arXiv 论文提出 EAL-Bench，测得 LLM 智能体记忆可造出 45.4% 假授权且执行器 99.0% 会照做
Agent Memory Is a Surface for Endogenous Authorization Laundering
AI 导读
论文提出内源性授权洗白概念并发布 EAL-Bench，测量持久记忆保存演化授权状态的准确性。七款 LLM 作记忆写入器、两款作执行器，在采购、网络安全和金融任务中，增量类型化记忆更新使写入器为最高 45.4% 的未授权请求造出假授权，假授权出现后执行器在 99.0% 的试验中照做；记忆级防护能减少洗白但会拒绝合法动作，存在安全与效用权衡。
正文 · 原文
Abstract:Long-running LLM agents rely on persistent memory to preserve not only task context but also the permissions and restrictions governing their actions. When memory misrepresents this evolving authorization state, the agent's own records can make unauthorized actions appear permitted, resulting in misaligned behavior without any external attacks.
We term this failure endogenous authorization laundering, where memory creates or retains false authority through semantic misinterpretation or failed updates, and executors act on that authority. We then introduce EAL-Bench to measure how accurately persistent memory preserves evolving authorization state and whether memory errors propagate to unauthorized actions.
We evaluate seven LLMs as memory writers and two as executors across procurement, cybersecurity, and finance tasks. Under incremental typed-memory updates, writers create false authority for up to 45.4% of unauthorized requests, and once false authority is present, executors act on it in 99.0% of trials. Memory-level safeguards reduce laundering but can reject legitimate actions, exposing a safety-utility tradeoff. Persistent memory is therefore part of an LLM agent's effective authorization policy, not merely a performance component.
| Comments: | Accepted at the NeurIPS 2026 PALM Workshop (Personalized, Aligned, Long-Term Memory for AI Systems). Revised camera-ready version with expanded experiments, analyses, and appendices. 51 pages, 10 figures |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2609.01836 [cs.CR] |
| (or arXiv:2609.01836v2 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2609.01836 arXiv-issued DOI via DataCite |
Submission history
From: Tommaso Cerruti [view email]
[v1]
Tue, 1 Sep 2026 20:12:08 UTC (2,098 KB)
[v2]
Sat, 24 Oct 2026 12:57:58 UTC (2,391 KB)
来源：arXiv cs.AI · arxiv.org