{"id":"https://openalex.org/W7162755822","doi":"https://doi.org/10.48550/arxiv.2605.29960","title":"Hijacking Agent Memory: Stealthy Trojan Attacks Through Conversational Interaction","display_name":"Hijacking Agent Memory: Stealthy Trojan Attacks Through Conversational Interaction","publication_year":2026,"publication_date":"2026-05-28","ids":{"openalex":"https://openalex.org/W7162755822","doi":"https://doi.org/10.48550/arxiv.2605.29960"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.29960","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.29960","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.29960","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5137379836","display_name":"Hongtao Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Hongtao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137386983","display_name":"Se Yang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yang, Se","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137365217","display_name":"Yu Chen","orcid":"https://orcid.org/0000-0003-3038-5792"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chen, Yu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5037451675","display_name":"Puzhuo Liu","orcid":"https://orcid.org/0000-0002-8995-5924"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Puzhuo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.6847000122070312,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.6847000122070312,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.04740000143647194,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12808","display_name":"Ferroelectric and Negative Capacitance Devices","score":0.03449999913573265,"subfield":{"id":"https://openalex.org/subfields/2208","display_name":"Electrical and Electronic Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.6572999954223633},{"id":"https://openalex.org/keywords/memory-safety","display_name":"Memory safety","score":0.4977000057697296},{"id":"https://openalex.org/keywords/embedding","display_name":"Embedding","score":0.43619999289512634},{"id":"https://openalex.org/keywords/leverage","display_name":"Leverage (statistics)","score":0.4296000003814697},{"id":"https://openalex.org/keywords/isolation","display_name":"Isolation (microbiology)","score":0.39730000495910645},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.3889999985694885},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.33250001072883606},{"id":"https://openalex.org/keywords/payload","display_name":"Payload (computing)","score":0.31529998779296875}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8187999725341797},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.6572999954223633},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5681999921798706},{"id":"https://openalex.org/C28180684","wikidata":"https://www.wikidata.org/wiki/Q4080983","display_name":"Memory safety","level":3,"score":0.4977000057697296},{"id":"https://openalex.org/C41608201","wikidata":"https://www.wikidata.org/wiki/Q980509","display_name":"Embedding","level":2,"score":0.43619999289512634},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.4296000003814697},{"id":"https://openalex.org/C2775941552","wikidata":"https://www.wikidata.org/wiki/Q25212305","display_name":"Isolation (microbiology)","level":2,"score":0.39730000495910645},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3889999985694885},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.33250001072883606},{"id":"https://openalex.org/C134066672","wikidata":"https://www.wikidata.org/wiki/Q1424639","display_name":"Payload (computing)","level":3,"score":0.31529998779296875},{"id":"https://openalex.org/C160145156","wikidata":"https://www.wikidata.org/wiki/Q778586","display_name":"Executable","level":2,"score":0.2980000078678131},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.2939999997615814},{"id":"https://openalex.org/C2985957978","wikidata":"https://www.wikidata.org/wiki/Q492","display_name":"Human