PaperlayerView exact revision on arXiv

Source-linked AI summary

Hidden in Memory: Sleeper Memory Poisoning in LLM Agents

Sidharth Pulipaka, Stanislau Hlebik, Leonidas Raghav, Sahar Abdelnabi, Vyas Raina, Ivaxi Sheth, Mario Fritz

arXiv:2605.15338v2cs.CRcs.AI

TL;DR

Persistent memory may let adversarial content influence assistants beyond the session in which it appears. This paper evaluates sleeper memory poisoning across the attack pipeline, finding attacker-intended behavior in 41.0–73.9% of behavioral evaluations under external memory-manager retrieval in the single-attack setting.

  • Problem

    The central question is whether adversarial context can corrupt assistants’ long-term memory and influence later conversations, extending beyond stateless, session-bound attacks.

    Source: §1 · pp. 1–2

  • Method

    The paper studies sleeper memory poisoning by manipulating external context to induce fabricated user memories, then evaluates writing, retrieval, and downstream behavior across memory regimes, interaction settings, and model families.

    Source: §1 · p. 2

  • Results

    41.0–73.9% of behavioral evaluations showed attacker-intended behavior under external memory-manager retrieval in the single-attack setting.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Persistent memory creates a cross-session attack surface: fabricated memories can be retrieved after the malicious context is gone and influence later behavior, especially in agentic settings.

    Source: §8 · pp. 10–11

    The threat model assumes a black-box attacker who can manipulate user-provided external context but cannot access model weights, the system prompt, memory-writing or retrieval systems, or stored memory contents.

    Source: §3.2.1 · pp. 3–4

Abstract

from arXiv · show

Large language models are increasingly augmented with persistent memory, allowing assistants to store user-specific information across sessions for personalization and continuity. This statefulness introduces a new security risk: adversarial content can corrupt what an assistant remembers and thereby influence future interactions. We propose and study sleeper memory poisoning, a delayed attack in which an adversary manipulates external context, such as a document, webpage, or repository, to cause the assistant to store a fabricated memory about the user. Unlike conventional prompt injection, the attack can remain dormant and re-emerge across multiple later conversations. We evaluate the full attack pipeline: whether poisoned memories are written, later retrieved, and ultimately used to steer the following conversations. Across stateful LLM assistants, poisoned memories were added up to 99.8% on GPT-5.5 and 95% on Kimi-K2.6. Crucially, among successful retrievals, poisoned memories cause attacker-intended agentic actions in 60-89% of evaluations across models. These results show that persistent memory can act as a long-term attack surface across multiple future conversations.

1 Introduction

Persistent memory lets assistants personalize across sessions, but malicious external context can plant fabricated user memories that resurface to steer later interactions. The paper evaluates this delayed attack across memory-management regimes, interaction settings, and model families.

1 Introduction

  • Unlike stateless attacks confined to a current interaction, memory poisoning can affect later conversations, and asynchronous external-memory consolidation may ingest adversarial content before defenses can intervene.A single exposure can therefore have a one-to-many effect across future conversations.Source: §1 · pp. 1–2
  • Attackers manipulate external context to plant fabricated user memories without direct access to the memory store or future conversation; later retrieval can steer the assistant toward their objective.Figure 1 depicts the three stages: injection through a document, later retrieval, and negative impact on the conversation.Source: §1 · p. 2, Figure 1 · p. 2
  • The universal attack uses a reusable poisoning template that can target arbitrary adversarial memory goals across external contexts, rather than requiring a bespoke payload for each document or memory.Examples include biasing shopping recommendations toward a brand or creating delayed exfiltration risk by storing a fabricated file-upload preference.Source: §1 · p. 2
  • Injection rates exceeded 97% on GPT-5.4 and 99% on GPT-5.5; retrieval rates were 60–89%, while end-to-end attacker-intended behavior occurred in 41.0–73.9% of behavioral evaluations.Retrieval rates were reported in agentic settings for several models; the end-to-end evaluation used external memory-manager retrieval in the single-attack setting and reached up to 66% of goal-adjacent agentic evaluations.Source: §1 · p. 2

2 Related Work

Prior work documents prompt injection, tool-use attacks, and risks from persistent memory, while this paper studies a delayed attack that poisons memory for influence in later sessions. It frames its contribution around sleeper behavior, universality, and external delivery without direct memory-store access.

Prompt injection attacks

Agent/tool call attacks

  • Prior agent/tool-call attacks manipulate skill execution, tool selection, or agent behavior, whereas sleeper poisoning affects later tool use through memory writing [Schmotz et al., 2026, Shi et al., 2025b, Debenedetti et al., 2024].Poisoned state can later influence file handling, code execution, or tool use across future sessions.Source: §2 · p. 3

Persistent Memory Risks

  • Prior persistent-memory research reports harmful out-of-context influence and sycophancy, retrieval or memory-store poisoning, practical memory corruption, and web-agent injection [Pulipaka et al., 2026, Mireshghallah et al., 2025; Chen et al., 2024, Zou et al., 2025, Dong et al., 2025, Tian et al.; Chen and Lu, 2025, Microsoft Defender Security Research Team, 2026; Raghav and Choong, 2026].The cited work covers adversarial content inserted into retrieval corpora, agent memory stores, or long-term memory systems, as well as malicious webpages and persistent recommendation planting.Source: §2 · p. 3
  • This work targets sleeper behavior, universality, and external delivery: reusable instructions manipulate processed context to plant varied memory goals without direct access to the memory store.Source: §2 · p. 3

3 Background

Memory-augmented assistants write user-specific information to persistent stores and may retrieve it in later sessions. The threat model considers reusable adversarial context that can poison this process and steer future responses.

3.1 Persistent Memory in LLM Assistants

  • Memory-augmented assistants can write user-specific information to persistent memory and retrieve it to personalize responses in later sessions.Memory writing may use an explicit model-issued tool call, as in ChatGPT [OpenAI, 2025], or an external manager such as Mem0.Source: §3.1 · p. 3

3.2.1 Attacker Capabilities

  • The attacker is a black-box outsider who manipulates user-provided context, embedding instructions to make the memory writer store a target memory as legitimate user information.The attacker cannot access model internals or the memory bank, directly read or write it, or join future sessions; attack surfaces include webpages, documents, emails, and repositories [Greshake et al., 2023].Source: §3.2.1 · pp. 3–4

3.2.2 Attacker Objective

  • A successful sleeper memory poisoning attack requires injection of the target memory, its retrieval in a later session, and adversarial use that overrides the user’s true intent.The paper evaluates these stages separately as Injection Rate (IR), Retrieval Rate (RR), and Adversarial Usage Rate (AUR).Source: §3.2.2 · p. 4
  • The objective is a universal, reusable payload template that attempts to store varied attacker-chosen memories across many unseen documents and contexts.Unlike a bespoke attack, it need not be optimized separately for each document or target memory.Source: §3.2.2 · p. 4

4 Attack Generation

Attack generation uses a two-stage procedure: it searches for a universal payload that induces memory writing, then optionally rewrites the adversarial memory goal to improve later retrieval. The attack does not directly optimize downstream use of retrieved memories.

