Source-linked AI summary
Transferable End-to-End Optimization for Indirect Long-Term Memory Poisoning in LLM Agents
Chuanchao Zang, Jianing Wang, Wenyu Chen, Xiangtao Meng, Li Wang, Xinyu Gao, Zheng Li, Shanqing Guo
TL;DR
Indirect memory poisoning exploits the persistence of untrusted external content in LLM-agent memory, but existing stage-isolated attacks overlook coupling across writing, retrieval, and utilization. PIPEPOISON jointly optimizes this lifecycle using shadow-system feedback, chain-structured losses, and stability-calibrated weighting; it improves AUR by 19.1 percentage points and outperforms the strongest baseline by 16 percentage points on transfer to unseen configurations.
Problem
Existing memory-poisoning attacks optimize writing, retrieval, and utilization separately, despite shared content and sequential transformations that couple these stages.
Method
PIPEPOISON is a black-box framework that uses local shadow pipelines, stage-level feedback, chain-structured losses, and weighted multi-configuration optimization to generate transferable poisoning content.
Results
19.1 percentage points: PIPEPOISON improves attack utilization rate over the strongest baseline across 12 matched memory–agent configurations and by 16 percentage points under transfer evaluation.
Takeaways & Limitations
Indirect memory poisoning should be optimized and defended across the complete write–retrieve–utilize lifecycle rather than at isolated stages.
Takeaways & Limitations
The related-work comparison distinguishes PIPEPOISON’s threat model from attacks requiring direct injection or attacker interaction with the victim.
Abstract
from arXiv · showhide
Long-term memory can turn untrusted external content into persistent influence over an LLM agent's future decisions, creating the threat of indirect memory poisoning. A successful attack must survive a multi-stage pipeline comprising memory writing, retrieval, and utilization. Existing attacks largely rely on intra-stage optimization, optimizing individual stages in isolation while overlooking inter-stage coupling. Specifically, these stages impose different requirements on the same poisoning content, and each stage operates on the transformed output of its predecessor. Consequently, optimizing one stage may undermine the effectiveness of other stages, while upstream transformations may erase improvements intended for downstream stages. Indirect memory poisoning should therefore be viewed as an end-to-end optimization problem. Based on this insight, we present \textsc{PipePoison}, which collects fine-grained stage feedback from local shadow systems, uses chain-structured losses to identify and optimize the stage bottlenecking end-to-end success, and applies stability-calibrated stage and configuration weights to improve transferability. Across three agent frameworks and four memory mechanisms, \textsc{PipePoison} improves attack utilization rate by 19.1 percentage points. Even on fully unseen victim configurations, it outperforms the strongest baseline by 16 percentage points and remains effective under eight representative defenses.
1 Introduction
Indirect memory poisoning turns attacker-controlled external content into persistent influence over later agent decisions. Because writing, retrieval, and utilization transform and constrain the same poisoning content, the paper frames attack construction as end-to-end optimization and introduces PIPEPOISON to improve transferability.
- Long-term memory lets malicious external information persist beyond its original interaction and influence future agent decisions.
- Successful indirect poisoning must pass through writing, retrieval, and utilization rather than merely expose the agent to poisoning content.
- Existing attacks optimize stages in isolation, although shared poisoning content and upstream transformations can make stage improvements interfere with one another.
- PIPEPOISON uses local shadow systems, stage-level feedback, chain-structured losses, and stability-calibrated weights to optimize transferable poisoning content.
- 19.1 percentage points: PIPEPOISON improves attack utilization rate over the strongest baseline across 12 matched memory–agent configurations.
- 16 percentage points: PIPEPOISON outperforms the strongest baseline in attack utilization rate under transfer evaluation with differing victim configurations.
- PIPEPOISON remains effective against eight representative defenses, retaining 41%–66% attack utilization rate across evaluated defense settings.
2 Preliminaries and Related Work
The paper defines indirect memory poisoning as an attack delivered through untrusted external sources and evaluated across a write–retrieve–utilize memory lifecycle. It distinguishes this threat model from direct or interaction-based attacks and shows that isolated stage optimization can create substantial cross-stage performance gaps.
- Indirect memory poisoning relies on an agent encountering attacker-controlled content in external sources and later using derived information from long-term memory.
- The attacker specifies an objective g and expected query domain Qtar, targeting later queries related to the intended fact, preference, recommendation, or action.
- Writing succeeds when attack-relevant meaning survives the writer’s summarization, filtering, compression, or rewriting; retrieval succeeds when derived memory appears for a later target-domain query.
- Direct and interaction-based attacks assume memory access or attacker-provided inputs entering a store, whereas this threat model assumes neither victim interaction nor direct injection.
