Large language models are increasingly augmented with persistent memory, allowing assistants to store user-specific information across sessions for personalization and continuity. This statefulness introduces a new security risk: adversarial content can corrupt what an assistant remembers and thereby influence future interactions. We propose and study sleeper memory poisoning, a delayed attack in which an adversary manipulates external context, such as a document, webpage, or repository, to cause the assistant to store a fabricated memory about the user. Unlike conventional prompt injection, the attack can remain dormant and re-emerge across multiple later conversations. We evaluate the full attack pipeline: whether poisoned memories are written, later retrieved, and ultimately used to steer the following conversations. Across stateful LLM assistants, poisoned memories were added up to 99.8% on GPT-5.5 and 95% on Kimi-K2.6. Crucially, among successful retrievals, poisoned memories cause attacker-intended agentic actions in 60-89% of evaluations across models. These results show that persistent memory can act as a long-term attack surface across multiple future conversations.

翻译：大语言模型日益配备持久化记忆功能，使得助手能够跨会话存储用户特定信息，以实现个性化和连续性。这种有状态特性引入了一种新的安全风险：对抗性内容可篡改助手的记忆内容，从而影响未来交互。我们提出并研究了休眠记忆投毒攻击，这是一种延迟性攻击：攻击者操纵外部上下文（如文档、网页或代码仓库），诱使助手存储关于用户的虚构记忆。与常规提示注入不同，该攻击可保持潜伏状态，并在后续多次对话中重新浮现。我们评估了完整的攻击链路：被投毒的记忆是否被写入、后续是否被检索、以及最终是否被用于引导后续对话。在多种有状态大语言模型助手上，GPT-5.5的记忆投毒成功率高达99.8%，Kimi-K2.6则达95%。尤为关键的是，在成功检索的案例中，被投毒记忆导致模型执行攻击者预设的自主行为，各模型成功率介于60%-89%。这些结果表明，持久化记忆可成为横跨多次未来对话的长期攻击面。