MemoryDojo: A Benchmark for Memory Poisoning in LLM Agents
The MemoryDojo benchmark reveals that all LLM agent memory systems are vulnerable to cross-session poisoning attacks, but the impact varies by architecture.
MemoryDojo is the first benchmark to systematically track the lifecycle of toxic information in LLM agent memory and quantify its downstream effects, including 155 multi-session long-horizon trajectories across four domains and five memory systems. The evaluation finds that all memory systems are vulnerable to poisoning attacks, but the degree of downstream impact varies significantly due to different storage and retrieval mechanisms, highlighting the key role of memory architecture design in security. Researchers also propose a memory-aware poisoning optimization method that can improve attack efficiency and amplify differences between architectures, indicating that attackers can tailor strategies to specific systems. This benchmark provides an extensible tool for understanding and mitigating agent memory risks and calls for future development of toxic memory detection and isolation mechanisms and more robust retrieval strategies.
Memory Systems: A Double-Edged Sword for Agents
Large language model (LLM) agents significantly improve their performance on long-horizon, multi-session tasks through memory systems. They can remember past interactions, avoid repeating mistakes, and maintain contextual coherence. However, this capability also introduces a critical attack surface: malicious instructions can be stored in memory during one session and retrieved and executed in later sessions, creating cross-session poisoning propagation.
Different memory systems process and retrieve information in different ways, leading to vastly different downstream effects of poisoning. To quantify these effects, researchers have introduced MemoryDojo—a benchmark for tracking the lifecycle of toxic information in agent memory and measuring its impact on subsequent behavior.
MemoryDojo: Design and Composition
The core goal of MemoryDojo is to systematically evaluate memory poisoning effects. It is designed to be easily extensible and includes 155 multi-session long-horizon trajectories, covers four domains, and supports five different memory systems. By injecting malicious instructions into these trajectories, researchers can observe how toxic information is stored, retrieved, and influences agent decisions.
What makes this benchmark unique is its cross-architecture comparison capability. Because different memory systems (e.g., vector retrieval-based, summary-based, graph-structured) have different storage and retrieval mechanisms, poisoning effects also differ significantly. MemoryDojo provides a quantifiable measurement framework for these differences.
Memory systems are core components that enable LLM agents to maintain state during long-horizon tasks. Common implementations include: semantic retrieval based on vector databases (embedding conversations and recalling by similarity), summary-based compressed storage (periodically summarizing history with an LLM), graph-structured knowledge graphs (organizing memory as entity relations), and hybrid architectures. Different systems differ significantly in storage granularity, retrieval strategies, and forgetting mechanisms, which directly determines whether malicious instructions will be activated after being written. Understanding these underlying mechanisms helps explain why the same poisoning sample exhibits markedly different propagation paths and levels of harm under different architectures.
All Memory Systems Are Vulnerable
The evaluation results reveal an alarming fact: all tested memory systems are vulnerable to memory poisoning attacks, but the degree of downstream impact varies enormously. Some systems may rapidly propagate malicious instructions, while others may attenuate the impact due to filtering effects in their retrieval mechanisms. This difference highlights the importance of memory architecture design in security protection.
Researchers further propose a memory-aware poisoning optimization process that can improve poisoning efficiency and further amplify the differences between memory architectures. This indicates that attackers can tailor attack strategies to specific memory systems, thereby bypassing certain defense mechanisms.
Memory poisoning is a variant of data poisoning attacks, where the attack surface shifts from training data to the agent's runtime memory. Attackers do not need access to model weights; they only need to plant seemingly harmless text containing malicious instructions during normal interactions (e.g., "when X happens in the future, execute Y"), wait for the system to store it in long-term memory, and have it retrieved and executed in later sessions. Compared with prompt injection, memory poisoning is persistent and can propagate across sessions, and may be further amplified through the agent's self-reflection or summarization mechanisms. The difficulty of defense lies in the fact that memory content is naturally treated as trusted context, and the retrieval process lacks source verification and trust grading.
Implications for Agent Security
The introduction of MemoryDojo provides an important tool for understanding and mitigating agent memory risks. As LLM agents are widely applied in scenarios such as automated tasks and personal assistants, memory poisoning may become a real-world threat. For example, an attacker may plant malicious instructions in one conversation and induce the agent to leak sensitive information or perform dangerous operations in later sessions.
This benchmark encourages more research to focus on the security design of memory systems. In the future, we may need to develop mechanisms that can detect and isolate toxic memories, or design retrieval strategies that are more robust to poisoning. The open-source and extensible nature of MemoryDojo will accelerate exploration in this field.
Conclusion
MemoryDojo is not only a benchmark but also a systematic examination of agent memory security. It reminds us that while pursuing long-term memory capabilities for agents, we must be vigilant about the accompanying attack surface. Through quantitative cross-architecture comparisons, researchers can more clearly understand the vulnerabilities of different memory systems, thereby driving safer agent design.
One-line Summary
The MemoryDojo benchmark reveals that all LLM agent memory systems are vulnerable to cross-session poisoning attacks, but the impact varies by architecture.
Paragraph Summary
MemoryDojo is the first benchmark to systematically track the lifecycle of toxic information in LLM agent memory and quantify its downstream effects. It includes 155 multi-session long-horizon trajectories, covering four domains and five memory systems. The evaluation finds that all memory systems are vulnerable to poisoning attacks, but the degree of downstream impact varies significantly due to different storage and retrieval mechanisms, highlighting the key role of memory architecture design in security protection. Researchers also propose a memory-aware poisoning optimization method that can improve attack efficiency and amplify differences between architectures, indicating that attackers can tailor strategies to specific systems. This benchmark provides an extensible tool for understanding and mitigating agent memory risks, and calls for future development of toxic memory detection and isolation mechanisms as well as more robust retrieval strategies.
Related articles
Seven Years of Evolution: How Far Has the Foldable Come From the First Generation?
From the first foldable to today's latest models, what has seven years changed? Shallower creases, higher brightness, thinner bodies, and smoother software migration—has the foldable crossed the chasm from enthusiasts to ordinary users? This article discusses the question based on a video comparison.
When Did Humans Start Eating Salt? A 10,000-Year History of Salt
When did humans start eating salt? From salt use at the dawn of agriculture 11,000 years ago to ancient seawater evaporation and rock salt mining, and on to the salt trade, salt taxes, and Gandhi's Salt March, this article traces salt's key role in human civilization.
Microsoft Paza Research: How African Language Speech Recognition Breaks Through Architecture and Data Bottlenecks
Microsoft's Paza research evaluates 53 speech models across 39 African languages, revealing architecture choice matters more than pre-training coverage, 200-300 hours is the practical data threshold, and language typology deeply influences recognition performance.