Transferable End-to-End Optimization for Indirect Long-Term Memory Poisoning in LLM Agents

2026-08-31

AI Summary

本文针对间接长期记忆中毒问题，提出PipePoison方法，通过端到端优化各阶段瓶颈，提高攻击利用率和跨配置迁移性。

Abstract

Long-term memory can turn untrusted external content into persistent influence over an LLM agent's future decisions, creating the threat of indirect memory poisoning. A successful attack must survive a multi-stage pipeline comprising memory writing, retrieval, and utilization. Existing attacks largely rely on intra-stage optimization, optimizing individual stages in isolation while overlooking inter-stage coupling. Specifically, these stages impose different requirements on the same poisoning content, and each stage operates on the transformed output of its predecessor. Consequently, optimizing one stage may undermine the effectiveness of other stages, while upstream transformations may erase improvements intended for downstream stages. Indirect memory poisoning should therefore be viewed as an end-to-end optimization problem. Based on this insight, we present \textsc{PipePoison}, which collects fine-grained stage feedback from local shadow systems, uses chain-structured losses to identify and optimize the stage bottlenecking end-to-end success, and applies stability-calibrated stage and configuration weights to improve transferability. Across three agent frameworks and four memory mechanisms, \textsc{PipePoison} improves attack utilization rate by 19.1 percentage points. Even on fully unseen victim configurations, it outperforms the strongest baseline by 16 percentage points and remains effective under eight representative defenses.

Problem

• long-term memory
• indirect memory poisoning
• multi-stage pipeline
• stage coupling
• end-to-end optimization

Innovation

• end-to-end optimization
• fine-grained stage feedback
• chain-structured losses
• stability-calibrated weights