arXiv:2605. 08442v5 Announce Type: replace-cross Abstract: We discover that prompt-injection success and tool-execution success are separable safety properties: defenses that block injection do not necessarily block execution, and vice versa.
InjecMEM introduces a memory injection attack that can steer the responses of large language model agents toward a desired output using only a single interaction, without needing read or edit access to the memory store. The attack leverages the retrieval‑then‑generate workflow of memory systems by crafting a retriever‑agnostic anchor with high‑recall topical cues and an adversarial command optimized through gradient‑based coordinate search. Experiments across various memory systems and backbone models show that InjecMEM reliably induces topic‑conditioned retrieval and targeted generation, remains effective even when memory drifts, and does not affect non‑target queries.
arXiv:2609. 04875v1 Announce Type: cross Abstract: Long-running LLM agents are stateful: beyond the transcript they accrete compressed summaries, plaintext memory, pending tool plans, and, under every serving API, a KV cache.
arXiv:2609.09115v1 Announce Type: new Abstract: Long horizon Large Language Model (LLM) agents rely on external memory systems to preserve user preferences and task knowledge across extended interact...
arXiv:2606. 10742v1 Announce Type: cross Abstract: External memory has become a core component of modern web agents, enabling long-horizon reasoning through the retrieval of past experiences.
AdaMem introduces adaptive memory policies that allow personalized agents to decide what information to write into long‑term memory based on user preferences for each interaction context. Each policy is updated from periodic feedback and controls subsequent memory writing, aiming to improve relevance and reduce unnecessary memory persistence. In experiments on AdaMem‑Bench, AdaMem raises QA accuracy from 80.0% to 84.35% while cutting persistent memory by 9.27%, though models still struggle to execute policies reliably.