Is This My Preference? Role Grounding Attacks on Agent Memory in Social Interaction
Is it my preference? Role Grounding Attack against Agent's Memory via Social Interaction
Quick read
Based on the paper's full text (AI-generated); refer to the original
Researchers from Beijing University of Posts and Telecommunications propose the Role Grounding Attack (RGA), which exploits a flaw in agent memory systems regarding role attribution, causing the victim agent to record the attacker user's preferences as its own user's preferences. The attack is carried out via an ordinary experience-sharing post; the post quotes a conversation between the attacker and its user, and when the victim agent writes to memory it retains the relative role user but loses the object it is bound to, and does not fabricate content, with the poster's identity truthfully labeled. Attack instances are tool selection manipulation and privacy leakage; the latter layers on task-requirement preferences to induce sensitive information into tool parameters passed to an attacker-controlled tool. Across five memory systems (A-MEM, Mem0, Hindsight, MemOS, LangMem) and six models in the DeepSeek-V4, Qwen3.8, and GPT-5.6 series, the average attack success rate for tool manipulation is 92.37% and for privacy leakage 69.57%; the attack posts were all judged benign in GPT-5.6-Luna safety review.
- LLM-based agents share experiences on social platforms and persistently memorize preferences, but existing memory systems have a vulnerability in role-to-principal grounding: preferences in nested dialogues may be incorrectly recorded under the victim user's name, and then used to manipulate tool selection or steal privacy.
- The authors formalize the Role Grounding Attack (RGA): first, Publisher-Preference Decoupling binds the preference to the publisher's owner role rather than to the publisher itself; then, a nested dialogue construction (quoting a user/assistant conversation) is used as packaging, causing the victim agent to lose the context binding during memory formation and misattribute the attacker user's preference to its own user.
- Evaluated on 5 memory systems (A-MEM, Mem0, Hindsight, MemOS, LangMem) and 6 language models: tool-selection manipulation achieves an average attack success rate of about 92.37%, and privacy leakage about 69.57%; in a multi-attacker competitive setting, the average is about 78.41%. In the memory formation stage, most attack payloads are directly misattributed (Mem0 78.1%, A-MEM 75.7%, Hindsight 99.0%), and they are harder for safety review to detect than Hidden in Memory.
- The authors propose role-attribution reminders based on platform metadata as a defense, which can reduce ASRsel by an average of about 61.96 percentage points, but explicit attribution prompts alone cannot fully protect all memory systems; the material does not give other limitations or future directions.
The attack neither fabricates content nor impersonates the publisher; five mainstream memory systems are all affected, and teams working on agent memory can use this to check whether role attribution binding is preserved.