RECORD
MemForm: Benchmarking Memory Formation Poisoning in LLM Agents
Cryptography and Security · Submitted 10 Oct 2026
abstract compiled · 2026-10-14 · no language-model review
The authors' main claim These findings motivate protecting both what is committed to persistent memory and how memory is formed from experiences.
The compiled record
The paper's own sentences, arranged. Each label is drawn from a closed vocabulary; the number beside it is the probability the classifier gave that label. Numbers in the tables are the authors', checked by code. No sentence in this record was written by a model.
Open the compiled record
The abstract, sentence by sentence
Long-term memory enables LLM agents to learn from past interactions but exposes memory formation to adversarial influence. Existing studies primarily organize memory poisoning by attack channels, corruption patterns, or lifecycle stages, leaving formation interfaces insufficiently characterized. We formulate Memory Formation Poisoning as adversarial manipulation of the interfaces through which persistent agent memory is produced and committed, and introduce MemForm, a controlled diagnostic benchmark covering five interfaces: Content, Evidence, Scope, Selection, and Path Poisoning. We introduce Selection and Path Poisoning as controlled intervention categories that isolate retention and consolidation order effects, respectively. Each category pairs clean and poisoned conditions with interface-specific controls. Evaluations across six LLMs and two response formats reveal broad susceptibility at all five interfaces under the evaluated memory protocols and implementations. Crucially, authentic experiences with successful outcomes do not guarantee reliable behavior after memory formation: changes to contextual support, retention, or consolidation order can induce undesirable downstream behavior. In particular, consolidation order can alter behavior even with identical retained experiences, depending on the memory formation procedure. Additional analyses show that interface applicability depends on memory architecture and that Path Poisoning susceptibility depends on the updater. The evaluated defenses provide incomplete mitigation that varies by interface. These findings motivate protecting both what is committed to persistent memory and how memory is formed from experiences. Code and data are available at https://github.com/opanhw/memform-code.
background contribution method result interpretation main claim
| # | sentence | role | the authors' own work | states the main conclusion | strength |
|---|---|---|---|---|---|
| s0 | Long-term memory enables LLM agents to learn from past interactions but exposes memory formation to adversarial influence. | background 1.00 | 0.06 | 0.04 | asserted 1.00 |
| s1 | Existing studies primarily organize memory poisoning by attack channels, corruption patterns, or lifecycle stages, leaving formation interfaces insufficiently characterized. | gap 1.00 | 0.07 | 0.03 | asserted 1.00 |
| s2 | We formulate Memory Formation Poisoning as adversarial manipulation of the interfaces through which persistent agent memory is produced and committed, and introduce MemForm, a controlled diagnostic benchmark covering five interfaces: Content, Evidence, Scope, Selection, and Path Poisoning. | contribution 1.00 | 0.96 | 0.09 | asserted 1.00 |
| s3 | We introduce Selection and Path Poisoning as controlled intervention categories that isolate retention and consolidation order effects, respectively. | method 0.52 | 0.92 | 0.05 | asserted 1.00 |
| s4 | Each category pairs clean and poisoned conditions with interface-specific controls. | method 0.98 | 0.83 | 0.03 | asserted 0.99 |
| s5 | Evaluations across six LLMs and two response formats reveal broad susceptibility at all five interfaces under the evaluated memory protocols and implementations. | result 1.00 | 0.96 | 0.32 | asserted 1.00 |
| s6 | Crucially, authentic experiences with successful outcomes do not guarantee reliable behavior after memory formation: changes to contextual support, retention, or consolidation order can induce undesirable downstream behavior. | interpretation 0.66 | 0.88 | 0.54 | asserted 0.95 |
| s7 | In particular, consolidation order can alter behavior even with identical retained experiences, depending on the memory formation procedure. | result 0.90 | 0.87 | 0.15 | asserted 0.75 |
| s8 | Additional analyses show that interface applicability depends on memory architecture and that Path Poisoning susceptibility depends on the updater. | result 0.98 | 0.94 | 0.05 | asserted 1.00 |
| s9 | The evaluated defenses provide incomplete mitigation that varies by interface. | result 0.99 | 0.88 | 0.08 | asserted 1.00 |
| s10 | These findings motivate protecting both what is committed to persistent memory and how memory is formed from experiences. | interpretation 0.82 | 0.46 | 0.62 | asserted 0.67 |
| s11 | Code and data are available at https://github.com/opanhw/memform-code. | contribution 0.85 | 0.41 | 0.02 | asserted 0.94 |
What was examined, and what was not
- arXiv listing abstract v1
- full text
- figures and tables
- references and citing sentences
- relations to other papers
- P abstract
- S sections
- T body sentences
- C citations
- R cross-paper relations
The paper
Original abstract
Long-term memory enables LLM agents to learn from past interactions but exposes memory formation to adversarial influence. Existing studies primarily organize memory poisoning by attack channels, corruption patterns, or lifecycle stages, leaving formation interfaces insufficiently characterized. We formulate Memory Formation Poisoning as adversarial manipulation of the interfaces through which persistent agent memory is produced and committed, and introduce MemForm, a controlled diagnostic benchmark covering five interfaces: Content, Evidence, Scope, Selection, and Path Poisoning. We introduce Selection and Path Poisoning as controlled intervention categories that isolate retention and consolidation order effects, respectively. Each category pairs clean and poisoned conditions with interface-specific controls. Evaluations across six LLMs and two response formats reveal broad susceptibility at all five interfaces under the evaluated memory protocols and implementations. Crucially, authentic experiences with successful outcomes do not guarantee reliable behavior after memory formation: changes to contextual support, retention, or consolidation order can induce undesirable downstream behavior. In particular, consolidation order can alter behavior even with identical retained experiences, depending on the memory formation procedure. Additional analyses show that interface applicability depends on memory architecture and that Path Poisoning susceptibility depends on the updater. The evaluated defenses provide incomplete mitigation that varies by interface. These findings motivate protecting both what is committed to persistent memory and how memory is formed from experiences. Code and data are available at https://github.com/opanhw/memform-code.
Human review
Discussion
Know something about this paper? Leave a comment, or highlight any passage above to comment on it.