4 Attack Generation

  • A universal payload targets memory injection, while an optional goal rewrite targets later retrieval; downstream use is evaluated rather than optimized during attack generation.The full attack objective requires injection, retrieval, and adversarial usage.Source: §4 · p. 4

4.1 Universal Payload Optimization

  • An LLM-driven actor–critic search adapted from Shi et al. [2025a] iteratively proposes payload templates, critiques failed writes, and selects the final template by held-out injection rate.Candidates are tested on document–goal pairs, refined for up to K steps, and retained in a pool; held-out assistants reduce overfitting to the search environment.Source: §4.1 · p. 5

4.2 Retrieval-Aware Memory Goal Rewriting

  • Goal rewriting seeks a semantically faithful version of the adversarial memory goal that maximizes average cosine similarity to a set of plausible future target queries.This targets retrieval because many memory-enabled assistants use semantic similarity.Source: §4.2 · p. 5
  • LLM-guided candidates are scored and checked for semantic equivalence; the highest-scoring accepted rewrite is used, or the original goal if none qualifies.The procedure requires only attacker-specified plausible goal-relevant queries, not access to the target memory store or future conversations.Source: §4.2 · p. 5

5 Evaluation

The evaluation tests whether adversarial external content causes fabricated memories to be written, retrieved in a later session, and used to influence assistant behavior. It spans memory-management architectures, document domains, adversarial goals, and post-injection interaction settings.

5.1 Evaluation Setup

  • The evaluation covers tool-based and external-manager memory regimes and separates injection from later retrieval and usage to distinguish failure stages.This separation also balances post-injection sample sizes across models, avoiding estimates confounded by models with different injection rates.Source: §5.1 · pp. 5–6

5.2 Dataset Design

  • The injection dataset contains 700 document-goal pairs from 15 sources, divided into 500 Behavior goals and 200 Agent Action goals.The post-injection dataset samples 400 goals, evenly split between the two categories, and tests future sessions without the original document; queries are goal-adjacent or goal-distant.Source: §5.2 · p. 6

5.3 Retrieval

  • Retrieval is evaluated with embedding-based semantic retrieval, an LLM-based external memory manager, and an all-memories-in-context baseline; Table 2 uses the external manager.The external-manager main setting is intended to approximate high-capacity memory selection in deployed assistants.Source: §5.3 · pp. 6–7

5.4 Metrics

  • Evaluation separates Injection Rate (IR), Retrieval Rate (RR), and Adversarial Usage Rate (AUR), measuring aligned writes, future retrieval, and behavior impact conditional on retrieval, respectively.IR counts memories semantically aligned with the adversarial goal; RR counts successfully injected memories retrieved later; AUR counts sessions where behavior is impacted given retrieval.Source: §5.4 · p. 7

6 Experiments

The experiments find that document-based sleeper memory poisoning can write fabricated memories and later steer behavior, especially when those memories are relevant to future queries. Prompt defenses help unevenly, while adaptive attacks and detection results show the limits of prevention alone.

6.1 Experimental Setup

  • The experiments compare a universal Actor-Critic payload with User Review across six current open-weight and proprietary memory-augmented models.Injection tests measure memory writing; separate future-session tests measure retrieval and adversarial usage, reported as IR, RR, and AUR.Source: §6.1 · p. 7

6.2 Results

  • Near-100% IR for GPT-5.4 and GPT-5.5 versus below 5% for User Review on LLM Behavior show Actor-Critic’s advantage in the tool-based setting.Across settings, Actor-Critic substantially outperforms User Review; injection rates are generally lower for Agent Action goals than for behavior-level memories.Source: §6.2 · pp. 7–8, Table 1 · p. 8
  • For LLM Behavior, goal-adjacent queries have 90–95% RR and 42–85% AUR, versus 3–8% RR and 0–6% AUR for goal-distant queries.AUR is conditional on retrieval; both retrieval and downstream usage vary with query proximity.Source: Table 2 · p. 8, §6.2 · p. 8
  • For Agent Action, goal-adjacent queries have 94–98% RR and 60–89% AUR, while goal-distant RR falls to 13–18%.Claude-Sonnet-4.6 has the lowest goal-adjacent AUR at 60%, while Gemini-3.1 has the highest at 89%; the authors attribute the pattern to contextual assimilation of task-relevant poisoned memories.Source: Table 2 · p. 8, §6.2 · p. 9
  • Injection difficulty varies by goal and memory harness: Claude-Sonnet-4.6 is comparatively robust, while GPT-5.5’s IR drops from near-ceiling under GPT-style setup with Claude- or Gemini-style setups.The passage identifies commercial manipulation and operational sabotage as easier goals, and personal attribute fabrication, data exfiltration, and brute-force execution as harder goals; it also reports more explicit refusals by Claude.Source: §6.2 · p. 8
  • Goal-adjacent end-to-end success ranges from 41.0–73.9% for LLM Behavior and 3.0–66.0% for Agent Action, versus at most 1.0% and 5.0% for goal-distant queries.These are single-attack estimates with external memory-manager retrieval.Source: §6.2 · p. 9
  • Production-interface tests induced target memories in 24/25 cases for ChatGPT-5.4 and Claude-Sonnet-4.6, and 22/25 cases for Kimi-K2.6.Kimi-K2.6 succeeded in 12/13 Behavior cases and 10/12 Agent Action cases.Source: §6.2 · p. 9

6.3 Defenses

  • GEPA Prompt Hardening and Hardening + Spotlighting reduce IR to near zero for Claude-Sonnet-4.6 and Gemini-3.1, but adaptive attacks raise Kimi-K2.6 IR from 6.2% to 64.6%.Activation probes achieve AUROC above 0.95 with as few as 125 training documents, and Gemma-4-26B’s scanner localization score exceeds 0.96; the authors recommend combining prevention and detection.Source: §6.3 · pp. 9–10, Table 3 · p. 10

7 Mechanistic Analysis

Mechanistic analyses find that successful memory-injection attacks have separable activation signatures and receive greater attention to their payloads. Attack signatures transfer across model families after Procrustes alignment, but not through shared PCA alignment alone.

