{"id":"https://openalex.org/W7162308491","doi":"https://doi.org/10.48550/arxiv.2605.23723","title":"MemAudit: Post-hoc Auditing of Poisoned Agent Memory via Causal Attribution and Structural Anomaly Detection","display_name":"MemAudit: Post-hoc Auditing of Poisoned Agent Memory via Causal Attribution and Structural Anomaly Detection","publication_year":2026,"publication_date":"2026-05-22","ids":{"openalex":"https://openalex.org/W7162308491","doi":"https://doi.org/10.48550/arxiv.2605.23723"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.23723","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.23723","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.23723","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5136973518","display_name":"Zhewen Tan","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Tan, Zhewen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136578166","display_name":"Yilun Yao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yao, Yilun","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5123913100","display_name":"Huiyan Jin","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jin, Huiyan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136921858","display_name":"Wenhan Yu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yu, Wenhan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101966263","display_name":"Guoan Wang","orcid":"https://orcid.org/0000-0003-3142-8395"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Guoan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136968748","display_name":"Mengyuan Fan","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Fan, Mengyuan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136902573","display_name":"liang lu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"lu, liang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136902199","display_name":"Feng Liu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Feng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136952567","display_name":"Xiangzheng Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Xiangzheng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5066219365","display_name":"Duohe Ma","orcid":"https://orcid.org/0000-0002-2160-8344"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ma, Duohe","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136938679","display_name":"Tong Yang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yang, Tong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5136953864","display_name":"Lin Sun","orcid":"https://orcid.org/0009-0001-9073-3368"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sun, Lin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.3327000141143799,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.3327000141143799,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.23649999499320984,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.04569999873638153,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/counterfactual-thinking","display_name":"Counterfactual thinking","score":0.708899974822998},{"id":"https://openalex.org/keywords/audit","display_name":"Audit","score":0.6328999996185303},{"id":"https://openalex.org/keywords/consistency","display_name":"Consistency (knowledge bases)","score":0.5580999851226807},{"id":"https://openalex.org/keywords/memory-model","display_name":"Memory model","score":0.48750001192092896},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.462799996137619},{"id":"https://openalex.org/keywords/focus","display_name":"Focus (optics)","score":0.42809998989105225},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.3977000117301941},{"id":"https://openalex.org/keywords/memory-errors","display_name":"Memory errors","score":0.33160001039505005}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.722000002861023},{"id":"https://openalex.org/C108650721","wikidata":"https://www.wikidata.org/wiki/Q1783253","display_name":"Counterfactual thinking","level":2,"score":0.708899974822998},{"id":"https://openalex.org/C199521495","wikidata":"https://www.wikidata.org/wiki/Q181487","display_name":"Audit","level":2,"score":0.6328999996185303},{"id":"https://openalex.org/C2776436953","wikidata":"https://www.wikidata.org/wiki/Q5163215","display_name":"Consistency (knowledge bases)","level":2,"score":0.5580999851226807},{"id":"https://openalex.org/C12186640","wikidata":"https://www.wikidata.org/wiki/Q6815743","display_name":"Memory model","level":3,"score":0.48750001192092896},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.462799996137619},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.42809998989105225},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.39820000529289246},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.3977000117301941},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3774999976158142},{"id":"https://openalex.org/C119907115","wikidata":"https://www.wikidata.org/wiki/Q6815725","display_name":"Memory