---
title: "你的智能体记忆并不属于它自己：针对LLM智能体记忆的伪造推理攻击与防御"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2607.05029v1"
permalink: "https://feed.astralor.com/items/itm_f0f161a88c25f24fb4846fc0"
published: "2026-07-06T13:10:13.000Z"
score: 81
channel: "ai"
tags: ["FARMA攻击","LLM智能体安全","SENTINEL","推理守卫"]
---

# 你的智能体记忆并不属于它自己：针对LLM智能体记忆的伪造推理攻击与防御

## AI 点评

> 这篇论文让我意识到，我们不仅要关注AI智能体数据投毒，更要警惕更隐蔽的“推理记忆污染”。对AI安全研究人员、LLM应用开发者尤为重要，它提醒我们记忆系统的每一层都可能成为突破口。

## 速览

本文介绍了一种针对LLM智能体持久记忆的新型攻击FARMA，通过植入伪造推理痕迹（而非事实知识）来操纵智能体行为，并采用自指强化机制规避共识防御。为此提出的防御框架SENTINEL包含推理守卫组件，通过五种加权信号检测伪造推理条目。实验表明FARMA在基线条件下攻击成功率高达100%，而SENTINEL将其降至0%且无假阳性。该研究强调了保护智能体推理历史完整性的重要性。

## 关键点

- FARMA攻击专注于污染智能体的推理历史而非事实知识
- 采用规避关键字和自指强化手段绕过现有防御
- SENTINEL防御框架通过推理守卫实现结构化检测
- 实验证明SENTINEL将攻击成功率降至0%且无假阳性

## 全文

Persistent memory has enabled large language model (LLM) agents to store factual knowledge, prior decisions, reasoning histories, tool usage information, and context. While this has improved the agent's functionality and continuity across tasks, it has also introduced a new attack surface: the agent's own reasoning history. In this paper, we introduce the Forged Amplifying Rationale Memory Attack (FARMA), which poisons an agent's remembered reasoning rather than its factual knowledge. It inserts forged reasoning traces using evasive language that bypasses keyword-based defenses, then amplifies them through self-referential reinforcement that defeats consensus-based defenses. To address FARMA, we introduce SENTINEL, a layered defense pipeline to detect forged reasoning entries. Its central component is the Reasoning Guard that structurally analyzes candidate entries for forgery using five weighted signals. We evaluate FARMA and SENTINEL across multiple agents and different LLM models with 50 trials and show that FARMA achieves an attack success rate of up to 100% under baseline conditions and is capable of defeating defense mechanisms like keyword filter and A-MemGuard. Our evaluation also shows that SENTINEL reduces FARMA's attack success rate to as low as 0% with no false positives observed across 326 benign agent traces. Our work demonstrates the need to protect not only an agent's retrieved content but also the integrity of its reasoning history.

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_f0f161a88c25f24fb4846fc0