memory","level":3,"score":0.29100000858306885},{"id":"https://openalex.org/C2778689934","wikidata":"https://www.wikidata.org/wiki/Q1313396","display_name":"Headline","level":2,"score":0.2728999853134155},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.2720000147819519},{"id":"https://openalex.org/C109297577","wikidata":"https://www.wikidata.org/wiki/Q161157","display_name":"Password","level":2,"score":0.2711000144481659},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.2623000144958496},{"id":"https://openalex.org/C67174900","wikidata":"https://www.wikidata.org/wiki/Q178022","display_name":"Minutiae","level":4,"score":0.2621999979019165},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.26109999418258667},{"id":"https://openalex.org/C2780513914","wikidata":"https://www.wikidata.org/wiki/Q18210350","display_name":"Bottleneck","level":2,"score":0.26080000400543213},{"id":"https://openalex.org/C2780801425","wikidata":"https://www.wikidata.org/wiki/Q5164392","display_name":"Construct (python library)","level":2,"score":0.2581999897956848},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.2526000142097473},{"id":"https://openalex.org/C83860907","wikidata":"https://www.wikidata.org/wiki/Q135005","display_name":"Phishing","level":3,"score":0.2502000033855438}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.29960","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.29960","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.29960","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.29960","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.5528427958488464}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Large":[0],"language":[1],"model":[2],"(LLM)":[3],"agents":[4],"increasingly":[5],"leverage":[6],"long":[7],"term":[8],"memory":[9,26,39,62,80,86,102,137,182,214],"to":[10,34,131,145,191],"support":[11],"persistent":[12],"and":[13,57,125,151,181,205,221],"autonomous":[14],"task":[15],"execution.":[16],"However,":[17],"this":[18,73],"capability":[19],"also":[20],"introduces":[21,112],"a":[22,78,117,128,161],"new":[23],"attack":[24,82,187,201],"surface:":[25],"poisoning,":[27],"where":[28,91],"adversaries":[29],"can":[30,47,94],"inject":[31,95],"malicious":[32],"information":[33],"influence":[35],"future":[36],"behavior.":[37],"Existing":[38],"poisoning":[40,81],"attacks":[41],"often":[42],"assume":[43],"that":[44,83,121,142,156,199],"injected":[45],"content":[46],"be":[48],"stored":[49],"directly":[50],"in":[51,60,88,164,212,226],"memory,":[52],"overlooking":[53],"the":[54,99,123,165,200,228],"selective":[55,85,213],"extraction":[56],"rewriting":[58],"stages":[59],"modern":[61],"pipelines.":[63],"This":[64],"makes":[65],"prior":[66],"methods":[67],"ineffective":[68],"under":[69],"realistic":[70],"settings.":[71],"In":[72],"paper,":[74],"we":[75],"propose":[76],"MemPoison,":[77],"novel":[79],"bypasses":[84],"mechanisms":[87,183],"LLM":[89],"agents,":[90],"an":[92],"attacker":[93],"triggerable":[96],"backdoors":[97],"into":[98,127,136,160],"agent's":[100],"long-term":[101],"through":[103],"dialogue":[104],"interactions,":[105],"thereby":[106],"misleading":[107],"its":[108],"subsequent":[109],"responses.":[110],"MemPoison":[111,185],"three":[113],"key":[114],"components:":[115],"(i)":[116],"semantic":[118],"relational":[119],"bridge":[120],"binds":[122],"trigger":[124],"payload":[126],"coherent":[129],"statement":[130],"ensure":[132],"they":[133],"are":[134],"extracted":[135],"together;":[138],"(ii)":[139],"entity":[140],"masquerading":[141],"optimizes":[143],"triggers":[144],"mimic":[146],"named":[147],"entities,":[148],"resisting":[149],"rewriting;":[150],"(iii)":[152],"joint":[153],"embedding":[154,166],"optimization":[155],"shapes":[157],"trigger-injected":[158],"texts":[159],"tight":[162],"cluster":[163],"space":[167],"while":[168],"maintaining":[169],"isolation":[170],"from":[171],"benign":[172],"embeddings":[173],"for":[174],"stealth.":[175],"Evaluations":[176],"across":[177],"different":[178],"agent":[179],"domains":[180],"show":[184],"achieves":[186],"success":[188],"rates":[189],"up":[190],"0.95,":[192],"outperforming":[193],"existing":[194],"baselines.":[195],"Mechanistic":[196],"analysis":[197],"indicates":[198],"exploits":[202],"embedding-space":[203],"anisotropy":[204],"shifts":[206],"attention":[207],"patterns,":[208],"highlighting":[209],"core":[210],"vulnerabilities":[211],"systems.":[215],"We":[216],"evaluate":[217],"multiple":[218],"defense":[219],"strategies":[220],"demonstrate":[222],"their":[223],"fundamental":[224],"limitations":[225],"mitigating":[227],"attack.":[229]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-05-30T00:00:00"}