← Back to all news
arXiv AI By Haoran Bu, Yiting Shen, Litian Zhang, Ruihan Hu, Xi Zhang

Is it my preference? Role Grounding Attack against Agent's Memory via Social Interaction

Read the original on arXiv AI →

The paper introduces the Role Grounding Attack (RGA), a method that exploits a vulnerability in LLM-based agents’ memory systems where preferences can be misattributed from an attacker to the victim’s user. By publishing nested conversation posts that quote attacker-user interactions, the attacker causes the victim agent to record the attacker’s preferences as its own, leading to misinformed decisions. The study demonstrates RGA’s effectiveness in tool‑selection manipulation and privacy leakage across multiple memory systems and language models, highlighting the need for stronger role grounding mechanisms.

Machine-generated by The Flow from the publisher's headline and feed description — not written or checked by a human. The full article lives at arXiv AI.

Related stories

arXiv Machine Learning
Oct 22

Combining Long-Term Memory and LLMs Comes at a High Cost: From Prompt Injection to Persistent Compromise

The paper investigates a new vulnerability called memory injection, where malicious prompts can persist across sessions in modern LLM‑as‑a‑service platforms. By demonstrating that all NIST attack goals can be achieved on ChatGPT Instant 5.3, Claude Sonnet 4.6, and Gemini 3 Flash, the authors show that these services can spread disinformation, generate harmful content, or cause offline unresponsiveness even in fresh sessions. The study also reveals that many proposed defenses are not yet implemented and provides datasets and artifacts for further research.

By Pedro H. Barcha Correia, Matheus Azevedo de S\'a, Paulo H. Gomes de Senna, Giovanni Mandel Martignago, Victor Takashi Hayashi, Charles Christian Miers, Marcos A. Simplicio Jr
llmsragagentssafety
More like this →
arXiv AI
Sep 21

CIPL: A Channel-Aware Framework for Recoverable Privacy Leakage in LLM Agents

CIPL (Channel Inversion for Privacy Leakage) is a channel-aware framework designed to evaluate black-box privacy leakage in large language model agents. It models the leakage process through stages of sensitive source, selection, assembly, execution, observation, and extraction, assessing how selected sensitive units become attacker-recoverable outputs. Experiments across memory, retrieval, and tool-mediated targets, plus a live-agent case study, reveal that recoverability depends on factors beyond storage labels, such as observation surface, prompt alignment, retrieval depth, and provider behavior, and that a semantic audit can uncover disclosures missed by exact matching.

By Tao Huang, Guosen Wu, Guolong Zheng, Jiayang Meng, Chen Hou, Xu Yang, Xuechao Yang, Feng Xia
llmsagentssafety
More like this →