arXiv Machine Learning June 30, 2026 By Jun Wen Leong

Forensic Trajectory Signatures for Agent Memory Poisoning Detection

Read the original on arXiv Machine Learning →

arXiv:2606. 30566v1 Announce Type: cross Abstract: We discover a behavioral invariant in LLM agents under persistent memory poisoning: in architectures where routing information is retrieved through observable memory-tool invocations, successful attacks require calling memory_recall_fact before email_send_email, a transition that non-exfiltrating sessions rarely exhibit.

Summary generated by The Flow from the publisher's feed. The full article lives at arXiv Machine Learning.

arXiv AI

Aug 5

Injection-Execution Dissociation: A Mechanistic Evaluation of Persistent Memory Attacks and Defenses in Stateful LLM Agents

arXiv:2605. 08442v5 Announce Type: replace-cross Abstract: We discover that prompt-injection success and tool-execution success are separable safety properties: defenses that block injection do not necessarily block execution, and vice versa.

By Jun Wen Leong

llms rag agents benchmarks safety

arXiv AI

Jul 8

Doomed from the Start: Early Abort of LLM Agent Episodes via a Recall-Controlled Probe Cascade

arXiv:2607. 06503v1 Announce Type: new Abstract: Large language model (LLM) agents solving multi-step tasks frequently commit to trajectories that are doomed to fail, yet continue to consume substantial inference compute before the failure becomes observable.

By Kai Ruan, Zihe Huang, Ziqi Zhou, Qianshan Wei, Xuan Wang, Hao Sun

llms agents

arXiv AI

Jul 31

MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair

arXiv:2607. 27080v1 Announce Type: cross Abstract: Memory systems allow agents to retain and reuse information from past interactions, but they can also let malicious content persist.

By Xuanze Chen, Xukang Xie, Wentao Fu, Jiajun Zhou, Shanqing Yu, Qi Xuan

llms agents benchmarks

arXiv Machine Learning

Aug 4

Why Formal Monitors Fail: Attack Distribution Entropy as a Coverage Bound for LTL-Based LLM Agent Safety

arXiv:2608. 01388v1 Announce Type: cross Abstract: Runtime safety monitors based on Linear Temporal Logic (LTL) and finite automata (FSA) are increasingly deployed to intercept unsafe tool-call sequences in LLM agents.

By Ruiyang Zhang

llms agents safety

arXiv Machine Learning

Jun 25

Defense effectiveness across architectural layers: a mechanistic evaluation of persistent memory attacks on stateful LLM agents

arXiv:2605. 08442v3 Announce Type: replace-cross Abstract: Persistent memory attacks against LLM agents achieve high attack success rates against open-source models.

By Jun Wen Leong

llms rag agents multimodal

arXiv AI

Jul 14

The Compliance Trap: Diagnosing How AI Agents Consume Conflicting Memory

arXiv:2607. 10608v1 Announce Type: new Abstract: Memory is becoming a core component of long-horizon AI agents, allowing agents to reuse past experience when operating web browsers, software tools, and other interactive environments.

By Yixiong Chen, Xinyi Bai, Alan Yuille

agents benchmarks

Related stories

Injection-Execution Dissociation: A Mechanistic Evaluation of Persistent Memory Attacks and Defenses in Stateful LLM Agents

Doomed from the Start: Early Abort of LLM Agent Episodes via a Recall-Controlled Probe Cascade

MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair

Why Formal Monitors Fail: Attack Distribution Entropy as a Coverage Bound for LTL-Based LLM Agent Safety

Defense effectiveness across architectural layers: a mechanistic evaluation of persistent memory attacks on stateful LLM agents

The Compliance Trap: Diagnosing How AI Agents Consume Conflicting Memory