Poisoned-Experience Cross-Session Drift

Properties

family: context-rot
severity: systemic
triggerError: An attacker plants a small set of malicious procedure templates in an agent's long-term RAG memory store alongside legitimate experiences.
mechanism: Future agent instantiations load the poisoned store from disk; semantic similarity retrieval surfaces the malicious templates whenever a task resembles the poisoned entries, causing the agent to adopt unsafe patterns, and the behavioral drift propagates across sessions and across users without further attacker intervention.
blastRadius: Every future session of the agent and every user it serves after the memory is poisoned; a small number of poisoned records can dominate retrieved experiences on benign workloads.
mast: [Cat 1][Cat 3]
detection: Behavioral anomaly detection across sessions; comparison of retrieved experience templates against an allowlisted baseline; monitoring for retrieval of low-trust memory records.
mitigation: Trust-scored memory retrieval that discounts records below a provenance threshold; memory sanitization before persistence; periodic memory audits that replay experiences against a verifier.
source: MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval (arXiv:2512.16962)

family: context-rot
severity: systemic
triggerError: An attacker plants a small set of malicious procedure templates in an agent's long-term RAG memory store alongside legitimate experiences.
mechanism: Future agent instantiations load the poisoned store from disk; semantic similarity retrieval surfaces the malicious templates whenever a task resembles the poisoned entries, causing the agent to adopt unsafe patterns, and the behavioral drift propagates across sessions and across users without further attacker intervention.
blastRadius: Every future session of the agent and every user it serves after the memory is poisoned; a small number of poisoned records can dominate retrieved experiences on benign workloads.
mast: [Cat 1][Cat 3]
detection: Behavioral anomaly detection across sessions; comparison of retrieved experience templates against an allowlisted baseline; monitoring for retrieval of low-trust memory records.
mitigation: Trust-scored memory retrieval that discounts records below a provenance threshold; memory sanitization before persistence; periodic memory audits that replay experiences against a verifier.
source: MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval (arXiv:2512.16962)