arXiv AI
The Price of Safety: Benign-Case Utility and Token Overhead of Memory-Poisoning Defenses in LLM Agents
Read the original on arXiv AI →The Flow has not summarised this story yet — read it at arXiv AI.
Related stories
arXiv Machine Learning
Jun 25
Defense effectiveness across architectural layers: a mechanistic evaluation of persistent memory attacks on stateful LLM agents
arXiv:2605. 08442v3 Announce Type: replace-cross Abstract: Persistent memory attacks against LLM agents achieve high attack success rates against open-source models.
arXiv AI
Sep 30
CounterSteer: Suppressing Indirect Prompt Injection with Activation Steering
arXiv:2609.36570v1 Announce Type: cross Abstract: Indirect prompt injection makes an LLM agent treat untrusted retrieved text as instructions. We present CounterSteer, an inference-time defense that...
arXiv AI
Aug 5
Injection-Execution Dissociation: A Mechanistic Evaluation of Persistent Memory Attacks and Defenses in Stateful LLM Agents
arXiv:2605. 08442v5 Announce Type: replace-cross Abstract: We discover that prompt-injection success and tool-execution success are separable safety properties: defenses that block injection do not necessarily block execution, and vice versa.
arXiv AI
Jun 12
SMSR: Certified Defence Against Runtime Memory Poisoning in Persistent LLM Agent Systems
arXiv:2606. 12703v1 Announce Type: cross Abstract: Retrieval-augmented generation (RAG) agents increasingly run with persistent memory that accumulates across user sessions.
arXiv AI
Jul 23
ChannelGuard: Safe Models Do Not Compose into Safe Multi-Agent Systems
arXiv:2607. 19430v1 Announce Type: cross Abstract: Multi-agent LLM applications chain a planner, worker agents, a verifier, and a synthesizer, and every hop between agents is an unmonitored channel through which an adversary can smuggle instructions.
arXiv Computation and Language
Oct 23
Memories That Outlive Their Reasons: Dependency-Tethered Memory for Tool-Using LLM Agents
The paper introduces Dependency‑Tethered Memory (Tether), a memory system for tool‑using LLM agents that records the exact versions of premises each verdict depends on. By withdrawing any verdict whose support has failed anywhere in the store, Tether reduces unsafe publications to 0.3% and cuts verification calls by 37% compared to naive fact memory, while maintaining similar recall. The study demonstrates that capturing dependencies is crucial for safe memory use, as weaker writers or delayed relation arrivals increase unsafe publication rates.