New benchmark exposes how agent memory systems amplify poisoning attacks
Source published ·Modelwire updated
Original coverage: arXiv cs.CL ↗·How Modelwire adds context
The development
Agent memory systems are becoming a critical vulnerability as LLMs move toward multi-session, long-horizon reasoning. MemoryDojo, a new benchmark, systematically measures how poisoned instructions persist and propagate through different memory architectures, revealing that attack surface varies significantly across designs. This work matters because production agents increasingly rely on memory to maintain context across conversations, making them susceptible to adversarial injection that compounds over time. The benchmark's 155 trajectories provide the first standardized way to evaluate memory robustness, forcing builders to choose between capability and safety in their memory implementations.
Modelwire’s AI-generated summary of coverage from arXiv cs.CL.
Modelwire analysis
ExplainerOur AI-generated reading of the wider context and the next developments to watch.
MemoryDojo isolates poisoning as a *persistence* problem distinct from single-turn injection attacks. The benchmark reveals that memory architecture choices (retrieval strategy, compression, storage format) don't just trade off capability for safety equally; they create asymmetric vulnerabilities where some designs leak poison while others contain it.
This work sits directly downstream of 'Do Agents Still Follow the Rules?' from early November, which showed that context compaction erodes rule adherence unevenly. MemoryDojo extends that finding by measuring not just compliance drift but active adversarial persistence through memory systems. It also connects to the hallucination detection work (HaluCheck, same week) in that both expose how errors compound across agent reasoning steps rather than staying isolated. Together these papers map a coherent threat model: agents lose guardrails under compression, poisoned instructions survive that compression, and detection systems can't catch the resulting drift.
If the MemoryDojo benchmark gets adopted in agent safety evaluations at major labs (Anthropic, OpenAI, DeepSeek) within the next six months, watch whether their published safety reports cite specific memory architectures they rejected based on these results. If no major lab publicly names a memory design they abandoned due to poisoning risk, the benchmark remains academically interesting but hasn't shifted production practice.
This interpretation is generated from the summary above and the archive coverage cited below. Our methodology · Report an error
Coverage behind this analysis
These archive entries ground the connection in our analysis. They are ordered by source publication date, with links to our coverage and the original sources.
·arXiv cs.CL
Compressing agent context erodes rule compliance in production workflows
As LLM agents scale into production, context window limits force systems to compress operational histories, but new research reveals this compaction systematically erodes rule adherence. ARCBench, a benchmark built on the open-source pi agent harness, measures compliance violations directly within agent execution loops rather than in isolation, exposing where guardrails fail after compression. The findings…
MentionsMemoryDojo · LLM agents
How this coverage is produced
Modelwire uses AI to generate summaries and context from source headlines, snippets, and selected archive coverage. Automated checks do not verify every claim, and items are not routinely reviewed by a person before publication. Zacaria Solis operates the site. Read the linked source for the full evidence and report errors through our corrections process.
Modelwire summarizes, we don’t republish. arXiv cs.CL originally reported this story as “MemoryDojo: Benchmarking Poisoning Through LLM Agent Memory”. The full content lives on arxiv.org. If you’re a publisher and want a different summarization policy for your work, see our takedown page.