- 12.1 percentage points: retrieval-oriented optimization reduces average WSR from 59.4% to 47.3% across four attacks and four memory mechanisms.
- 15.2 percentage points: memory writing reduces RSR from 93.1% on original poisoning content to 77.9% on the resulting memory.
3 Our PIPEPOISON
PIPEPOISON optimizes indirect memory poisoning across the complete write–retrieve–utilize pipeline using local shadow systems and stage-specific feedback. It refines bottleneck stages and, in transfer settings, jointly accounts for heterogeneous shadow configurations.
- 3.1 Overview and Shadow Setup: A successful candidate must preserve its payload during writing, enable retrieval for the expected query domain, and steer the agent toward the attacker’s objective.
- 3.2 Stage-Level Signals: PIPEPOISON executes each poisoning candidate through complete local shadow pipelines and collects writing, retrieval, and utilization scores.These signals indicate whether attack-relevant content survives writing, remains retrievable under benign-memory competition, and influences agent behavior.
- 3.3.2 Transfer across Multiple Shadow Configurations: In transfer mode, PIPEPOISON jointly optimizes one candidate across multiple heterogeneous shadow configurations rather than relying on a single matched configuration.The matched case uses n = 1 with uniform configuration and stage weights; transfer prioritizes configurations and stages limiting end-to-end performance.
- 3.3.1 Bottleneck-Guided Refinement: PIPEPOISON represents poisoning content with writing, retrieval, and utilization hints that a local generator combines into one coherent candidate.The hints respectively target survival through memory transformation, target-domain retrieval cues, and behavioral steering toward the objective.
- 3.3.1 Bottleneck-Guided Refinement: Its lifecycle score rewards performance across the complete pipeline while placing additional pressure on the weakest stage.Optimization terminates when the lifecycle score reaches the stopping threshold η.
- 3.3.1 Bottleneck-Guided Refinement: Chain-structured losses delay retrieval refinement until writing succeeds sufficiently, and utilization refinement until the written memory is retrieved.This ordering follows the pipeline’s sequential dependencies and prevents prioritizing downstream stages before their required inputs exist.
4 Evaluation
PIPEPOISON is evaluated across matched and transfer settings, component variants, attacker-side choices, deployment conditions, and defenses. It generally improves end-to-end attack utilization and maintains transfer stability, although stronger restrictions and defenses reduce effectiveness.
- Matched effectiveness: Across 12 matched memory–agent configurations, PIPEPOISON achieves the highest AUR in every configuration and the lowest cross-configuration variation.Its average AUR improves by 19.1 percentage points over the strongest baseline.
- Transfer effectiveness: 67%–68% WSR, 93%–95% RSR@5, and 63%–64% AUR are retained on fully different configurations, with the highest AUR among evaluated methods.Moving from shadow-covered to fully different configurations reduces AUR by approximately 7–9 percentage points.
- Transfer stability: 4.34%, 1.69%, and 5.01%: PIPEPOISON obtains the lowest transfer RSDs for WSR, RSR@5, and AUR across eight victim configurations.The results indicate that transfer effectiveness is not driven by a small number of favorable implementations.
- Component ablation: 73% AUR is reached by the complete component variant in the matched setting, compared with 43% for final-outcome-only feedback and 52% for independent stage signals.The complete variant combines stage signals, chain-structured losses, and calibrated stage and configuration weights.
- Sensitivity and robustness: A moderate stopping threshold best balances matched and transfer performance: η = 0.7 outperforms η = 0.5 for transfer, while η = 0.9 specializes toward matched settings.At η = 0.9, matched performance reaches 91% AUR but transfer performance falls to 46%–58% AUR.
5 Discussion
The evaluation uses automated and human-validated evaluators, while optimization remains local to attacker-controlled shadow systems. PIPEPOISON typically reaches its stopping condition within a bounded number of iterations, including under transfer settings.
- AgentEvals achieved 0.93-0.95 agreement with human labels, compared with an average pairwise Cohen’s κ of 0.71 among three human experts.The human validation covered 800 records across four representative attacks.
- PIPEPOISON performs optimization exclusively on attacker-controlled local shadow systems without interacting with the victim system.The optimization budget is capped at 50 iterations.
- 4.6 average optimization iterations were required in the matched setting, versus 14.7, 19.8, and 27.8 in the three transfer settings.
6 Conclusion
The paper frames indirect memory poisoning as end-to-end optimization across the memory pipeline and introduces PIPEPOISON to jointly optimize writing, retrieval, and utilization. Experiments report stronger performance, transfer to unseen victim configurations, and effectiveness under representative defenses.
