Injection-Execution Dissociation: A Mechanistic Evaluation of Persistent Memory Attacks and Defenses in Stateful LLM Agents

2026/05/31 by Jun Wen Leong
Computer Science · #cs.CR #cs.AI #cs.LG

paper · pdf

v4: Added double dissociation (reasoning-mode ablation), content-layer defense (RATG), loaded-corpus frontier evaluation (21 models, 3 providers, N=40), 7B judge capability bound, reproducibility validity criterion, ethics/disclosure statement. Gemini 3.1 Pro Preview 95% ASR; GPT-5.1 regression (22.5%); tripartite vendor divergence. Code: github.com/junwenleong/stateful-agent-security-eval

arxiv created 2026/08/04 · arxiv updated 2026/08/05

Abstract

We discover that prompt-injection success and tool-execution success are separable safety properties: defenses that block injection do not necessarily block execution, and vice versa. We call this the injection-execution dissociation. In LLM agents with persistent memory, malicious instructions are stored at rates exceeding 97.5%, yet downstream execution ranges from 0% to 95% with no correlation to storage rate. This reframes the threat model: preventing storage alone is insufficient, and blocking execution requires structurally enforcing authority boundaries between memory ingestion and action execution. We substantiate this through a 5,040-run factorial experiment across nine open-source models (N=40 per condition), evaluating six defenses at four architectural layers against delayed-trigger attacks that persist across session boundaries via RAG retrieval. Defense effectiveness is governed by where a defense sits relative to the attack's authority boundary, not by classifier quality. Only Memory Sandbox -- a tool-layer defense that structurally isolates recalled memory from executable context -- reduces attack success to 0% for eight of nine models. A reasoning-mode ablation reveals a double dissociation: no single schema-layer intervention is safe across both reasoning and non-reasoning model classes. A loaded-corpus frontier evaluation (21 models, 3 providers; N=40 base, headline models topped up to N=172) reveals vendor-correlated patterns: Anthropic blocks predominantly at injection, OpenAI blocks at execution with variable generational hardening, and a pre-release Gemini endpoint exfiltrates in the majority of runs. Stored-but-dormant payloads constitute a compositional supply-chain risk in shared-memory deployments.

Citations

• Forensic Trajectory Signatures for Agent Memory Poisoning Detection
• What If Prompt Injection Never Left? Rethinking Agent Security through Cross-Session Stored Prompt Injection
• Hidden in Memory: Sleeper Memory Poisoning in LLM Agents
• Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injections
• MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval
• Memory Injection Attacks on LLM Agents via Query-Only Interaction
• Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents
• ShieldGemma: Generative AI Content Moderation Based on Gemma
• AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents
• Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training
• Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations
• Formalizing and Benchmarking Prompt Injection Attacks and Defenses
• Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection

Cited by

• Online Shift Detection and Conformal Adaptation for Deployed Safety Classifiers