Source-linked AI summary
MEMORY Wins All: Indirect Bias Injection Attacks via Social Media Feeds
Minjae Seo, Wonwoo Choi, Geonwoo Han, Taekyoung Kwon, Yongsu Kim, Sang Seo, Jaewon Noh, Hankyul Baek, Seongyun Seo, Myoungsung You
TL;DR
Personal agents’ routine ingestion and persistent storage of external content create an indirect route for manipulating later behavior without direct memory access. The paper presents IBIA, which combines cloaking, watermarking, and category anchoring, and reports high adversary-aligned response rates across tasks while proposing a memory-boundary defense.
Problem
Persistent memory is treated as trusted context, but indirect manipulation through routinely ingested external content has been largely unexamined.
Method
IBIA plants an adversary-aligned stance through externally posted comments using cloaking, watermarking, and category anchoring within the agent’s routine curation process.
Results
91.2% average adversary-aligned response rate across four downstream tasks and seven LLMs, including 86.6% on GPT-5.5.
Takeaways & Limitations
The results identify persistent memory as a critical attack surface and motivate provenance controls for retained agent information.
Takeaways & Limitations
The evaluation targets personalized agents collecting and summarizing SNS posts and comments through routines such as OpenClaw on a local host.
Abstract
from arXiv · showhide
Personal AI agents routinely consume external content while performing tasks such as web browsing, email processing, and SNS feed summarization, and they retain selected information or execution results in persistent memory for later use. We show that this ordinary ingestion of external content opens an indirect path for manipulating subsequent agent behavior. Based on this observation, we present IBIA, an Indirect Bias Injection Attack that plants an adversary-aligned stance on a specific topic into a victim agent's memory through external content, without direct access to the agent, its memory, or future user queries. For this, IBIA combines three mechanisms: comment cloaking, which keeps the crafted content consistent with the surrounding discussion, comment watermarking, which enables lightweight identification during curation, and category anchoring, which makes the retained stance salient under later related requests. We evaluate IBIA on BiasBench, a benchmark of 6,000 adversary-crafted social comments and 120 email instances. The watermark-based curation identifies 95.9% of the injected comments. Under the OpenClaw setting, IBIA achieves adversary-aligned response rates (AARs) of 91.2% on average across four downstream tasks, including 86.6% on the frontier GPT-5.5. We further propose a memory boundary defense that detects the injected bias and reduces AARs to 80.6%.
1 Introduction
Personal agents’ routine ingestion and trusted persistence of external content create an indirect path for adversaries to shape later responses. IBIA exploits this path by disguising, identifying, and anchoring crafted comments during feed curation, achieving high adversary-aligned response rates in controlled evaluation.
- Security motivation: Persistent memory is supplied as trusted context and reused for later requests, creating a security risk when adversary-aligned information is retained.The memory persists across sessions and participates in the agent’s recall-act-update loop.
- Security motivation: Prior memory-corruption attacks assume direct write access, whereas indirect injection through routinely ingested external content remains largely unexamined.Direct attacks leave explicit memory artifacts or execute code on the host, making them conspicuous.
- IBIA: IBIA plants an adversary-aligned stance in persistent memory through ordinary external content without direct access to the agent or its memory.The attack posts crafted comments that the benign agent collects and persists during routine SNS summarization.
- IBIA: IBIA combines comment cloaking, comment watermarking, and category anchoring to make injected comments appear benign, identifiable during curation, and salient under related requests.Cloaking preserves consistency with surrounding discussion and helps clear toxicity filtering.
- Evaluation: 91.2% average AAR across four downstream tasks and seven LLMs, including 86.6% on GPT-5.5, demonstrates strong attack effectiveness in the evaluated setting.The evaluation uses BiasBench and a controlled multi-agent SNS environment with an OpenClaw-based agent.
- Evaluation: 80.6% of injected entries are detected by the proposed memory boundary defense at a 5.6% false positive rate.Detection is reported as part of the paper’s mitigation analysis.
2 Background and Motivation
Personal agents ingest external content through skills, retain selected results in persistent memory, and later use that memory to answer related requests. This architecture creates an indirect memory-corruption path that avoids direct access and can be difficult to detect.
- 2.1 Autonomous Agents: Personal agents use installed skills to access external content and retain selected observations or execution results in memory.The architecture includes a model runtime, skills, and memory; memory is updated from action outcomes.
- 2.2 Memory and Recall–Act–Update Loop: The recall–act–update loop supplies persistent memory to inference, allowing stored records to shape later responses across sessions.A later related request can recall an earlier feed summary and ground its answer on that record.
- 2.3 Indirect Memory Corruption: Indirect memory corruption lets adversaries supply external content that the agent ingests and writes into memory without directly touching the agent or memory store.The adversary only needs control over the curation path, such as a skill governing which observations are retained.
