Attack Type

Poisoning Research

Attacks targeting training data, fine-tuning, retrieval knowledge bases, or persistent agent memory

112 matching entries

Poisoning research results

112 entries

Trajectory Poisoning in Self-Evolving Agent Skills

Published 8/6/2026

Analyzed 8/13/2026

Self-evolving agent-skill systems may promote recurring, attacker-controlled execution records into persistent reusable instructions. The paper evaluates whether poisoned but task-plausible trajectories survive aggregation and appear in generated skill artifacts, using inert canary behaviors and two structurally different skill-evolution pipelines.

When Experience Becomes Instruction: Trajectory Poisoning in Self-Evolving Agent Skill Systems

Evaluated models: GPT-5.4, MiniMax M2.5, DeepSeek V3.2 +3 more

Source: arXiv

Persistent Agent Memory Poisoning and Incomplete Repair

Published 7/29/2026

Analyzed 8/13/2026

MemSecBench follows malicious agent-memory content from initial write through persistence, retrieval, action selection, execution, and attempted selective repair. Its controlled Write–Execute–Forget protocol evaluates 310 human-reviewed cases across two harnesses, four memory backends, three model backends, and seven evidence-gated lifecycle checkpoints.

MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair

Evaluated models: GPT-5.5, DeepSeek V4-Pro, MiniMax-M3

Source: arXiv

Workspace Agent Runtime Safety Failures Across Risk Carriers

Published 7/29/2026

Analyzed 8/13/2026

AgentS4D measures unsafe actions and state changes across complete workspace-agent executions rather than treating task completion or isolated model responses as safety evidence. Its 328 sandboxed cases introduce risky content through user requests, documents, web resources, tools, third-party skills, and persistent memory, then compare the same cases across four agent harnesses and five model backends.

AgentS4D: Benchmarking Runtime Risks across the Execution Lifecycle of LLM-Based Workspace Agents

Evaluated models: GPT-5.5, Gemini 3.1 Pro, DeepSeek V4-Pro +2 more

Source: arXiv

Lifecycle poisoning of reusable agent skills

Published 7/15/2026

Analyzed 7/21/2026

The paper presents SkillSec-Eval, a controlled evaluation of attacks against reusable agent skills across repository admission, semantic retrieval, planner selection, runtime execution, and updates. It reports that malicious metadata, retrieval manipulation, unsafe workflow composition, and poisoned updates can cause agents to retrieve, select, or execute unintended skills. These are paper-reported benchmark results, not independently verified vulnerabilities in a named production product.

Agent Skill Security: Threat Models, Attacks, Defenses, and Evaluation

Evaluated models: all-MiniLM-L6-v2, Gemini 3.1 Pro, Gemini 1.5 Flash

Source: arXiv

GhostWriter Persistent Memory Poisoning in Tool-Using Agents

Published 7/6/2026

Analyzed 7/20/2026

The paper describes GhostWriter, a reproducible two-phase attack against tool-using agents with persistent memory: untrusted email or calendar content is admitted into long-term memory, then later retrieved during a benign user task and treated as trusted context. In the authors’ controlled evaluation, this could steer subsequent agent actions despite the adversary lacking direct access to the agent, memory store, account, or later prompt. The paper reports an average 98% memory-injection rate…

When Agents Remember Too Much: Memory Poisoning Attacks on Large Language Model Agents

Evaluated models: GPT-5.4-mini, DeepSeek V4 Flash, Gemini 2.5 Flash +1 more

Source: arXiv

Query-Agnostic Poisoning of Policy-Aware RAG Knowledge Bases

Published 7/5/2026

Analyzed 7/20/2026

The paper describes a specific, reproducible retrieval-layer poisoning issue: an adversary with knowledge-base write access can add semantically broad, cross-category policy rules that rank in top-k retrieval across varied queries without knowing runtime prompts. In the authors' isolated PA-LLM-RAG evaluation, one injected rule caused at least one poisoned rule to enter the LLM context for 17/20 prompts. Safe defensive reproduction should use a synthetic policy KB, synthetic benign prompts…

Knowledge Base Poisoning Attacks and Defense for Policy-Aware LLM-RAG Framework

Evaluated models: nomic-embed-text

Source: arXiv

Long-Term Memory Authority Laundering

Published 6/23/2026

Analyzed 7/20/2026

The paper describes a reproducible agent-memory poisoning issue: untrusted content stored in persistent memory can later influence consequential actions after its origin is laundered through agent summarization, trusted-tool echo, or manufactured corroboration. The paper reports that content scoring, lineage, and single-session capability/IFC defenses remain vulnerable because they decide authority from malleable content or derivation signals. This is a paper-reported evaluation; it was not…

Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees

Evaluated models: GPT-5 Chat, GPT-4o Mini, Claude Opus 4.1 +5 more

Source: arXiv

Persistent Memory Poisoning in LLM Agents

Published 6/3/2026

Analyzed 7/20/2026

The paper describes and evaluates a reproducible application-layer weakness in agents with persistent memory: untrusted external content can cross the memory-write boundary, be stored as trusted factual, experience, or procedural memory, and influence later sessions. It identifies four write channels—explicit writes, policy-driven writes, compaction, and experience-to-procedure synthesis—and six attack classes. For safe defensive testing, use MPBench’s two-phase structure in an isolated agent…

From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents

Evaluated models: GPT-oss 120B

Source: arXiv

Fluent Single-Document RAG Corpus Poisoning

Published 5/27/2026

Analyzed 7/20/2026

SilentRetrieval describes a specific RAG corpus-integrity vulnerability: an attacker able to add a topically relevant document to a retrieval corpus can make that document rank highly and influence the generated answer while remaining fluent enough to evade simple perplexity checks. The paper evaluates a two-stage method combining retrieval-oriented document optimization with context-adaptive claim integration. A safe defensive reproduction is to use only isolated benchmark corpora and inert…

SilentRetrieval: Hijacking Retrieval-Augmented Generation via Semantically-Preserving Adversarial Data Poisoning

Evaluated models: Llama 2 7B Chat, Mistral 7B Instruct v0.2, Qwen 7B Chat +1 more

Source: arXiv

Sleeper Memory Poisoning in LLM Agents

Published 5/14/2026

Analyzed 7/20/2026

The paper presents a specific black-box indirect prompt-injection evaluation: attacker-controlled external content can cause a memory-enabled assistant or external memory manager to persist a fabricated user memory, which may later be retrieved in a separate session and steer responses or agent actions. The authors evaluate injection, retrieval, and conditional adversarial usage separately across synthetic document and future-session datasets. The released repository provides defensive…

Hidden in Memory: Sleeper Memory Poisoning in LLM Agents

Evaluated models: GPT-5.4, GPT-5.5, Claude Sonnet 4.6 +3 more

Source: arXiv

Related research categories