MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair
Source: https://arxiv.org/abs/2607.27080
Authors: Xuanze Chen, Xukang Xie, Wentao Fu, Jiajun Zhou, Shanqing Yu, Qi Xuan
Published: 2026-07-29
Categories: cs.CR, cs.AI
Abstract
Memory systems allow agents to retain and reuse information from past interactions, but they can also let malicious content persist. A malicious instruction crafted by an attacker may be stored in long-term memory, recalled much later, and quietly shape a real action. Recent benchmarks increasingly examine agent memory security, yet few trace the same malicious semantics across persistence, downstream consequences, and selective repair under diverse memory-backend comparisons.
MemSecBench is a task-grounded benchmark for the lifecycle security of agent memory systems. It contains 310 cases drawn from 48 realistic contexts across code and science, daily life, and office work. Each case follows a controlled Write–Execute–Forget protocol in an isolated runtime under an exact agent configuration, defined by an agent harness, a memory backend, and an LLM backend. Evidence-based adjudication combines a deterministic write check, checkpoint-specific judge-model evaluations, and programmatic gates across seven lifecycle checkpoints.
The experimental design spans a 24-configuration matrix (2 agent harnesses × 4 memory backends × 3 LLM backends). Key findings: malicious memory persists in 84.2% of all cases, and the full Write–Execute chain succeeds in 50.3%. Among successfully poisoned cases, 59.6% complete the full Execute chain, while 56.1% achieve selective repair.
Evidence (Obsidian)
From 论文流水线 2026-07-31:
- 310 个案例来自 48 个真实场景（代码/科研、日常生活、办公），每个案例走 Write–Execute–Forget 协议在隔离运行时执行。
- 评测有 7 个生命周期 checkpoint：write check + checkpoint 级 judge-model 评估 + 程序化 gate。
- 核心贡献是「追踪同一段恶意语义跨 persistence → consequence → repair 的完整链路」。
- 与本周 UniMem（记忆路由）、MemLens（记忆价值评估）合成记忆层三件套：存哪、留多久、怎么防污染。