paperarXivTrust 82 · PrimaryPublished 4d agoLive · yesterday

Utility Under Attack: Agent Memory Poisoning and the Limits of Content Screening and Provenance Ranking

Persistent memory makes false information durable: once a false statement is stored, it can be retrieved into future sessions that match it. We measure the cost of this failure mode using plainly worded false assertions generated in a single pass, with no instruction, trigger, or retriever optimization. Poisoning 1.2% of a LongMemEval corpus reduces accuracy from 0.850 to 0.300. A four-stage write-time screening pipeline that reaches 0.832 recall on indirect prompt injection while flagging 1.5% of trigger-word-laden benign text rejects 0 of 360 poisoned memories. We argue this exposes a bounda

Lineage graph

Paper → model → repo connections mined from source citations (Tier-1 exact match).

Why these links exist

Every edge carries a method, confidence, and the source snippet that justified it — so bad links are debuggable.

PossiblePossibly related (embedding) · 53%MemoryOps AI: governed memory runtime for LLM agents with deletion-leakage evals and context admission [P] →
FuzzySimilar title/name (fuzzy) · 59%AgentCore-8B →
“Fuzzy title match (0.73): “Utility Under Attack: Agent Memory Poisoning and the Limits ” ≈ “AgentCore-8B””
PossiblePossibly related (embedding) · 48%We're building agents that can read millions of documents, but still forget a video they watched yesterday. →
PossiblePossibly related (embedding) · 48%Agents collapse "observed", "concluded", and "generated" into one confidence level. Is anyone modeling epistemic status directly instead of just improving retrieval? [D] →
LinkedLinked via arxiv author · 85%Arulnidhi Karunanidhi →
“Utility Under Attack: Agent Memory Poisoning and the Limits of Content Screening and Provenance Ranking”
FuzzySimilar title/name (fuzzy) · 87%SWE-agent/SWE-agent →
“Fuzzy title match (0.94): “Utility Under Attack: Agent Memory Poisoning and the Limits ” ≈ “SWE-agent/SWE-agent””
FuzzySimilar title/name (fuzzy) · 87%zhayujie/CowAgent →
“Fuzzy title match (0.94): “Utility Under Attack: Agent Memory Poisoning and the Limits ” ≈ “zhayujie/CowAgent””
FuzzySimilar title/name (fuzzy) · 66%TencentCloud/TencentDB-Agent-Memory →
“Fuzzy title match (0.78): “Utility Under Attack: Agent Memory Poisoning and the Limits ” ≈ “TencentCloud/TencentDB-Agent-Memory””

Covers

newsMemoryOps AI: governed memory runtime for LLM agents with deletion-leakage evals and context admission [P]newsWe're building agents that can read millions of documents, but still forget a video they watched yesterday.newsAgents collapse "observed", "concluded", and "generated" into one confidence level. Is anyone modeling epistemic status directly instead of just improving retrieval? [D]

Has model

modelAgentCore-8B

authored (incoming)

personArulnidhi Karunanidhi

Implements (incoming)

repoSWE-agent/SWE-agent repozhayujie/CowAgent repoTencentCloud/TencentDB-Agent-Memory repoNousResearch/hermes-agent repoiflytek/astron-agent

Related across the graph

newsWe're building agents that can read millions of documents, but still forget a video they watched yesterday.repoSWE-agent/SWE-agent repozhayujie/CowAgent repoNousResearch/hermes-agent newsAgents collapse "observed", "concluded", and "generated" into one confidence level. Is anyone modeling epistemic status directly instead of just improving retrieval? [D]modelAgentCore-8B newsMemoryOps AI: governed memory runtime for LLM agents with deletion-leakage evals and context admission [P]repoiflytek/astron-agent repoTencentCloud/TencentDB-Agent-Memory personArulnidhi Karunanidhi

Topics

cs.AI