- 2.3 Indirect Memory Corruption: Prior direct-access attacks leave explicit artifacts or require executable payloads, whereas the indirect path produces ordinary-looking, non-executable records.The injected comment can appear as an on-topic opinion, while the resulting memory entry is a short note.
3 Threat Model
The threat model considers a personal agent that collects external content and stores execution results in persistent memory, while the adversary can influence upstream content and curation without directly accessing the agent or memory. The attack targets later subjective queries by maximizing adversary-aligned answers.
- The user runs a personal agent that collects and summarizes external content, with an installed skill curating results into persistent memory.
- The adversary targets one of four subjective categories, where later queries lack an objective answer and may be susceptible to implanted bias.
- The attack objective is the fraction of plausible queries whose answers carry a fixed target bias, scored as support, neutrality, or opposition.
- The adversary cannot query the victim, observe future queries, read or modify memory, alter runtime behavior, or execute code on the host.
- Instead, the adversary posts biased comments to a trending feed and uses a third-party skill so the victim agent performs the memory writes.
4 Method
IBIA addresses benign-looking delivery, reliable identification, and later retrieval of adversarial bias through three coordinated mechanisms. The attack cloaks comments within host discussions, watermarks them for lightweight curation, and anchors retained content to categories and target topics in memory.
- IBIA is an indirect attack that poisons an agent’s persistent memory through externally posted content without directly accessing the agent.
- 4.3 Efficient Comment Identification: Comment watermarking identifies adversary-crafted comments independently of their apparent semantics, allowing the skill to filter ordinary comments before memory curation.
- 4.1 Benign-Looking Comment Construction: Comment cloaking makes biased comments resemble ordinary host-feed content while preserving a fixed target-topic stance and remaining below moderation thresholds.
- 4.1 Benign-Looking Comment Construction: Cloaked comments combine host-topic alignment, a transition hook, and a self-contained target-topic bias payload, with sufficient length for watermarking.
- 4.2 Category Anchoring: Category anchoring recodes selected comments into structured category records that bind target topics to bias payloads and support recall under related requests.
5 Evaluation
The evaluation measures indirect bias transfer across four downstream tasks using controlled social-feed and email settings. IBIA consistently steers responses toward the injected stance, although susceptibility varies by model and task.
- Experimental Setup: BiasBench contains 6,000 adversary-crafted SNS comments and 120 emails spanning four categories for evaluating four delegated agent tasks.The tasks are recommendation, opinion QA, email summarization, and email drafting.
- Bias transfers in the wild: 74.4% average bias under selectively retained biased comments exceeds 55.0% for mixed comments and 45.0% with no injection.The mixed condition varies across categories, whereas selective curation strengthens and stabilizes transfer.
- Effectiveness of Bias Injection: 87% to 100% +1 rates occur across all six backends and four categories after attack, versus 0% to 23.5% baselines for recommendation and opinion QA.Advertisement, Celebrity, and Public Figure average 99.5%, 99.3%, and 99.8%, while Politics averages 92.9%.
- Effectiveness of Bias Injection: 81.5% to 98% adversary-aligned rates occur for GPT-5.5 on Recommendation and Opinion QA, but its resistance differs across downstream tasks.GPT-5.5 resists summarization yet is fully steered in draft generation.
- Microbenchmark: 99.2% Celebrity alignment with full IBIA versus 14% with watermarking alone shows that watermarking and category anchoring are complementary.Category anchoring also raises Advertisement, Politics, and Public Figure from 83%, 85%, and 84.5% to 100%, 97.8%, and 100%.
6 Mitigation
The proposed memory-boundary defense screens candidate updates before they enter persistent memory. It detects most injected entries while introducing a limited false-positive rate on benign content.
- Mitigation Architecture: The memory boundary filter screens candidate memory entries before subsequent retrieval, targeting injected bias rather than every agent input or action.Filtering only on persistent-memory creation or modification confines added cost to relevant state changes.
- Mitigation Results: 80.6% of 6,000 injected entries are detected by correctly identifying their ground-truth bias category.Detection is highest for Public Figure and Celebrity entries at 98.4% and 91.4%, and lower for Advertisement and Politics at 69.3% and 63.0%.
- Mitigation Results: 5.6% of 1,000 benign Civil Comments entries are incorrectly flagged, leaving 94.4% unflagged.Because filtering occurs at the memory boundary, a false positive prevents storage rather than blocking the content from the user.
7 Factual Prior Analysis
Factual priors constrain indirect bias injection: injected stances reinforce existing beliefs more reliably than they overturn strong knowledge. Weakening recognizable entity cues makes conflicting injections substantially more effective.
- Factual Prior Analysis: Without injection, only 0.5% of 200 conspiracy-event responses are true, while 94.5% are false, indicating a strong prior against the claims.The remaining responses are 5% neutral.