errors","level":3,"score":0.33160001039505005},{"id":"https://openalex.org/C33762810","wikidata":"https://www.wikidata.org/wiki/Q461671","display_name":"Data integrity","level":2,"score":0.33070001006126404},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.2955999970436096},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.29269999265670776},{"id":"https://openalex.org/C80958533","wikidata":"https://www.wikidata.org/wiki/Q1047174","display_name":"Audit trail","level":3,"score":0.2924000024795532},{"id":"https://openalex.org/C176649486","wikidata":"https://www.wikidata.org/wiki/Q2308807","display_name":"Memory management","level":3,"score":0.29030001163482666},{"id":"https://openalex.org/C71889745","wikidata":"https://www.wikidata.org/wiki/Q1783264","display_name":"Counterfactual conditional","level":3,"score":0.28369998931884766},{"id":"https://openalex.org/C93361087","wikidata":"https://www.wikidata.org/wiki/Q4426698","display_name":"Data consistency","level":2,"score":0.27730000019073486},{"id":"https://openalex.org/C82029504","wikidata":"https://www.wikidata.org/wiki/Q4373882","display_name":"Sequential consistency","level":4,"score":0.27639999985694885},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.27549999952316284},{"id":"https://openalex.org/C115086926","wikidata":"https://www.wikidata.org/wiki/Q17004651","display_name":"Causal reasoning","level":3,"score":0.27379998564720154},{"id":"https://openalex.org/C89611455","wikidata":"https://www.wikidata.org/wiki/Q6804646","display_name":"Mechanism (biology)","level":2,"score":0.2574999928474426}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.23723","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.23723","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.23723","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.23723","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.5898872017860413}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Large":[0],"language":[1],"model":[2],"agents":[3],"increasingly":[4],"rely":[5],"on":[6,63],"persistent":[7],"memory":[8,23,41,100,116,131,142,151],"to":[9,52,125,199,208],"store":[10],"past":[11],"interactions,":[12],"retrieve":[13],"relevant":[14],"demonstrations,":[15],"and":[16,45,57,128,160,174],"improve":[17],"long-horizon":[18],"task":[19],"execution.":[20],"However,":[21],"this":[22],"mechanism":[24],"also":[25],"creates":[26],"a":[27,97,114,130,149],"practical":[28],"security":[29],"vulnerability:":[30],"an":[31],"adversarial":[32],"user":[33],"may":[34],"inject":[35],"malicious":[36,156],"records":[37,47,157],"into":[38],"the":[39,54,78,140],"agent's":[40,55],"through":[42,162],"ordinary":[43],"interaction,":[44],"these":[46],"can":[48],"later":[49],"be":[50],"retrieved":[51],"steer":[53],"reasoning":[56],"actions.":[58],"Existing":[59],"defenses":[60],"primarily":[61],"focus":[62],"online":[64],"intervention,":[65],"such":[66],"as":[67],"prompt":[68],"filtering":[69],"or":[70],"output":[71],"blocking,":[72],"but":[73],"they":[74],"do":[75],"not":[76],"address":[77],"post-hoc":[79,98,185],"question":[80],"of":[81],"which":[82,155],"stored":[83,161],"memories":[84,138],"are":[85,158],"responsible":[86],"after":[87],"harmful":[88,126],"behavior":[89],"has":[90],"already":[91],"been":[92],"observed.":[93],"We":[94,144],"propose":[95],"\\textbf{MemAudit},":[96],"causal":[99,123],"auditing":[101,186],"framework":[102,108],"for":[103],"memory-augmented":[104],"LLM":[105],"agents.":[106],"The":[107,188],"combines":[109],"two":[110],"complementary":[111],"signals:":[112],"(1)":[113],"counterfactual":[115],"influence":[117],"score":[118],"that":[119,134,191],"measures":[120],"each":[121],"memory's":[122],"contribution":[124],"outputs,":[127],"(2)":[129],"consistency":[132],"graph":[133],"identifies":[135],"structurally":[136],"anomalous":[137],"within":[139],"broader":[141],"store.":[143],"evaluate":[145],"MemAudit":[146,177],"against":[147],"MINJA,":[148],"query-only":[150],"injection":[152],"attack":[153,180,193,203],"in":[154],"generated":[159],"normal":[163],"agent":[164],"interactions":[165],"rather":[166],"than":[167],"direct":[168],"memory-bank":[169],"modification.":[170],"Across":[171],"both":[172],"QA":[173,192],"reasoning-agent":[175],"settings,":[176],"substantially":[178],"reduces":[179],"success":[181,194,204],"rates":[182],"under":[183],"realistic":[184],"scenarios.":[187],"results":[189],"show":[190],"is":[195],"reduced":[196],"from":[197,206],"$70\\%$":[198],"$0\\%$,":[200],"while":[201],"RAP":[202],"drops":[205],"$83.3\\%$":[207],"$0\\%$.":[209]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-05-26T00:00:00"}