{"id":"https://openalex.org/W7161547260","doi":"https://doi.org/10.48550/arxiv.2605.15338","title":"Hidden in Memory: Sleeper Memory Poisoning in LLM Agents","display_name":"Hidden in Memory: Sleeper Memory Poisoning in LLM Agents","publication_year":2026,"publication_date":"2026-05-14","ids":{"openalex":"https://openalex.org/W7161547260","doi":"https://doi.org/10.48550/arxiv.2605.15338"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.15338","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.15338","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.15338","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5124896747","display_name":"Sidharth Pulipaka","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Pulipaka, Sidharth","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136452148","display_name":"Stanislau Hlebik","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Hlebik, Stanislau","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5128216376","display_name":"Leonidas Raghav","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Raghav, Leonidas","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5040674721","display_name":"Sahar Abdelnabi","orcid":"https://orcid.org/0009-0000-5269-951X"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Abdelnabi, Sahar","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5024132945","display_name":"Vyas Raina","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Raina, Vyas","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136399520","display_name":"Ivaxi Sheth","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sheth, Ivaxi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5136380226","display_name":"Mario Fritz","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Fritz, Mario","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.19269999861717224,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.19269999861717224,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.10270000249147415,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12128","display_name":"AI in Service Interactions","score":0.06909999996423721,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/adversary","display_name":"Adversary","score":0.6833000183105469},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.5551000237464905},{"id":"https://openalex.org/keywords/stateful-firewall","display_name":"Stateful firewall","score":0.5430999994277954},{"id":"https://openalex.org/keywords/recall","display_name":"Recall","score":0.31679999828338623},{"id":"https://openalex.org/keywords/attack-surface","display_name":"Attack surface","score":0.2824000120162964},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.28200000524520874}],"concepts":[{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7360000014305115},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.6833000183105469},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5943999886512756},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.5551000237464905},{"id":"https://openalex.org/C22927095","wikidata":"https://www.wikidata.org/wiki/Q1784206","display_name":"Stateful firewall","level":3,"score":0.5430999994277954},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.5016000270843506},{"id":"https://openalex.org/C46312422","wikidata":"https://www.wikidata.org/wiki/Q11024","display_name":"Communication","level":1,"score":0.39160001277923584},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.36340001225471497},{"id":"https://openalex.org/C100660578","wikidata":"https://www.wikidata.org/wiki/Q18733","display_name":"Recall","level":2,"score":0.31679999828338623},{"id":"https://openalex.org/C188147891","wikidata":"https://www.wikidata.org/wiki/Q147638","display_name":"Cognitive science","level":1,"score":0.31529998779296875},{"id":"https://openalex.org/C180747234","wikidata":"https://www.wikidata.org/wiki/Q23373","display_name":"Cognitive psychology","level":1,"score":0.3018999993801117},{"id":"https://openalex.org/C2776576444","wikidata":"https://www.wikidata.org/wiki/Q303569","display_name":"Attack surface","level":2,"score":0.2824000120162964},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.28200000524520874},{"id":"https://openalex.org/C76178495","wikidata":"https://www.wikidata.org/wiki/Q4808784","display_name":"Asset (computer security)","level":2,"score":0.27619999647140503},{"id":"https://openalex.org/C12186640","wikidata":"https://www.wikidata.org/wiki/Q6815743","display_name":"Memory model","level":3,"score":0.272599995136261},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.2703999876976013},{"id":"https://openalex.org/C183003079","wikidata":"https://www.wikidata.org/wiki/Q1000371","display_name":"Personalization","level":2,"score":0.266400009393692},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.2630000114440918},{"id":"https://openalex.org/C2775992745","wikidata":"https://www.wikidata.org/wiki/Q6815763","display_name":"Memory work","level":2,"score":0.26170000433921814},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.25290000438690186}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.15338","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.15338","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.15338","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.15338","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.7358273267745972,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Large":[0],"language":[1],"models":[2],"are":[3,101],"increasingly":[4],"augmented":[5],"with":[6],"persistent":[7,150],"memory,":[8],"allowing":[9],"assistants":[10],"to":[11,65,69,108,122],"store":[12,70],"user-specific":[13],"information":[14],"across":[15,88,144,159],"sessions":[16],"for":[17],"personalization":[18],"and":[19,36,43,86,105,126],"continuity.":[20],"This":[21],"statefulness":[22],"introduces":[23],"a":[24,48,60,71,155],"new":[25],"security":[26],"risk:":[27],"adversarial":[28],"content":[29],"can":[30,83,152],"corrupt":[31],"what":[32],"an":[33,53],"assistant":[34,68],"remembers":[35],"thereby":[37],"influence":[38],"future":[39,161],"interactions.":[40],"We":[41,92],"propose":[42],"study":[44],"sleeper":[45],"memory":[46,73,151],"poisoning,":[47],"delayed":[49],"attack":[50,82,96,157],"in":[51,140],"which":[52],"adversary":[54],"manipulates":[55],"external":[56],"context,":[57],"such":[58],"as":[59,154],"document,":[61],"webpage,":[62],"or":[63],"repository,":[64],"cause":[66,136],"the":[67,75,81,94,110],"fabricated":[72],"about":[74],"user.":[76],"Unlike":[77],"conventional":[78],"prompt":[79],"injection,":[80],"remain":[84],"dormant":[85],"re-emerge":[87],"multiple":[89,160],"later":[90,103],"conversations.":[91,112,162],"evaluate":[93],"full":[95],"pipeline:":[97],"whether":[98],"poisoned":[99,117,134],"memories":[100,118,135],"written,":[102],"retrieved,":[104],"ultimately":[106],"used":[107],"steer":[109],"following":[111],"Across":[113],"stateful":[114],"LLM":[115],"assistants,":[116],"were":[119],"added":[120],"up":[121],"99.8%":[123],"on":[124,128],"GPT-5.5":[125],"95%":[127],"Kimi-K2.6.":[129],"Crucially,":[130],"among":[131],"successful":[132],"retrievals,":[133],"attacker-intended":[137],"agentic":[138],"actions":[139],"60-89%":[141],"of":[142],"evaluations":[143],"models.":[145],"These":[146],"results":[147],"show":[148],"that":[149],"act":[153],"long-term":[156],"surface":[158]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-05-19T00:00:00"}