{"id":"https://openalex.org/W7163550999","doi":"https://doi.org/10.48550/arxiv.2606.04329","title":"From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents","display_name":"From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents","publication_year":2026,"publication_date":"2026-06-03","ids":{"openalex":"https://openalex.org/W7163550999","doi":"https://doi.org/10.48550/arxiv.2606.04329"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.04329","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.04329","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.04329","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5005171312","display_name":"Pritam Dash","orcid":"https://orcid.org/0000-0002-9818-4922"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Dash, Pritam","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5042607758","display_name":"Tongyu Ge","orcid":"https://orcid.org/0000-0002-9618-8719"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ge, Tongyu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137911555","display_name":"Aditi Jain","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jain, Aditi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137860495","display_name":"Tanmay Shah","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Shah, Tanmay","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5024730880","display_name":"Zhiwei Shang","orcid":"https://orcid.org/0009-0000-6829-4568"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Shang, Zhiwei","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.45239999890327454,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.45239999890327454,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.14890000224113464,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.02969999983906746,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/memory-safety","display_name":"Memory safety","score":0.5180000066757202},{"id":"https://openalex.org/keywords/memory-protection","display_name":"Memory protection","score":0.43689998984336853},{"id":"https://openalex.org/keywords/component","display_name":"Component (thermodynamics)","score":0.3853999972343445},{"id":"https://openalex.org/keywords/encoding","display_name":"Encoding (memory)","score":0.3790999948978424},{"id":"https://openalex.org/keywords/interleaved-memory","display_name":"Interleaved memory","score":0.361299991607666},{"id":"https://openalex.org/keywords/memory-leak","display_name":"Memory leak","score":0.359499990940094},{"id":"https://openalex.org/keywords/memory-management","display_name":"Memory management","score":0.35249999165534973},{"id":"https://openalex.org/keywords/cache-only-memory-architecture","display_name":"Cache-only memory architecture","score":0.34209999442100525},{"id":"https://openalex.org/keywords/memory-map","display_name":"Memory map","score":0.3224000036716461}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7703999876976013},{"id":"https://openalex.org/C28180684","wikidata":"https://www.wikidata.org/wiki/Q4080983","display_name":"Memory safety","level":3,"score":0.5180000066757202},{"id":"https://openalex.org/C18131444","wikidata":"https://www.wikidata.org/wiki/Q163585","display_name":"Memory protection","level":5,"score":0.43689998984336853},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.40049999952316284},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.3853999972343445},{"id":"https://openalex.org/C125411270","wikidata":"https://www.wikidata.org/wiki/Q18653","display_name":"Encoding (memory)","level":2,"score":0.3790999948978424},{"id":"https://openalex.org/C63511323","wikidata":"https://www.wikidata.org/wiki/Q908936","display_name":"Interleaved memory","level":4,"score":0.361299991607666},{"id":"https://openalex.org/C156731835","wikidata":"https://www.wikidata.org/wiki/Q751740","display_name":"Memory leak","level":4,"score":0.359499990940094},{"id":"https://openalex.org/C176649486","wikidata":"https://www.wikidata.org/wiki/Q2308807","display_name":"Memory management","level":3,"score":0.35249999165534973},{"id":"https://openalex.org/C3720319","wikidata":"https://www.wikidata.org/wiki/Q5015937","display_name":"Cache-only memory architecture","level":5,"score":0.34209999442100525},{"id":"https://openalex.org/C74426580","wikidata":"https://www.wikidata.org/wiki/Q719484","display_name":"Memory map","level":3,"score":0.3224000036716461},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.3206999897956848},{"id":"https://openalex.org/C12186640","wikidata":"https://www.wikidata.org/wiki/Q6815743","display_name":"Memory model","level":3,"score":0.30079999566078186},{"id":"https://openalex.org/C133875982","wikidata":"https://www.wikidata.org/wiki/Q764810","display_name":"Shared memory","level":2,"score":0.2912999987602234},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.2847999930381775},{"id":"https://openalex.org/C2780428219","wikidata":"https://www.wikidata.org/wiki/Q16952335","display_name":"Cover (algebra)","level":2,"score":0.28279998898506165},{"id":"https://openalex.org/C153247305","wikidata":"https://www.wikidata.org/wiki/Q835713","display_name":"Memory address","level":3,"score":0.2800000011920929},{"id":"https://openalex.org/C171675096","wikidata":"https://www.wikidata.org/wiki/Q1143380","display_name":"Extended memory","level":4,"score":0.2775000035762787},{"id":"https://openalex.org/C39528615","wikidata":"https://www.wikidata.org/wiki/Q1229610","display_name":"Distributed shared memory","level":5,"score":0.2745000123977661},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.2720000147819519},{"id":"https://openalex.org/C41036726","wikidata":"https://www.wikidata.org/wiki/Q844824","display_name":"Physical address","level":3,"score":0.26809999346733093},{"id":"https://openalex.org/C2779602883","wikidata":"https://www.wikidata.org/wiki/Q15544750","display_name":"Memory architecture","level":2,"score":0.2653999924659729},{"id":"https://openalex.org/C177950962","wikidata":"https://www.wikidata.org/wiki/Q10997658","display_name":"Non-volatile memory","level":2,"score":0.2603999972343445},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.2551000118255615}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.04329","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.04329","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.04329","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.04329","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Memory":[0],"is":[1],"a":[2,28,42,82,96,135],"core":[3],"component":[4],"of":[5,24,45,84,87],"AI":[6,145],"agents,":[7],"enabling":[8],"them":[9],"to":[10,108,127],"accumulate":[11],"knowledge":[12],"across":[13],"interactions":[14],"and":[15,57,67,103,110,139],"improve":[16],"performance.":[17],"However,":[18],"persistent":[19],"memory":[20,25,31,46,54,88,100,112,129,141],"introduces":[21],"the":[22],"risk":[23],"poisoning,":[26],"where":[27],"single":[29],"adversarial":[30],"write":[32,55,109],"can":[33],"exert":[34],"long-term":[35],"influence":[36],"over":[37],"agent":[38,68],"behavior.":[39],"We":[40,51,118],"present":[41],"systematic":[43],"study":[44],"poisoning":[47,89,101,130,142],"in":[48,61],"LLM-based":[49],"agents.":[50,146],"identify":[52],"four":[53],"channels":[56,74],"nine":[58],"structural":[59],"vulnerabilities":[60],"model":[62],"capabilities,":[63],"system":[64,69],"prompt":[65,123],"design,":[66],"architecture":[70],"that":[71,105,121],"make":[72],"these":[73,78],"exploitable.":[75,117],"Based":[76],"on":[77],"vulnerabilities,":[79],"we":[80,92],"develop":[81],"taxonomy":[83],"six":[85],"classes":[86],"attacks.":[90,131],"Furthermore,":[91],"design":[93],"MPBench":[94],"--":[95],"benchmark":[97],"for":[98,137],"evaluating":[99],"attacks,":[102],"show":[104,120],"agents":[106],"designed":[107],"retrieve":[111],"more":[113,116],"aggressively":[114],"are":[115],"also":[119],"existing":[122],"injection":[124],"defenses":[125],"fail":[126],"cover":[128],"Our":[132],"findings":[133],"provide":[134],"foundation":[136],"understanding":[138],"mitigating":[140],"attacks":[143],"against":[144]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-06-05T00:00:00"}