arXiv Machine Learning June 30, 2026 By Jun Wen Leong

Forensic Trajectory Signatures for Agent Memory Poisoning Detection

Read the original on arXiv Machine Learning →

arXiv:2606. 30566v1 Announce Type: cross Abstract: We discover a behavioral invariant in LLM agents under persistent memory poisoning: in architectures where routing information is retrieved through observable memory-tool invocations, successful attacks require calling memory_recall_fact before email_send_email, a transition that non-exfiltrating sessions rarely exhibit.

Machine-generated by The Flow from the publisher's headline and feed description — not written or checked by a human. The full article lives at arXiv Machine Learning.

arXiv AI

Aug 5

Injection-Execution Dissociation: A Mechanistic Evaluation of Persistent Memory Attacks and Defenses in Stateful LLM Agents

arXiv:2605. 08442v5 Announce Type: replace-cross Abstract: We discover that prompt-injection success and tool-execution success are separable safety properties: defenses that block injection do not necessarily block execution, and vice versa.

By Jun Wen Leong

llms rag agents benchmarks safety

arXiv AI

Jul 8

Doomed from the Start: Early Abort of LLM Agent Episodes via a Recall-Controlled Probe Cascade

arXiv:2607. 06503v1 Announce Type: new Abstract: Large language model (LLM) agents solving multi-step tasks frequently commit to trajectories that are doomed to fail, yet continue to consume substantial inference compute before the failure becomes observable.

By Kai Ruan, Zihe Huang, Ziqi Zhou, Qianshan Wei, Xuan Wang, Hao Sun

llms agents

arXiv AI

Sep 23

The Price of Safety: Benign-Case Utility and Token Overhead of Memory-Poisoning Defenses in LLM Agents

arXiv:2609.22818v1 Announce Type: cross Abstract: Memory-poisoning defenses for LLM agents are typically evaluated by their ability to prevent attacks. However, the traffic they process is rarely adv...

By Pritom Bhowmik

llms rag agents safety

arXiv AI

Jul 31

MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair

arXiv:2607. 27080v1 Announce Type: cross Abstract: Memory systems allow agents to retain and reuse information from past interactions, but they can also let malicious content persist.

By Xuanze Chen, Xukang Xie, Wentao Fu, Jiajun Zhou, Shanqing Yu, Qi Xuan

llms agents benchmarks

arXiv AI

Sep 7

Forgetting Without Restarting: Execution-State Unlearning for Stateful LLM Agents

arXiv:2609. 04875v1 Announce Type: cross Abstract: Long-running LLM agents are stateful: beyond the transcript they accrete compressed summaries, plaintext memory, pending tool plans, and, under every serving API, a KV cache.

By Chao Yao, Yangbo Wei, Zhen Huang, Junhong Qian, Chenle Chen, Shaoqiang Lu, Chen Wu, Lei He

llms agents efficiency

arXiv Machine Learning

Aug 4

Why Formal Monitors Fail: Attack Distribution Entropy as a Coverage Bound for LTL-Based LLM Agent Safety

arXiv:2608. 01388v1 Announce Type: cross Abstract: Runtime safety monitors based on Linear Temporal Logic (LTL) and finite automata (FSA) are increasingly deployed to intercept unsafe tool-call sequences in LLM agents.

By Ruiyang Zhang

llms agents safety

One email a morning, machine-written

Related stories

Injection-Execution Dissociation: A Mechanistic Evaluation of Persistent Memory Attacks and Defenses in Stateful LLM Agents

Doomed from the Start: Early Abort of LLM Agent Episodes via a Recall-Controlled Probe Cascade

The Price of Safety: Benign-Case Utility and Token Overhead of Memory-Poisoning Defenses in LLM Agents

MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair

Forgetting Without Restarting: Execution-State Unlearning for Stateful LLM Agents

Why Formal Monitors Fail: Attack Distribution Entropy as a Coverage Bound for LTL-Based LLM Agent Safety