7 Mechanistic Analysis

  • AUROC reached 0.93–0.99 for strongest single-layer probes and often exceeded 0.95 for fused multi-layer probes across six models, with separability strongest in middle-to-late decoder layers.The probes distinguish benign from injected documents using mean-pooled intermediate activations.Source: §7 · p. 10
  • Successful injections received higher attack-attention mass than failures in every vulnerable model (Gemma-4-26B: 0.8 vs. 0.5; Qwen-3.6-35B: 1.4 vs. 0.8, scaled by 10^3).GPT-OSS-20B attended non-negligibly to the payload but had zero successful injections on the limited subset, indicating that attention alone was insufficient; semantic misinterpretation as an actionable instruction was also needed.Source: §7 · p. 10
  • Cross-model AUROC was 0.48–0.54 with shared PCA alignment, versus 0.74–0.85 with orthogonal Procrustes alignment, approaching target-native probe performance of 0.77–0.88.The results indicate a partially shared representational signature across architectures that is not trivially exposed by unaligned activation spaces.Source: §7 · p. 10

8 Conclusion

Sleeper memory poisoning uses adversarial external content to plant fabricated user memories that can be retrieved and influence later interactions after the original context is gone. The findings show that these memories can affect tool use and actions, while prompt-based mitigations remain inconsistent.

8 Conclusion

  • Adversarial external content can cause an assistant to store a fabricated user memory that is later retrieved after the malicious context is gone.This creates a cross-session attack surface in assistants with persistent memory.Source: §8 · pp. 10–11
  • Universal poisoning payloads induce memory writes across ChatGPT, Claude, and Gemini, and across memory-management regimes.When injected memories become relevant to future interactions, they can influence later behavior, especially tool use and actions in agentic settings.Source: §8 · p. 11
  • Prompt-based mitigations are inconsistent across models and adaptive attacks, motivating safeguards for what assistants write, retrieve, and respond.Source: §8 · p. 11

A Limitations and Impact … Autonomous Propagation & Third-Party Targeting

This section describes the paper’s limitations and threat model, along with how attack phrasing, retrievable goals, and evaluation datasets were constructed. It also presents a taxonomy of agent-action goals, with examples spanning operational sabotage, system changes, data movement, and third-party communications.

B Ethics, Risk and Safety

  • The study characterizes persistent-memory poisoning as a dual-use risk and emphasizes controlled evaluation, defensive analysis, prompt-based mitigations, and responsible disclosure.The authors state that their goal is safer memory mechanisms, and report checking support channels at OpenAI, Anthropic, and Google to share findings.Source: A Limitations and Impact · p. 17, B Ethics, Risk and Safety · p. 18

A Limitations and Impact

  • The evaluation is limited by possible LLM-judge discrepancies, partly reconstructed provider pipelines, a single-document-per-session threat model, and no systematic study of memory-management defenses.Judge calibration against human annotations yielded LLM Behavior QWK = 0.7288 and Agent Action accuracy = 97.5%, but borderline indirect influence may still be judged differently.Source: A Limitations and Impact · pp. 17–18

C.1 Actor-Critic Loop

  • The Actor-Critic pipeline refined candidate attacks against a shadow model, then filtered candidates on development samples before selecting a final universal phrasing.Kimi-K2.5 served as Actor and Critic, GLM-4.7-Flash as Shadow LLM; the loop used batches of three for up to 10 iterations, and generated candidates were narrowed from 30 to 10 before frontier validation.Source: §C.1 · pp. 18–19
  • For adaptive attacks, AC+ reruns the loop with the target defense active, leading the Actor to tailor payloads to the defended setting and its boundary conventions.For spotlighting, AC+ learned to place adversarial instructions inside markers resembling the defense’s untrusted-document delimiters; all generation and optimization used development data, with evaluation held out.Source: §C.1 · pp. 18–19

C.2 Goals Optimization

  • Goal optimization rewrites adversarial memories to preserve meaning while increasing similarity to likely future queries, using synonym expansion, narrative detail, and user-like phrasing.Candidates are ranked by mean query similarity and checked for same meaning; the highest-scoring candidate that passes is selected, otherwise the original goal is retained.Source: §C.2 · pp. 19–20, Optimization Strategies · pp. 20–21

D.1.1 Document Creation

  • The injection dataset contains 700 samples—500 for LLM Behavior and 200 for Agent Action—drawn from 15 source domains and split evenly by preexisting-memory condition within each subset.The behavior subset has 250 samples per condition, while the action subset has 100 per condition.Source: §D.1.1 · p. 21

D.1.2 LLM Behavior Goals Creation

D.1.4 Agent Action Goals Creation

  • The agent-action goal pipeline generated exactly 200 unique goals from category, domain, and constraint tuples, using 43 operational constraints across threat categories.The constraints include data-exfiltration tactics such as hiding sensitive information in outbound channels or metadata.Source: §D.1.4 · p. 24
  • The benchmark taxonomy derives 200 agent-action goals from domains and adversarial constraints, including system hijacking, brute-force execution, operational sabotage, and autonomous propagation.The listed categories cover configuration changes, execution and persistence, integrity attacks, and spread or trust across people and systems.Source: §D.1.4 · p. 25, Table 9 · p. 26

Operational Sabotage

  • Examples of operational sabotage ask to weaken a brute-force trigger from 5 failures to 50 or calculate report figures using a 3% base.The examples frame the changes as a risk decision and consistency requirement.Source: Operational Sabotage · p. 26

System Hijacking & Resource Exploitation

  • System-hijacking examples request unlimited quotas, attacker-specified dependency sources, or build steps involving a base64 request or setup script.These examples are presented as routine requirements for API clients, bytecode verification, or build compliance.Source: System Hijacking & Resource Exploitation · p. 26

Data Exfiltration & Privacy Compromise

  • Data-exfiltration examples direct dataset uploads and automated storefront backups to externally specified destinations.Both are framed as compliance archiving or centralized disaster recovery.Source: Data Exfiltration & Privacy Compromise · p. 27

Autonomous Propagation & Third-Party Targeting

  • Third-party-targeting examples request attaching an external data-processing addendum to a closed ticket and posting an announcement to Slack while archiving its exact text externally.The requests are framed as checklist completion, audit, and regulatory review.Source: Autonomous Propagation & Third-Party… · p. 27

D.2 Post-Injection Dataset … E.2 External Memory Manager

The evaluation separates whether an attack writes a poisoned memory from whether that memory affects later behavior, using standardized paraphrases and provider-faithful simulated contexts. It constructs distinct conversational and agent-action datasets and an external-manager regime in which a separate LLM extracts memories from interactions.