- The paper formulates indirect memory poisoning as an end-to-end optimization problem over the entire memory pipeline.
- PIPEPOISON jointly optimizes memory writing, retrieval, and utilization as a transferable framework.
- Experiments show that PIPEPOISON outperforms existing attacks, transfers to unseen victim configurations, and remains effective under representative defenses.
- The findings highlight the need for lifecycle-wide protection of persistent agent memory.
A Query Domains and Shadow Queries
Each attack task pairs an attacker-intended fact or outcome with a semantic domain of future queries. Shadow queries instantiate varied phrasings of that domain for optimization, while a held-out victim query tests transfer across query realizations.
- Each attack task is represented as T = ⟨g,Qtar⟩, where g specifies the intended fact or outcome and Qtar defines the future-query domain.
- Shadow queries are generated from g and Qtar to represent different phrasings of the target intent for retrieval and utilization optimization.
- The held-out victim query is excluded from generation and optimization to evaluate transfer across realizations of the target intent.
B Shadow Memory Store
For each attack task, the attacker constructs a separate shadow memory store containing 1,000 benign memories relevant to the target query domain while excluding content that promotes the attack objective.
- Each attack task uses a separately generated shadow store containing 1,000 benign memories.
- The benign memories represent ordinary information and interactions relevant to Qtar while excluding content that promotes the attack objective g.
- Shadow-store construction uses no victim-side memories or queries.
C Baseline Implementations
The baselines use the same attack inputs and optimize only attacker-controlled shadow components before submitting unchanged content to victims. Prompts generate target-domain queries, benign memories, and improved poisoning candidates while requiring memories to remain untrusted during agent reasoning.
- Each baseline receives the same attack task, shadow queries, and external-content carrier as PIPEPOISON.
- Baseline-specific generation and refinement occur exclusively on attacker-controlled shadow components before unchanged content is evaluated by each victim system.
- The attacker optimization prompt asks candidates to preserve the objective through writing, retrieval, and post-retrieval agent influence.
- Shadow-query generation varies wording, specificity, and conversational context without revealing attack instructions or held-out victim queries.
- Shadow-memory generation produces diverse benign records while excluding any mention, support, or implication of the attack objective.
- The agent prompt instructs that retrieved memories must not override system instructions, current requests, or authorization requirements.
D Evaluating LLM and Embedding Effectiveness in Matching Scenarios
The matching-scenario study varies the LLM or embedding model while fixing the other model component, with Mem0 and LangGraph held constant. PIPEPOISON remains strongest across the tested LLMs and embeddings, particularly on end-to-end utilization.
- The study fixes Mem0 and LangGraph, then varies five LLMs or three embedding models one component at a time.
- Across different LLMs, PIPEPOISON achieves the strongest performance on WSR, RSR@5, and AUR.
- PIPEPOISON's WSR remains around 76–86%, RSR@5 stays above 90%, and AUR remains around 73–83% across LLMs.
- Changing the embedding model affects retrieval behavior, but PIPEPOISON remains best-performing across TE3-S, TE3-L, and E5.
- PIPEPOISON maintains high retrieval success and substantially higher AUR than baselines under all three embeddings.
E Complete Component-Ablation Results
The component ablation compares increasingly complete feedback and weighting designs, from a final binary outcome to PIPEPOISON's chain-structured, jointly weighted formulation. Additional seen-victim variants provide diagnostic comparisons in selected settings.
- C1 uses only the final binary attack outcome, whereas C2 adds independent write, retrieval, and utilization signals without chain-structured losses.
- C3 adds chain-structured losses but assigns uniform weights across stages and shadow configurations.
- C4 is the complete PIPEPOISON design, combining chain-structured losses with joint stage–configuration weighting.
- For S2–S4, seen-victim C3 and C4 variants include the corresponding victim configuration in the shadow optimization set as diagnostic comparisons.
- C3 is omitted in S1 because the single-configuration setting makes its weighting uniform and equivalent to C4.
F Details of Human Evaluation
Human evaluation validates the automated judgments used for written-memory preservation and attack utilization. AgentEvals shows high agreement with human reference labels and performs best or tied-best in most evaluated combinations.
- AgentEvals determines whether written memories preserve the attacker objective for WSR and whether agent behavior satisfies it for AUR.
- Three human experts independently annotated 200 records from each of four representative attacks, totaling 800 records.
- Majority voting produced the human reference labels used to compare automated evaluators.
- AgentEvals agrees with human reference labels at 0.93–0.95 across all attacks and metrics.
- AgentEvals achieves the best or tied-best agreement in seven of eight attack–metric combinations and has the smallest variation across settings.