AuthorsChuanchao Zang, Jianing Wang, Wenyu Chen et al.
TL;DR
PIPEPOISON uses chain-structured, weighted end-to-end optimization over write–retrieve–utilize pipelines to raise Attack Utilization Rate by 19.1 percentage points over the strongest baseline.
Read our summary here, or open the publisher PDF on the next tab.
THE PROBLEM
Existing indirect memory poisoning attacks optimize writing and retrieval separately, causing write success rate to fall from 59.4% to 47.3% after retrieval-oriented tuning.
This cross-stage interference and sequential transformation mean poisoned content that looks retrievable can be rewritten away, breaking long-term influence on agent planning and decisions.
HOW IT WORKS
PIPEPOISON builds stage-level signals, chain-structured losses, and stability-calibrated configuration weights on local shadow systems to optimize a shared poisoning instance.
Think of PIPEPOISON as tuning one malicious "card" so it survives library cataloging, gets ranked highly during search, and then dominates the librarian’s final recommendation.
By explicitly modeling write, retrieve, and utilize as a chained objective, PIPEPOISON achieves persistent behavioral steering that a plain context window or stage-isolated optimization cannot provide.
DIAGRAM
This diagram shows how PIPEPOISON executes the write–retrieve–utilize pipeline on shadow configurations and feeds stage signals back into hint refinement.
DIAGRAM
This diagram shows how PIPEPOISON is evaluated over 12 memory–agent configurations, transfer scenarios, and eight defenses using WSR, RSR@5, and AUR.
PROCESS
Stage-Level Signals
PIPEPOISON runs the poisoning content through shadow configurations and computes writing score Wi(x), retrieval score Ri(x,q), and utilization score Ui(x,q) for each pipeline.
Chain-Structured Losses
PIPEPOISON converts stage scores into chain-structured losses ℓi,w ℓi,r ℓi,u, encoding that retrieval and utilization are optimized only after writing succeeds.
Weighted Multi-Configuration Optimization
PIPEPOISON computes configuration weights πi and stage weights αj from current losses, forming a joint lifecycle score J(t) that emphasizes difficult stages and configurations.
Hint Refinement and Poison Generation
PIPEPOISON updates one of the stage hints h(t)w h(t)r h(t)u using shadow feedback, regenerates poisoning content, and repeats until the lifecycle score exceeds threshold η.
KEY CONTRIBUTIONS
End-to-end formulation of indirect memory poisoning
PIPEPOISON formalizes indirect long-term memory poisoning as optimization over the full write–retrieve–utilize lifecycle, explaining why WSR drops 59.4% → 47.3% and RSR 93.1% → 77.9% under stage-wise tuning.
Transferable PIPEPOISON framework
PIPEPOISON introduces stage-level signals, chain-structured losses, and stability-calibrated configuration and stage weights to generate poisoning content that transfers across heterogeneous agent and memory configurations.
Comprehensive evaluation across systems and defenses
PIPEPOISON is evaluated on three agent frameworks, four memory mechanisms, multiple LLM and embedding setups, and eight defenses, achieving 73.4% AUR and retaining 41%–66% AUR under defenses.
RESULTS
Attack Utilization Rate
73.4%
+19.1 percentage points over MemMorph
Write Success Rate
76.1%
+13.1 percentage points over MemMorph
Retrieval Success Rate@5
94.2%
+8.4 percentage points over MINJA
AUR under defenses
41%–66%
PIPEPOISON remains effective across eight defenses including Llama Guard and A-MemGuard
On 300 tasks from LongMemEval, LoCoMo, and BEAM across 12 memory–agent configurations, PIPEPOISON reaches 73.4% Attack Utilization Rate, compared to 54.3% for MemMorph and 48.2% for MINJA. These results show that end-to-end, weighted lifecycle optimization lets PIPEPOISON maintain poisoned influence through writing, retrieval, and utilization.
BENCHMARK
On 300 tasks from LongMemEval, LoCoMo, and BEAM across 12 memory–agent configurations, PIPEPOISON reaches 73.4% Attack Utilization Rate, compared to 54.3% for MemMorph and 48.2% for MINJA. These results show that end-to-end, weighted lifecycle optimization lets PIPEPOISON maintain poisoned influence through writing, retrieval, and utilization.
BENCHMARK
Attack Utilization Rate (AUR) comparison across indirect and direct memory poisoning baselines.
KEY INSIGHT
Retrieval-oriented optimization in existing attacks reduces write success rate from 59.4% to 47.3%, and memory writing reduces retrieval success rate from 93.1% to 77.9%.
This is surprising because tuning content to be more retrievable intuitively should help attacks, yet PIPEPOISON shows that ignoring upstream transformations can erase those gains and harm end-to-end success.
WHY IT MATTERS
PIPEPOISON unlocks a way to treat long-term memory poisoning as a single chained objective, rather than three isolated stages, using shadow pipelines only.
Builders can now stress-test agent memory systems against realistic, transferable poisoning that survives writing, competes in retrieval, and actually changes behavior, revealing lifecycle-wide vulnerabilities that stage-local defenses miss.
Guilin Zhang, Wei Jiang et al.
· 2026
A-MAC scores candidate memories using Utility, Confidence, Novelty, Recency, and Type Prior combined by a learned linear admission policy with Algorithm 1 A-MAC Memory Admission. On the LoCoMo benchmark, A-MAC achieves F1 0.583 and 2644 ms latency, improving F1 by 0.042 and reducing latency by 1187 ms compared to A-mem.
Robbyant Team, Zelin Gao et al.
arXiv 2026 · 2026
LingBot-World combines a Data Engine, Fundamental World Model, Action-Conditioned World Model, and Post-Training causal adaptation to turn a 28B-parameter video generator into a real-time interactive world simulator. On the VBench benchmark, LingBot-World achieves a dynamic degree of 0.8857 versus 0.7612 for Yume-1.5, while also improving imaging quality to 0.6683.
Manoj Madushanka Perera, Adnan Mahmood et al.
· 2026
AgenticAI-DialogGen chains ChatPreprocessor, KnowledgeExtractor, TopicAnalyzer, KnowledgeGraphBuilder, PersonaGenerator, DuelingChat Agent, ConversationValidator, ConversationRefiner, QAGeneration, and PostProcessing to turn raw multi-session chats into topic-guided, persona-grounded conversations with explicit short- and long-term memories. On the TGC / KG memory QA benchmark, Mistral-7B fine-tuned within AgenticAI-DialogGen achieves 87.36 F1, compared to GPT-4’s 83.77 F1 in a zero-shot setting on the same task.
Answers use this explainer on Memory Papers.
Checking…