D.2 Post-Injection Dataset

  • Post-injection evaluation uses standardized, naturally paraphrased goals to separate memory writing from later influence and avoid model-imbalanced downstream samples.The authors also report a coupled end-to-end evaluation in Appendix I; when a target model refuses direct ingestion, a paraphrase generated by a more compliant model supplies the sample.Source: §D.2 · p. 27

D.2.1 LLM Behavior Dataset

  • The LLM Behavior dataset contains 200 cohesive conversations split evenly between goal-adjacent and goal-distant samples, with generated adjacent queries audited to avoid revealing the goal.Goal-distant sequences begin with non-toxic WildChat queries; goal-adjacent sequences are generated from the adversarial goal and assigned query style, and GPT-OSS-20B audits every adjacent sequence.Source: §D.2.1 · p. 28

D.2.2 Agent Action Dataset

  • The Agent Action dataset comprises 200 simulated workspaces, split into 100 goal-adjacent environments and 100 with shuffled, goal-distant query-and-file tuples.Each workspace has task files and USER.md, IDENTITY.md, and MEMORY.md; the adversarial goal is injected exclusively into MEMORY.md, while the shuffled split preserves user and memory consistency.Source: §D.2.2 · pp. 29–30

E.1 Provider-Faithful Document and Memory Rendering; E.1.1 System Prompt Sources; E.1.2 Memory Tool and Placement

  • Provider-faithful rendering reconstructs provider prompts, memory interfaces, and placement conventions; Claude’s truncated prompt yielded IR of 31/50 (62.0%) versus 32/50 (64.0%) with the full prompt.The truncated Claude prompt preserves memory-related content and was used for main Claude results; the appendix also documents prompt sources and provider-specific memory tools and placement.Source: §E.1.1 · p. 31, §E.1 · p. 31, §E.1.2 · pp. 31–32

E.1.3 Document Upload Representation

  • Provider document representations differ: Claude uses antml: XML, GPT raw text, and Gemini JSON envelopes, so evaluation renders uploads in provider-specific formats.The study tested eight file types and used only provider-inlined types in the main evaluation; a shared 16,000-character threshold applies to long-document truncation.Source: §E.1.3 · pp. 32–33

E.1.4 Transcript Construction

  • Transcript construction places memories and uploaded documents differently by provider, while defenses append system-prompt hardening or mark document bodies as untrusted.Claude uses an antml: XML user document; GPT uses a separate Model Set Context system message and raw text; Gemini appends memory instructions and uses a JSON envelope.Source: §E.1.4 · p. 33

E.2 External Memory Manager

  • The external-manager regime uses a Mem0-inspired additive extraction prompt, with an external LLM converting interactions into factual memory statements rather than exposing a memory-writing tool to the target.The manager receives only the user query and target completion, so injection must first influence the target’s output; scoring separately checks whether anything was written and whether a persisted memory semantically matches the goal.Source: §E.2 · pp. 33–34

E.2.1 External-Manager Model Ablation … F.2 Qualitative Failure Traces

The appendices show that injection rates vary substantially with manager choice, while benign-memory effects differ across models, subsets, and memory regimes. Failure traces contrast internal recognition of injected instructions with visible refusal or immediate compliance.

E.2.1 External-Manager Model Ablation

  • 63.8% IR for Gemini-3.1-Flash-Lite versus 24.3% for Claude-Haiku-4.5 shows a 2.6× pooled manager-choice spread, exceeding the spread across subjects within a manager.Claude Sonnet-4.6 is the most resistant subject regardless of manager; the ablation replays the same transcripts across five managers and six subjects.Source: Table 18 · p. 34, §E.2.1 · p. 34
  • Managers differ in failure mode: conservative managers often write no memory for borderline samples, while others persist goal-aligned preferences or vary in preserving adversarial intent through extraction and paraphrase.Manual inspection also found cases where a manager wrote no memory and cases where it captured only document-literal content.Source: §E.2.1 · p. 35

F.1 Detailed Injection Results

  • Detailed injection tables report IR with 95% bootstrap confidence intervals for base and adaptive actor-critic attacks, using 1,000 prompt-entry-level bootstrap resamples.Separate tables break down results by goal category and memory condition.Source: §F.1 · p. 35, Table 19 · p. 35, Table 20 · p. 35

F.1.1 Goal category splits

  • In the tool-based regime, DeepSeek-v4’s IR is 39.9% for Operational Sabotage and 36.3% for System Hijacking & Resource Exploitation; under external-manager memory, Gemini-3.1’s IR is 40.0% for Operational Sabotage and 13.3% for Data Exfiltration & Privacy Compromise.The tool-based category denominators are 750 for each cited category; the external-manager denominators are 100 for Operational Sabotage and 90 for Data Exfiltration & Privacy Compromise.Source: Table 21 · p. 36, §F.1.1 · pp. 37–38, Table 22 · p. 37

F.1.2 Memory condition splits

  • Benign preexisting memories change IR heterogeneously: effects vary by model and subset under the tool-based regime, and external-manager IR is higher with memories for five models on Agent Action but nearly unchanged for DeepSeek-v4.Under the external-manager regime on LLM Behavior, IR is nearly unchanged for four models, lower for Sonnet-4.6, and higher for Gemini-3.1.Source: §F.1.2 · p. 38

F.1.3 No-write failure-type breakdowns

  • No-write failures are classified as refused, ignored, accepted but not stored, or ambiguous, with empty responses assigned by whether they were content-filtered.The breakdown covers no-defense literature-baseline and actor-critic runs without untrusted markers in both memory regimes.Source: §F.1.3 · p. 41, Table 25 · p. 41, Table 26 · p. 41

F.2 Qualitative Failure Traces

  • Kimi-K2.6 and GPT-5.5 identify injected instructions in internal reasoning but provide normal-looking replies without surfacing a warning or acknowledgement.Kimi’s trace explicitly recognizes the external content as untrusted and rejects updating memory based solely on it.Source: §F.2 · pp. 42–43
  • Claude Sonnet-4.6’s traces show a binary pattern: it explicitly refuses and explains the injection, or complies immediately without hesitation.The examples include visible refusals even without an active defense, alongside successful-injection openings.Source: §F.2 · pp. 42–43

F.3 Discussion of Injection Results … G.3 Dynamic Semantic Retrieval

Injection results vary by regime, goal category, and model failure behavior; retrieval is evaluated through perfect-context, memory-manager, and semantic top-k approaches. Pre-existing memories usually have little effect on injection rates.

