Agent memory poisoning moves past stored content: which experiences are kept, and in what order they merge, can flip decisions

The risk surface of an agent's long-term memory extends from what gets written to how memory is formed. Earlier memory-poisoning studies organized attacks by channel, corruption pattern, or lifecycle stage, leaving the formation stage's interfaces uncharacterized. Prior evaluations grouped interventions by attack mechanism or lifecycle, without a shared protocol for paired comparison across multiple formation interfaces. MemForm pairs a clean and a poisoned condition per interface while holding non-target factors fixed, and evaluates six LLMs, two response formats, and two implementations of a shared memory protocol.

Memory formation is split into five interfaces: Content, Evidence, Scope, Selection, and Path. Content poisoning specifies what is committed to persistent memory; Evidence poisoning substitutes fabricated records for authentic ones; Scope poisoning keeps records authentic but changes contextual support; Selection poisoning swaps which experiences are retained from a fixed pool; Path poisoning changes consolidation order while the experience multiset and updater stay fixed. Selection and Path poisoning had not been proposed as separate controlled categories isolating retention and consolidation-order effects. The benchmark generated 300 semantic families, retained 235 after validation, compiled 1,016 paired cases, and instantiated 994 multiple-choice and 897 free-form format instances, 1,891 in total.

Even authentic experiences with successful outcomes can induce undesirable downstream behavior when contextual support, the retained subset, or consolidation order changes. Reliability was previously judged mainly by whether an individual experience was valid, yet the same experience set yields different decisions under different consolidation orders. On DeepSeek-V4-Flash and Claude-Sonnet-5, Scope poisoning preserved reference behavior on 99.4% and 100.0% of in-scope queries but only 26.7% and 52.0% of out-of-scope queries; under Path poisoning, random orders preserved reference behavior for 77.5% and 83.5% of cases while the designed order reduced these to 42.1% and 62.4%.

The benchmark is a controlled diagnostic: it measures behavioral susceptibility under specified formation interventions, not the cost or end-to-end success rate of attacks in deployed systems. Evaluation covers six LLMs, multiple-choice and free-form response formats, two implementations of a policy-based memory protocol in LangChain and LlamaIndex, and an additional retrieval-only episodic architecture. The intended readers are researchers and engineers working on agent memory security and memory mechanisms.

Results reflect the specified construction constraints and each model's own eligible subsets rather than an inherent vulnerability ranking. The two primary implementations share one policy-based memory protocol, limiting generalization to architectures with substantially different memory operations. Path poisoning is updater-dependent; batch replay nearly eliminates it under the evaluated short-history setting, but scalability and utility trade-offs under longer histories remain unexamined. The timing-based Selection and Path realizations assume a fixed event pool and do not evaluate the cost or success rate of inducing those experiences from scratch.