- Factual Prior Analysis: 100% of responses follow an injected false stance aligned with the model’s existing tendency, but only 28% follow a conflicting true stance.For conflicting true injections, 34.5% remain neutral and 37.5% continue rejecting the claim.
- Factual Prior Analysis: Anonymizing recognizable entities raises conflicting-injection alignment from 28% to 63%, a 35-percentage-point increase.False injection remains at 100%, while false and neutral responses under conflicting injection decrease to 13% and 24%.
8 Related Work
Prior agent-memory attacks differ mainly in how they obtain access to the memory substrate or induce poisoned content. IBIA instead targets the routine ingestion of external content by a personal agent.
- Agent memory poisoning: Personal agents reload persistent natural-language memory as trusted context, allowing entries encountered during browsing to steer future behavior.This setting includes durable facts, user preferences, and past interactions.
- Agent memory poisoning: AgentPoison and PoisonedRAG directly modify memory or knowledge stores, MINJA uses crafted queries, and MemoryGraft plants malicious procedures.These attacks differ from IBIA in their access assumptions.
9 Conclusion
IBIA shows that ordinary comments, curated by an agent itself, can plant adversary-aligned stances in persistent memory without direct access. Across four tasks and seven LLMs, the attack reaches high alignment rates, while a memory boundary defense detects many injected entries.
- 91.2% average adversary-aligned response rate across four downstream tasks and seven LLMs demonstrates IBIA’s effectiveness on BiasBench.The rate reaches 86.6% on GPT-5.5 despite its factual priors.
- 86.6% adversary-aligned response rate on GPT-5.5 shows the attack remains effective against a frontier model.
- The curating skill passes three state-of-the-art scanners, indicating that conventional skill screening does not identify it as malicious.
- The memory boundary defense detects 80.6% of injected entries and motivates provenance controls for retained information.
A Ethical Consideration
The study treats indirect memory corruption as a security and stakeholder concern because externally retained content can influence later agent responses and user decisions. It avoids exposing real users by evaluating crafted content in an isolated environment and provides a mitigation for the disclosed weakness.
- The study identifies users, agent developers, and skill marketplace operators as stakeholders affected by memory corrupted through external content.Users may receive influenced responses without an obvious indication of the original source, while skills can determine which observations are retained.
- The experiments never post adversary-crafted comments to live Reddit and instead use publicly available discussions in a controlled environment.
- The work aims to expose the trust boundary created by persistent memory and provide evidence for improving memory integrity controls.
- The study reports isolated evaluation, responsible disclosure, and a mitigation for the vulnerability it exposes.
- The repository provides IBIA code, benchmark data covering four categories, and implementation components for OpenClaw, Moltbook, data insertion, and skill integration.
C Curation Skill Workflow
SNSwatcher summarizes configured social feeds while selectively converting verified comments into category-organized long-term memory. Its watermark-based workflow reserves persistent storage for comments that pass verification and later recalls matching topic summaries.
- Curation workflow: SNSwatcher collects feeds and comments, summarizes current discussions, and normalizes comments for watermark verification.
- Curation workflow: Only comments that pass watermark verification become candidates for persistent memory; unverified comments may still contribute to the current summary.
- Curation workflow: For each verified comment, the skill extracts a target topic and concise opinion summary, then assigns the topic to a supported category.
- Memory construction: Verified topic-summary pairs are grouped by category, prefixed with category-specific context, and appended to long-term memory for later matching requests.
- Scope: The workflow is designed for any SNS supported by the user’s configured feed client rather than a particular platform.
- Stance evaluation: The evaluation judge assigns +1, −1, or 0 according to the response’s overall directional stance, treating ambiguous or neutral responses as 0.
- Stance evaluation: Task-specific criteria instantiate the common stance rule for Advertisement, Celebrity, Politics, and Public Figure responses.
G Human Verification of the LLM Judge
The authors validate the LLM judge against human annotations and report high agreement across the evaluated judgments. They also fully verify the email-task judgments, while documenting a taxonomy for disagreements.
- 94.2% agreement with human labels across 5,160 judgments supports the LLM judge’s overall reliability.
- 92.8% agreement across 4,200 judgments in the four-category results provides human verification for the reported rates.
- 98.5% agreement on Advertisement judgments is the highest category-specific agreement reported in the validation.
- All 960 judgments for the two email-based tasks were verified, with full agreement and no correction required.
- Table 11 categorizes the 301 disagreements among the 4,200 verified judgments.
H Report to OpenClaw
The authors reported the issue through OpenClaw’s public GitHub tracker, where an integrated bot reviewed it. The review indicated that the reported externally derived memory-promotion path had been considered in the current main branch.
- The issue was submitted through OpenClaw’s public GitHub issue tracker because no dedicated reporting email was available.
- An integrated repository bot automatically reviewed the submitted report.
- The review indicated that OpenClaw’s current main branch had considered the externally derived memory-promotion path described in the report.