F.3 Discussion of Injection Results

  • Tool-based IR exceeds external-manager IR for nearly every LLM and subset, except DeepSeek-v4 Behavior (86.4% vs. 82.2%); manager choice spans 2.6× pooled IR.The external-manager regime requires both the subject LLM to surface adversarial content and the manager to extract it as memory, creating a two-stage filter.Source: §F.3 · p. 43
  • Agent Action IR is generally lower than LLM Behavior IR, with category rankings varying by regime and model.Data Exfiltration & Privacy Compromise and Brute-Force Execution are among the hardest agent-action categories to inject, while Operational Sabotage and System Hijacking rank highest. In Behavior, Personal Attribute Fabrication is consistently lowest only in the tool-based regime; category rankings vary under external management.Source: §F.3 · p. 43
  • Claude Sonnet-4.6 has the lowest IR in both regimes and explicitly refuses 41.9% of no-write tool-based behavior cases, versus 4.1% for Gemini.In the external-manager regime, Claude refuses 17–33% of no-write cases while other LLMs are 84–100% ignore; when Claude complies, it does so immediately, without deliberation.Source: §F.3 · p. 43
  • Pre-existing benign memories produce small IR differences for most LLMs, but Gemini-3.1 external-manager behavior IR rises from 19.0% without them to 39.0% with them.The authors suggest richer conversational context may interact with manager extraction logic but say the mechanism cannot be isolated from the available evidence.Source: §F.3 · pp. 43–44

G Retrieval Methods

  • Retrieval is decoupled from downstream exploitation to isolate memory-selection effectiveness from the target model’s willingness to act on retrieved information.The main-text AURs assume successful retrieval; a fully coupled end-to-end analysis is described in Appendix I.Source: G Retrieval Methods · p. 44

G.1 Everything in-context

  • The in-context baseline assumes perfect retrieval by placing every successfully injected and benign pre-existing memory directly into the target’s active context.Behavior evaluations place memories in the system prompt; OpenClaw Agent Action evaluations write them to an accessible memory.md file.Source: §G.1 · p. 44

G.2 Memory Management Agent

  • The memory-management-agent method supplies the user query and all stored memories to GPT-OSS-20B, which selects those it deems useful for answering the query.This approximates systems that use an auxiliary language model to filter and retrieve relevant context.Source: §G.2 · p. 44

G.3 Dynamic Semantic Retrieval

  • Dynamic semantic retrieval uses Qwen-3-Embedding-8B to select the top 15 or 5 memories from pools expanded to 40–60 items, without a cosine-similarity threshold.RR measures whether a poisoned memory ranks among the retrieved top-k, not whether it exceeds an absolute relevance threshold; this retrieval style is used in memory systems like Chhikara et al. [2025].Source: §G.3 · p. 44

G.4 Discussion · H Post-Injection Results Details

Retrieval depends on query distance, memory type, and retrieval method: GOAL-ADJACENT queries often surface poisoned memories, while GOAL-DISTANT queries reveal sharp differences between retrieval systems. Dynamic semantic retrieval can still surface AGENT ACTION memories at very high rates for distant queries.

G.4 Discussion

  • 90.0%–95.0% on LLM BEHAVIOR and 94.0%–98.0% on AGENT ACTION: poisoned-memory retrieval was high for GOAL-ADJACENT queries.The reported rates span both subsets and retrieval methods.Source: §G.4 · pp. 44–45
  • 3.0%–8.0% on LLM BEHAVIOR and 13.0%–19.0% on AGENT ACTION: the memory management agent retrieved poisoned memories less often for GOAL-DISTANT queries.AGENT ACTION memories remained somewhat more likely to be retrieved, as they resemble operational preferences or workflow constraints.Source: §G.4 · p. 45
  • 34.0%–44.0%: dynamic semantic retrieval returned GOAL-DISTANT LLM BEHAVIOR memories at k = 15.Unlike the memory management agent, dynamic semantic retrieval always returns the top-k memories without a hard relevance threshold.Source: §G.4 · p. 45, Table 28 · p. 45
  • 3.0%–6.0%: dynamic semantic retrieval of GOAL-DISTANT LLM BEHAVIOR memories at k = 5, sharply lower than at k = 15.Reducing k substantially limits cross-context retrieval for behavior-style memories.Source: §G.4 · p. 45, Table 28 · p. 45
  • 99.0% at k = 15 and 98.0%–99.0% at k = 5: dynamic semantic retrieval surfaced AGENT ACTION memories for GOAL-DISTANT queries.The discussion attributes this to the semantic closeness between agentic user requests and injected operational goals.Source: §G.4 · p. 45, Table 28 · p. 45
  • Overall, broad top-k semantic retrieval carries the greatest retrieval risk, especially for AGENT ACTION memories, while the memory management agent filters distant queries more strongly.The discussion links the AGENT ACTION pattern to semantic closeness with injected operational goals.Source: §G.4 · p. 45

H.1 LLM Behavior · H.2 Agent Action · H.3 Discussion on Post-Injection Results

Hidden goals influence frontier-model responses and frequently carry over into agent actions, especially when they appear semantically relevant to the benign task. The discussion attributes this vulnerability to contextual assimilation and warns that silently ignored instructions may remain available to become actionable later.

