---
title: "MemSecBench：追踪智能体内存投毒从持久化到后果与修复的全生命周期基准"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2607.27080v1"
permalink: "https://feed.astralor.com/items/itm_35edba9d136778a467f9cbd6"
published: "2026-07-29T16:06:54.000Z"
score: 81
channel: "ai"
tags: ["LLM Agent","MemSecBench","内存投毒","智能体内存安全","生命周期安全"]
---

# MemSecBench：追踪智能体内存投毒从持久化到后果与修复的全生命周期基准

## AI 点评

> 这篇论文值得每一位关注 AI Agent 安全的从业者仔细阅读。它不止是又一个基准，而是首次把内存投毒的完整链条——从写入、持久化、执行到修复——放在一个统一框架里量化比较。如果你在构建生产级 Agent 系统，这篇文章会直接告诉你不同内存后端的风险差异，以及为什么「选择性修复」可能比想象中困难得多。

## 速览

MemSecBench 是一个面向智能体（Agent）内存系统安全性的任务驱动基准，覆盖代码、科学、日常生活和办公等 48 个真实场景中的 310 个案例。每个案例遵循受控的“写入-执行-遗忘”协议，在隔离运行时中评估恶意指令在内存中的持久化、下游执行后果及选择性修复能力。实验在 2 种智能体框架、4 种内存后端和 3 种 LLM 后端组成的 24 种配置矩阵上进行，结果发现恶意内存平均在 84.2% 的配置中持久存在，完整攻击链成功率 50.3%，而在中毒成功案例中选择性修复率可达 56.1%。不同内存系统栈在生命周期安全上存在显著差异。

## 关键点

- MemSecBench 包含 310 个案例，覆盖代码、科学、日常生活和办公 4 类场景。
- 实验在 2 种智能体框架 × 4 种内存后端 × 3 种 LLM 后端共 24 种配置下进行。
- 恶意内存持久化率达 84.2%，完整攻击链成功率 50.3%。
- 成功中毒案例中，选择性修复率 56.1%，不同内存系统栈间差异显著（攻击成功率最大差 16.1 个百分点，修复率差 41.3 个百分点）。

## 全文

Memory systems allow agents to retain and reuse information from past interactions, but they can also let malicious content persist. A malicious instruction crafted by an attacker may be stored in long-term memory, recalled much later, and quietly shape a real action. Recent benchmarks increasingly examine agent memory security, yet few trace the same malicious semantics across persistence, downstream consequences, and selective repair under diverse memory-backend comparisons. To address this gap, we introduce MemSecBench, a task-grounded benchmark for the lifecycle security of agent memory systems. It contains 310 cases drawn from 48 realistic contexts across code and science, daily life, and office work. Each case follows a controlled Write--Execute--Forget protocol in an isolated runtime under an exact agent configuration, defined by an agent harness, a memory backend, and an LLM backend. Evidence-based adjudication combines a deterministic write check, checkpoint-specific judge-model evaluations, and programmatic gates across seven lifecycle checkpoints. The experimental design spans a 24-configuration matrix of two agent harnesses, four memory backends, and three LLM backends. Across all 24 configurations, malicious memory persists in 84.2% of all cases, and the full Write--Execute chain succeeds in 50.3%. Among successfully poisoned cases, 59.6% complete the full Execute chain, while 56.1% achieve selective repair.Compared with matched Native configurations, the largest absolute differences are 16.1 percentage points for end-to-end attack success and 41.3 percentage points for selective repair. These descriptive contrasts indicate that the evaluated memory system stacks differ in lifecycle security, both in the propagation of malicious memory and in selective repair after successful memory poisoning.

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_35edba9d136778a467f9cbd6