---
title: "代理记忆中毒检测：基于取证轨迹签名的行为不变性方法"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2606.30566v1"
permalink: "https://feed.astralor.com/items/itm_097ce50a0f211248bf4d8500"
published: "2026-06-29T17:09:03.000Z"
score: 58
channel: "ai"
tags: ["GPT-4.1","GPT-4o","代理安全","检测方法","行为不变性","记忆中毒攻击"]
---

# 代理记忆中毒检测：基于取证轨迹签名的行为不变性方法

## 速览

该论文发现LLM代理在持久性记忆中毒攻击下存在行为不变性：成功攻击必须调用memory_recall_fact再调用email_send_email，而非渗出会话极少有此顺序。基于此规则的检测方法AUC达0.9563，随机森林在19个轨迹特征上AUC提升至0.9904。跨9个模型（7B-120B参数）验证，6/9分割AUC=1.000，且对前沿模型（GPT-4.1、GPT-4o）无需重训练即可泛化。仅使用前缀的变体AUC=0.934，可实现实时阻断。提示注入攻击产生不同轨迹（得分0.541），可区分攻击类型。

## 关键点

- 发现LLM代理在记忆中毒攻击下的行为不变性：内存读取调用必须在邮件发送之前。
- 基于此不变性的简单规则检测AUC=0.9563，随机森林模型AUC=0.9904。
- 跨9个模型验证，6/9分割AUC=1.000，对GPT-4.1/4o无需重训练泛化。
- 前缀检测变体AUC=0.934，可实现实时阻断；提示注入攻击轨迹不同（得分0.541），可区分攻击类型。

## 全文

We discover a behavioral invariant in LLM agents under persistent memory poisoning: in architectures where routing information is retrieved through observable memory-tool invocations, successful attacks require calling memory_recall_fact before email_send_email, a transition that non-exfiltrating sessions rarely exhibit. Under the evaluated architecture, this invariant follows from the attack's information-retrieval dependency rather than being merely an empirical correlation, and suppressing it breaks the attack. A simple rule exploiting this invariant alone achieves AUC = 0.9563. A Random Forest classifier over 19 trajectory features refines it to AUC = 0.9904 (BCa 95% CI [0.987, 0.993], N=10,000 resamples), demonstrating that the attack imprints on multiple independent behavioral channels. The signature is overdetermined: removing all recall-related features (half the feature set) leaves AUC unchanged at 0.990, confirming that memory poisoning induces a distributed trajectory signature rather than a single observable anomaly. Cross-model hold-out on 9 models (7B-120B parameters) confirms AUC = 1.000 on 6/9 hold-out splits, with all three exceptions mechanistically explained. The invariant generalizes to frontier models (GPT-4.1, GPT-4o) without retraining. A strictly prefix-only variant achieves AUC = 0.934, suggesting that real-time blocking is feasible with moderate degradation. The boundary is forensically useful: prompt-injection attacks that bypass memory produce a distinct trajectory (score = 0.541), enabling incident responders to distinguish memory-channel attacks from prompt-injection attacks using tool-call logs alone.

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_097ce50a0f211248bf4d8500