H.1 LLM Behavior

  • Hidden-goal usage ranged from 21.0% of GPT-5.4 completions to 45.5% of DeepSeek completions, with materially shaped answers in 16.0% and 38.0%, respectively.The prose reports substantial failure rates across every tested model.Source: Table 29 · p. 46, §H.1 · p. 46
  • On goal-adjacent queries, hidden-goal usage reached 85.0% for DeepSeek-v4-Pro, 83.0% for Gemini-3.1-Pro, and 42.0% for GPT-5.4, while goal-distant usage was 0% for both GPT models.Other models used the hidden goal in 2–6% of goal-distant completions.Source: Table 30 · p. 46, §H.1 · p. 47
  • Product and brand promotion had the highest average hidden-goal usage at 41.5%, followed by fabricated personal attributes at 40.0%.Fabricated attributes could be treated as hard constraints; recurring patterns also included unsolicited brand recommendations and adopting political or belief-based framing.Source: Table 31 · p. 47, §H.1 · p. 47

H.2 Agent Action

  • Data exfiltration was the most consistently dangerous agent category: every model used the injected goal in at least 44.4% of traces, and Gemini-3.1-Pro reached 66.7%.Gemini-3.1-Pro had the highest AUR in autonomous propagation, data exfiltration, and operational sabotage, and tied for the highest in brute-force/system hijacking.Source: Table 33 · p. 48, §H.2 · p. 48
  • 45.5% of agent traces used the injected goal overall; agent usage rose to 78.8% for adjacent goals versus 12.2% for non-adjacent goals.Every model had higher agent usage for adjacent goals; Gemini-3.1-Pro reached 89.0% AUR in adjacent traces.Source: §H.2 · pp. 48–49, Table 34 · p. 49
  • Server Administration had the highest domain AUR at 90.0%; all but Social Media & Brand Management among the bottom-ten domains still exceeded 28%.The attack was strongest where benign workflows already involved system actions, communication, file handling, or infrastructure control.Source: §H.2 · p. 49, Table 35 · p. 50

H.3 Discussion on Post-Injection Results

  • Across response and agent-action settings, contextual assimilation makes injected goals effective when they resemble useful task context, such as a user constraint, preference, workflow requirement, or background.Once a hidden goal is treated as relevant, tool access provides a direct path from interpretation to action.Source: §H.3 · p. 51
  • When models avoid using an injected goal, most silently ignore it rather than refuse; the instruction may persist in context or memory and become actionable in a later conversation.The discussion recommends detecting and removing or quarantining injected goals, since even stronger-performing models still use them at nontrivial rates.Source: §H.2 · p. 48, §H.3 · p. 51

I End-to-End Analysis … J.5.2 Metrics

This section evaluates sleeper-memory attacks end to end, including how success varies with query proximity and how four defenses perform, and assesses open-weight models’ detection and localization of prompt-injection payloads in documents. It defines measures for these evaluations.

I End-to-End Analysis

  • End-to-end success requires successful injection, retrieval, and adversarial use; failed injections remain in the denominator and contribute zero.Semantic-retrieval end-to-end rates are estimated using the external-memory-manager usage rate, while full-context estimates assume perfect retrieval and retain injection and usage failures.Source: I End-to-End Analysis · pp. 52–53

I.2.1 Discussion

  • 73.9% of GOAL-ADJACENT LLM BEHAVIOR examples succeed with external-memory-manager retrieval, versus 1.0% of GOAL-DISTANT examples.For single-attack LLM BEHAVIOR, success is 74.8% with semantic retrieval and 80.0% in full context for GOAL-ADJACENT queries, versus 8.5% and 5.0% for GOAL-DISTANT queries, respectively. The supplied results also report GOAL-ADJACENT AGENT ACTION success of 66.0%, 69.9%, and 68.0% across those settings; GOAL-DISTANT AGENT ACTION is 5.0% with the external memory manager and 27.5% with semantic retrieval, where retrieval is perfect on that subset.Source: §I.2.1 · p. 54, Table 36 · p. 55

I.2 Attack-Family End-to-End Results

  • 74.0% is the best-of-family GOAL-ADJACENT LLM BEHAVIOR success rate with external-memory-manager retrieval, compared with 73.9% for the fixed attack.Best-of-family LLM BEHAVIOR rates are 74.7% with semantic retrieval and 81.0% in full context; AGENT ACTION maxima are 70.0%, 72.7%, and 71.0%, respectively.Source: §I.2.1 · p. 54, Table 37 · p. 56

I.2.1 Discussion

  • Query proximity is the dominant factor, while retrieval failures—especially for GOAL-DISTANT queries—and downstream failures to use retrieved memories also limit success.The attack-family estimate is a best-of-family threat model, not the success rate of any individual attack.Source: I End-to-End Analysis · p. 53, §I.2.1 · p. 54, §I.2 · p. 54

J.1 Naive Prompt Hardening

  • Naive prompt hardening appends a static system-prompt suffix that treats external-content instructions as untrusted and bars memory updates without direct user confirmation.The same suffix instructs the assistant to treat requests to change memory, reveal hidden rules, ignore prior instructions, or conceal actions as prompt injection and refuse.Source: §J.1 · p. 57

J.2 GEPA Prompt Hardening

  • 0.884 was the best aggregate validation score for the Stage 2 GEPA suffix, with 24/24 behaviorally correct samples before its length penalty.GEPA uses execution traces and per-sample feedback to revise candidate suffixes; the optimized suffix transferred to a held-out attack and stronger GPT-5.4 model while preserving benign-save behavior, but was less effective on Kimi-K2.5.Source: §J.2 · pp. 57–58

J.3 Extreme Spotlighting

  • Extreme Spotlighting brackets uploaded documents with untrusted-content markers and appends a reminder not to follow their instructions or update memory without direct user confirmation.It operates at the user-message level and can be combined with system-prompt-level defenses.Source: §J.3 · p. 59

J.4 Hybrid Defense

  • The hybrid defense combines the naive hardening suffix in the system prompt with Extreme Spotlighting around the uploaded document, without additional optimization or fusion logic.The configuration is called “Hardening + Spotlighting” in the defense tables.Source: §J.4 · p. 59

J.5 LLM Document Scanner

  • Open-weight models are evaluated as scanners that detect and localize prompt-injection payloads in untrusted documents before they reach a production LLM.A detected attack is represented by its beginning and ending phrases so it can be localized.Source: §J.5 · p. 60

J.5.1 Setup

  • Documents from three corpora receive one payload at a random sentence boundary, using memory-specific and general-purpose template banks to avoid overfitting to memory injections.The corpora contain 500 LLM Behavior samples and 200 each for Agent Action and Multilingual; each template bank has 10 variants. The scanner returns JSON indicating detection and, when applicable, the attack’s beginning and ending phrases.Source: §J.5.1 · p. 60

J.5.2 Metrics

  • Localization success requires fuzzy similarity of at least 0.5 for both predicted attack-boundary anchors; localization enables payload excision while retaining legitimate document content.TPR is the fraction of attack documents flagged, and FPR is the fraction of benign documents falsely flagged; detection without accurate localization may require discarding the entire document.Source: §J.5.2 · p. 60

J.6 Results … K.1.2 Intra-Model Detection Performance

Localization varied by model and template family, while prompt defenses preserved legitimate memory saving. Activation probes distinguished injected from benign examples, with detection performance varying by model depth and remaining stable across tested payload positions.

