Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents

arXiv:2607.23444 · cs.CR · Submitted 2026-07-26 · Read on arXiv

Xinyu Gao, Wenyu Chen, Xiangtao Meng, Li Wang, Chuanchao Zang, Jianing Wang, Zheng Li, Shanqing Guo

cs.CR

Submitted: 2026-07-26

Code: https://github.com/snap-research/LoCoMo

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• RAG — 23× in this paper · explained in 3 episodes
• Long-Term Memory — 12× in this paper
• Short-Term Memory — 8× in this paper
• Embeddings — 7× in this paper · explained in 2 episodes
• Record Extraction Rate — 6× in this paper
• Ablation — 5× in this paper · explained in 1 episode
• Agent Memory — 5× in this paper · explained in 1 episode
• Adaptation — 4× in this paper · explained in 1 episode
• Fidelity — 4× in this paper · explained in 2 episodes
• Steering — 4× in this paper · explained in 2 episodes
• Ablation Studies — 3× in this paper · explained in 1 episode
• Core — 3× in this paper · explained in 2 episodes
• Decoupling — 3× in this paper · explained in 2 episodes
• Semantic Similarity — 3× in this paper · explained in 2 episodes
• Adversarial Context — 2× in this paper · explained in 1 episode
• Agent Architectures — 2× in this paper · explained in 1 episode
• Benchmark — 2× in this paper · explained in 2 episodes
• Benchmarking — 2× in this paper · explained in 4 episodes
• Ablation study — 1× in this paper · explained in 1 episode
• Adaptive Strategy — 1× in this paper · explained in 1 episode
• Adversarial Attacks — 1× in this paper · explained in 1 episode
• Aggregation — 1× in this paper · explained in 1 episode
• Clustering — 1× in this paper · explained in 2 episodes
• Foundation Model — 1× in this paper · explained in 3 episodes
• Foundation Models — 1× in this paper · explained in 7 episodes
• Redundancy — 1× in this paper · explained in 2 episodes
• State Management — 1× in this paper · explained in 3 episodes

Sources

• Conversational Health Agents: A Personalized LLM-Powered Agent Framework
• Feedback-Guided Extraction of Knowledge Base from Retrieval-Augmented LLM Applications
• A Survey on Evaluation of Large Language Models
• Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection
• Personal LLM Agents: Insights and Survey about the Capability, Efficiency and Security
• Follow My Instruction and Spill the Beans: Scalable Data Extraction from Retrieval-Augmented Generation Systems
• DeepSeek-V2: A Strong, Economical, and Efficient Mixture-of-Experts Language Model
• Evaluating Very Long-Term Conversational Memory of LLM Agents
• EHRAgent: Code Empowers Large Language Models for Few-shot Complex Tabular Reasoning on Electronic Health Records
• Gemini: A Family of Highly Capable Multimodal Models
• BEIR: A Heterogenous Benchmark for Zero-shot Evaluation of Information Retrieval Models
• SCM: Enhancing Large Language Model with Self-Controlled Memory Framework
• FinMem: A Performance-Enhanced LLM Trading Agent with Layered Memory and Character Design
• Unveiling Privacy Risks in LLM Agent Memory
• The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)
• Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents
• Text Embeddings by Weakly-Supervised Contrastive Pre-training
• Towards Ethical Personal AI Applications: Practical Considerations for AI Assistants with Long-Term Memory
• Silent Leaks: Implicit Knowledge Extraction Attack on RAG Systems through Benign Queries
• TradingAgents: Multi-Agents LLM Financial Trading Framework

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs