MemPoison: Uncovering Persistent Memory Threats and Structural Blind Spots in LLM Agents

TL;DR - MemPoison is a benchmark and analysis framework for studying persistent-memory poisoning attacks against LLM agents, showing that current write-time defenses miss compositional and trigger-conditioned threats. It matters because agents with external memory retain adversarial content across turns, creating durable security risks.

• Introduces a benchmark of 1,227 hand-validated cases spanning four attack types, three injection channels, and three memory substrates, evaluated across seven open-weight and three closed-weight model families.
• Proposes a three-tier attack taxonomy: L1 direct single-record corruption, L2 compositional multi-record corruption, and L3 context-triggered dormant corruption.
• Finds a "defense frontier": write-time defenses (e.g., consistency checks) suppress L1 attacks but fail on L2 and L3.
• Uses mechanistic influence decomposition (MID) to reveal structural blind spots—benign-looking records that become harmful via joint retrieval composition or trigger activation—and argues for adaptive, context-sensitive memory defenses.