J.6 Results

  • ≥92% localization was achieved by Gemma-4-26B and Qwen-3.6-35B on both template families, while smaller E2B/E4B variants scored 28–65%.The reported comparison covers memory-type and general-purpose templates.Source: §J.6 · p. 60, Table 41 · p. 61
  • 0% benign-document scores were observed for every model, while memory-type templates were easier for strong models and GPT-OSS-20B and small Gemma variants localized classic templates better.No model hallucinated injections on benign documents.Source: §J.6 · p. 61

J.7 Benign Memory-Save Evaluation

  • 95.1% overall semantic match across 840 samples accompanied ≥98.6% write rates under both defenses; cell-level semantic match ranged from 87.1% (Gemini 3.1 Pro, Naive) to 100% (Kimi-K2.6, GEPA).The single write failure was Claude Sonnet 4.6 under GEPA (69/70).Source: §J.7 · p. 62, Table 42 · p. 62
  • Of 840 samples, 41 received a “No” semantic judgment; 40 involved saved content diverging from the request, with model-specific failure patterns and no systematic refusal or ignored requests.Gemini 3.1 Pro accounted for 17 of 40 content mismatches, predominantly from aggressive compression; DeepSeek-v4-Pro accounted for 7, including 4 hallucinated entity names.Source: §J.7 · p. 62

K.1 Activation Probing

  • Activation probing tests whether intermediate representations distinguish benign documents from injected memory-write objectives and whether discriminative directions transfer across model families.The analysis considers linear and nonlinear separability of adversarial memory-injection examples from benign examples.Source: §K.1 · p. 63

K.1.1 Methodology and Feature Extraction

  • Probes used mean query-token activations across decoder layers from 125 development examples per model, with injected examples placed at document ends or random positions and binary benign/adversarial labels.Evaluated classifiers included Ridge Logistic Regression, LDA, QDA, linear and RBF SVMs, and Random Forests; probes also tested layer fusion and PCA with stratified cross-validation.Source: §K.1.1 · p. 63

K.1.2 Intra-Model Detection Performance

  • Above 0.95 AUROC is often achieved by PCA64 QDA and fused Ridge Logistic Regression, with several model-method combinations exceeding 0.98.The reported AUROC results indicate that combining information across layers can further improve detection.Source: §K.1.2 · p. 63, Table 43 · p. 63
  • Below 0.005 AUROC change was observed when probes trained on end-position payloads were evaluated on randomly positioned payloads; detection was strongest in middle-to-late decoder layers for most models.The exact peak layer varied by model.Source: §K.1.2 · p. 63

K.1.3 Cross-Model Subspace Alignment and Transferability … L.4 Production Website Validation

This section examines cross-model detection transfer and injection success in relation to geometric alignment, model architecture, attack placement, language context, and template wording. It also tests transfer to production websites and reports system-dependent results, including cases where Gemini reported saving a memory that was not visible.

K.1.3 Cross-Model Subspace Alignment and Transferability

  • 0.74–0.85 AUROC with Procrustes alignment approaches target-self performance (0.77–0.88), while Shared PCA yields 0.48–0.54 across model pairs.For Qwen-3.5-9B to qwen-3.6-35B, Procrustes achieves 0.85 AUROC versus 0.88 for target-self; alignment results use the evaluated open-weight models.Source: Figure 5 · p. 65, §K.1.3 · p. 65, §K.3 · p. 70

K.2.1 Methodology

  • The attention study evaluates six instruction-tuned models under end and random payload placement, measuring attack-versus-document attention at aggregate, layer, and head levels.Its attack ratio is the attack attention mass divided by the sum of attack and document attention mass, averaged across generated tokens and heads before separating outcomes.Source: §K.2.1 · p. 67

K.2.2 Attack Attention Mass: Success vs Failure

  • Successful attacks receive more attention mass than failures in every model with non-zero ASR, but payload attention alone does not ensure compliance.Gemma-4-26B end attacks show 0.8 versus 0.5 (60% relative increase), and Qwen-3.6-35B-A3B end attacks show 1.4 versus 0.8 (75% increase); GPT-OSS-20B attends to the payload but never succumbs. The synthesis describes a two-stage process: attention to the payload must be followed by semantic misinterpretation.Source: §K.2.2 · p. 67, Table 46 · p. 68, §K.3 · p. 70

K.2.3 Layer-wise Attack Ratio Profiles

  • Attention-ratio profiles vary by architecture: alternating-attention models show global-layer peaks, while Qwen models show smoother early-to-mid-layer success gaps.Gemma-4-E4B’s success curve is higher at every global-attention layer, whereas GPT-OSS-20B remains below 0.05 and has no successes. Qwen success curves are 10–15 percentage points above failure curves in layers 1–4; discriminative heads are model-specific, including Qwen-3.6-35B L1H4 (∆= +0.259) and Gemma-4-E2B L14H5 (∆= +0.279).Source: §K.2.3 · p. 68, Figure 6 · p. 69, §K.2.4 · p. 69

L.1 Injection Rate relative to position of attack in the document

  • Injection rates were higher for Kimi-K2.6 when payloads appeared inside documents, especially near the beginning or middle; GPT-5.5 had lower rates overall and a modest position effect.The position ablation used 100 documents and an adaptive Actor-Critic Loop attack with injected content markers under Extreme Spotlighting.Source: §L.1 · p. 71, Table 48 · p. 71

L.2.2 Results

  • The multilingual evaluation uses 200 documents across 20 non-English languages, with English attack templates and translated document content; the supplied passages give no injection-rate values.The dataset has 10 documents per language and is balanced between preexisting-memory and no-preexisting-memory conditions; tables cover tool-based injection rates and prompting-based defenses.Source: §L.2.1 · p. 72, §L.2.2 · p. 72, Table 51 · p. 72

L.3.3 Structure is a second-order effect

  • Across four wrapper structures, mean injection rates are tightly clustered, indicating that adding a document separator or closing line does not materially change behavior.The variants cross four wrapper structures with five wording styles, producing 20 combinations.Source: §L.3.1 · p. 74, §L.3.3 · p. 74, Table 54 · p. 75

