MemPoison exposes write-time memory defenses blind to compositional and trigger attacks

Persistent memory is the Achilles’ heel of autonomous AI agents. MemPoison, a new benchmark and analysis framework, shows that current write-time defenses are structurally blind to the most dangerous classes of memory poisoning — and the crypto agents relying on persistent memory are sitting ducks.

The framework introduces a three-tier attack taxonomy: L1 (direct single-record corruption), L2 (compositional multi-record corruption), and L3 (context-triggered dormant corruption) [^claim_2343]. The critical finding is that L2 and L3 attacks exploit compositional retrieval and conditional activation dynamics. Individual records look benign at write time but become harmful only when retrieved together or triggered by a specific context. Using mechanistic influence decomposition (MID), the authors show that baseline write-time defenses — like consistency checks — substantially suppress direct L1 attacks but fail to reliably suppress L2 and L3 attacks [^claim_2344][^claim_2345]. That’s a fundamental limitation: any defense that inspects records in isolation at insertion time cannot catch attacks that only activate upon composition or context.

The benchmark is thorough: 1,227 hand-validated cases across four attack types, three injection channels, and three representative memory substrates, evaluated on seven open-weight and three closed-weight model families [^claim_2341][^claim_2342]. That breadth suggests the vulnerability is systematic, not model-specific. Adversarial content can be injected via standard interaction channels, retained across turns, and later distort downstream behavior in persistent external memory systems [^claim_2347]. The paper argues for shifting from static filtering to adaptive, context-sensitive memory defense strategies [^claim_2346].

For crypto, the implications are immediate. On-chain agent memory — stored on L2s or in TEEs — is vulnerable. An attacker can inject L2/L3 poison records through a seemingly innocuous prompt, causing an agent to sign a malicious transaction, misreport an oracle price, or misroute funds. Write-time static filtering is provably insufficient. Any on-chain memory system must implement adaptive, context-sensitive re-evaluation at retrieval time, which is computationally expensive and may break the gas-cost model of current L2 agent frameworks. Autonomous trading agents could be poisoned via L3 dormant corruption — a trigger-conditioned attack that activates only when a specific market state occurs, creating a predictable MEV opportunity. That’s a new class of “memory MEV” that existing frontrunning protections do not address. For DAOs using LLM agents for governance assistance, a single poisoned interaction could distort the agent’s output across many subsequent decisions without the attacker needing to maintain a persistent presence.

That means memory stored in authenticated data structures (e.g., Merkleized logs) with retrieval-time verification — a natural fit for blockchain infrastructure but not yet standard practice in agent frameworks.