arXiv 论文提出 Role Grounding Attack：经社交互动篡改智能体记忆的偏好归属
Is it my preference? Role Grounding Attack against Agent's Memory via Social Interaction
AI 导读
论文首次形式化 Role Grounding Attack（RGA），利用嵌套对话结构让受害智能体把攻击者的偏好错误记作用户偏好，并在检索时持续影响决策。作者将 RGA 实例化为工具选择操纵和隐私泄露两类攻击，在 5 个主流记忆系统和 6 个语言模型上均取得高攻击成功率，呼吁加强角色 grounding。
推荐理由
论文形式化了智能体记忆系统中的角色归因漏洞，并给出攻击在多个记忆系统与模型上的成功率，可帮助开发者评估自身记忆设计的风险。
正文 · 原文
Abstract:LLM-based agents now share experiences on social platforms and remember new preferences to enhance their performance. However, existing memory systems contain a vulnerability in role-to-principal attribution that attackers can exploit. We identify Role Grounding Misattribution, in which an attacker-designed interaction causes the victim agent to incorrectly record a preference from the attacker as a preference of the victim's user. Specifically, we are the first to formalize Role Grounding Attack (RGA), an attack model that exploits this vulnerability through nested conversation structures. In the memory formation stage, an experience-sharing post quoting a conversation between the attacker agent and its user is published, which explicitly identifies its publisher. The inner conversation expresses preferences from the user of the attacker agent. When the victim agent remembers preferences from this nested structure, its memory loses the context binding and grounds the attacker's preference to the victim's user instead. In the memory retrieval stage, the misattributed preference persists and influences the victim agent's decisions when it encounters relevant scenarios. We instantiate RGA as tool selection manipulation and privacy leakage. Tool selection manipulation causes a tool-call preference to be misattributed to the victim's user, steering the victim toward an attacker-controlled tool. Privacy leakage extends this by misattributing both a tool-call preference and a task-requirement preference to the victim's user. The victim selects the attacker's tool, then includes sensitive information in tool arguments to satisfy the task requirement. We evaluate RGA across five mainstream memory systems and six language models. Tool manipulation and privacy leakage both achieve high attack success rates. These results call for stronger role grounding.
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Multiagent Systems (cs.MA) |
| Cite as: | arXiv:2610.38209 [cs.CR] |
| (or arXiv:2610.38209v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.38209 arXiv-issued DOI via DataCite |
Submission history
From: Haoran Bu [view email]
[v1]
Wed, 28 Oct 2026 03:03:29 UTC (2,722 KB)
来源：arXiv cs.AI · arxiv.org