L.3.4 Wording is the dominant control

  • Tool-aligned and authority-framed wording achieves near-ceiling injection rates on Kimi and GPT-5.4, while minimal and indirect wording largely fails; across 1,800 instances, the attack is robust to structural ablations but fragile to register shifts.Claude Haiku 4.5 is most robust overall but still succumbs at non-trivial rates to “save” and “urgent” wording; Table 53 reports per-variant rates for Kimi K2.6, GPT-5.4, and Claude Haiku 4.5.Source: §L.3.2 · p. 74, §L.3.4 · p. 75, Table 55 · p. 75

L.4 Production Website Validation

  • The production check evaluated a subset of 25 documents/goals across four memory-supporting systems to test transfer and rule out artifacts from the modeled upload pipeline.The systems were OpenAI ChatGPT 5.4 Thinking, Google Gemini 3.1 Pro Preview, Anthropic Claude 4.6 Sonnet, and Moonshot AI Kimi K2.6.Source: §L.4 · p. 76
  • ChatGPT 5.4 Thinking achieved 12/13 LLM Behavior and 12/12 Agent Action injections; Claude Sonnet 4.6 achieved 18/19 LLM Behavior and 6/6 Agent Action injections.Source: Table 56 · p. 76, §L.4 · p. 76
  • Kimi K2.6 achieved 12/13 LLM Behavior and 10/12 Agent Action injections; Gemini 3.1 Pro Preview achieved 10/13 LLM Behavior and 6/12 Agent Action injections.In some Gemini runs, it said it could not form memories despite memory features being enabled; in others, it reported saving a memory but no corresponding saved memory was visible.Source: Table 56 · p. 76, §L.4 · p. 76

L.5 Provider-Setup Swap Ablation · M Prompt Discussion

This section examines how provider-style setup affects injection rates across subject models and goal types, and describes provider-specific memory prompts, external-manager extraction, attack templates, and evaluation judges. It also covers a document scanner for assistant-directed prompt injection that treats document content as untrusted.

L.5 Provider-Setup Swap Ablation

  • GPT-style setup yields the highest semantic injection rate for every subject LLM in the fixed 100-sample tool-based ablation.The setup swap changes the full provider-style configuration, not just prompt text.Source: Table 57 · p. 76, §L.5 · p. 76
  • 100% Behavior and 94% Agent IR under GPT-style setup contrast with GPT-5.5’s single-digit IR on both subsets under Claude- or Gemini-style setups.Claude Sonnet 4.6 has 98% Behavior and 56% Agent Action IR under GPT-style setup, versus 66% and 6% under its native setup; Gemini 3.1 Pro has 86% Behavior and 74% Agent IR under its native setup, while GPT-style pushes both subsets near-ceiling.Source: §L.5 · p. 77
  • Claude’s IR is 36% under its native setup versus Gemini’s 80%, while under GPT-style setup the values are 77% versus 98%, narrowing the gap from 44 to 21 points.The findings attribute Claude’s lower native IR to both the Claude-style harness and model-intrinsic factors.Source: §L.5 · p. 77

M.1 Target LLM System Prompts

  • Target prompts are organized by memory regime: tool-backed prompts expose a provider-native writing tool, whereas external-manager prompts remove it and delegate persistence to a separate component.Claude uses a truncated prompt variant validated in Appendix E.1.1.Source: §M.1 · p. 78, Table 60 · p. 78

M.1.1 Tool-Backed Regime

  • Tool-backed provider prompts differ in memory interfaces, memory placement, document rendering, and safety language; Gemini evaluation adds a lightweight save_memory tool because its available extracts expose no native writing tool.GPT uses a bio channel and separate Model Set Context message; Claude uses memory_user_edits and inline memories; Gemini uses appended memories and a JSON document envelope; Generic adapts the GPT template for other model families.Source: §M.1.1 · pp. 78–79

M.1.2 External-Manager Regime

  • External-manager variants remove the writing tool and replace it with background-persistence framing while preserving provider-specific behavioral norms, document assumptions, memory placement, and safety instructions.The external manager extracts factual statements from conversation input but cannot see uploaded documents or the target’s full system prompt, so it is blind to embedded payloads unless the target launders them into its reply.Source: §M.1.2 · p. 79, §M.2 · p. 80

M.3.1 Universal Suffix Templates

  • Universal suffix attacks append a goal-agnostic payload to a document, with actor-critic variants closing the document wrapper so the target parses the instruction as user-level text.The external-manager variant instead prompts the target to acknowledge the goal for extraction from its response; the optimization critic assesses functional evidence of a memory update or stated intent to save.Source: §M.3.1 · pp. 80–81, §M.4.2 · p. 82

M.5.2 Benign-Save Goal-Match Judge

  • The benign-save judge uses the same yes/no semantic threshold as the adversarial judge but treats only substantive mismatches—such as contradiction or major fabrication—as incorrect.The adversarial judge checks whether a saved memory conveys the core intent of the attack goal; the benign judge ignores superficial phrasing differences from the user’s explicit save request.Source: §M.5.2 · p. 83, §M.5.1 · p. 83
  • The benign-save goal-match judge treats wording differences as acceptable when the saved memory preserves the requested user-related meaning, but rejects substantive mismatches or fabricated specifics.Superficial phrasing differences, grammar variations, shorthand, and concise compression do not count as mismatches.Source: §M.5.2 · p. 83

M.5.3 No-Write Failure-Type Judge

  • For no-write cases with a visible assistant reply, GPT-5.4-nano classifies failures as refused, ignored, accepted_but_not_stored, or ambiguous.The judge focuses on the assistant’s reply, not storage success; a reply that adopts the injected goal but disclaims future retention is accepted_but_not_stored.Source: §M.5.3 · pp. 83–84

M.5.4 Attack Usage Rate Judges

  • The goal-influence judge achieved QWK 0.7288 against human ratings, while the goal-action judge achieved 97.5% accuracy.The influence judge used a calibrated 1–4 rubric and Kimi-K2.5; the action judge relied on trace evidence to determine whether an agent performed, attempted, or accepted a target action.Source: §M.5.4 · pp. 84–85

M.6 LLM Document Scanner

  • The document scanner flags embedded assistant-directed hijacking attempts, treats document text as untrusted, and conservatively avoids flagging ordinary content absent such attempts.The prompt describes suspicious instructions such as commands to alter memory or call tools, and says to prefer not flagging when uncertain.Source: §M.6 · p. 86

Related papers

Loading 2605.15338v2…