MemoryDojo: Benchmarking Poisoning Through LLM Agent Memory

The source is a short arXiv abstract, so the article will use only those facts—no invented install commands, prices, or benchmark deltas.David H. Yang, Blake Bullwinkel, Amanda Minnich, Mohammad Mohammadi Amiri, and Giorgio Severi introduce MemoryDojo, a benchmark for poisoning that moves through the memory of an LLM agent.

The work is in arxiv.org's report, submitted on 6 Nov 2026 as arXiv:2611.09721 in Computer Science, under Cryptography and Security (cs.CR), with Artificial Intelligence (cs.AI) and Computation and Language (cs.CL). The title is MemoryDojo: Benchmarking Poisoning Through LLM Agent Memory.

This article is for engineers who build LLM agents for long-horizon, multi-session tasks, and for researchers who study agentic memory risk. It covers how a malicious instruction can be stored, propagated through memory, and retrieved for action in a later session. It also covers the 155 trajectories, four domains, and five memory systems, the finding that all of those systems are susceptible, and the memory-aware optimization that increases poisoning efficacy.

01Malicious instructions in later sessions

LLM agents benefit from memory systems on tasks that run for a long horizon and continue across sessions. Those systems improve performance by keeping information available for the sessions that follow. The authors identify that store as a critical attack surface, because a malicious instruction can be written into memory and carried into a later session.

An instruction encountered in one session may be stored and then propagated through memory. In a later session it may be retrieved and acted upon. MemoryDojo is built to trace that lifecycle and to measure the influence of the poisoned information on the agent's subsequent behavior.

Memory systems differ in how they process information and in how they retrieve it. The downstream effects of poisoning can therefore vary significantly across systems. The benchmark quantifies that variation across the five memory systems it supports, on its multi-session, long-horizon trajectories.

02155 trajectories and five systems

MemoryDojo traces the lifecycle of poisoned information through agent memory and measures the influence of that information on subsequent agent behavior. The authors describe the benchmark as easily extensible. They use it to quantify how poisoning differs across memory architectures.

The corpus consists of 155 multi-session long-horizon trajectories covering four domains. Five different memory systems are supported on that corpus. Because each trajectory spans sessions, an instruction stored in an earlier session can be measured by the agent's behavior after memory is retrieved later.

The record also phrases the byline as David H. Yang and four other authors. The submission history names David Hong Yang as the sender of the v1 upload dated 6 Nov 2026.

The record also phrases the byline as David H. Yang and four other authors. The submission history names David Hong Yang as the sender of the v1 upload dated 6 Nov 2026.

03Susceptibility across memory architectures

The evaluation finds that all memory systems are susceptible to memory poisoning. That result covers the five memory systems the benchmark supports. It is drawn from the 155 multi-session long-horizon trajectories spanning four domains, so the poison is observed across sessions of a long task.

Downstream effects vary substantially from one memory architecture to another. The authors tie that spread to the way each system processes and retrieves information. An instruction that is stored, propagated, and later retrieved can change subsequent agent behavior differently in each architecture.

04Memory-aware poison optimization

The authors propose a process that optimizes a poison with the memory system taken into account. They report that this memory-aware process increases the poisoning efficacy. Alongside that increase, the evaluation still reports that every supported memory system is susceptible, with substantial variation in downstream effects.

The process highlights differences between memory architectures. Those differences sit in how each system processes and retrieves what it stored, and in the influence that retrieved information has on later behavior. The comparison uses the benchmark's 155 multi-session trajectories, four domains, and five memory systems.

05Friday submission of version v1

David Hong Yang is the name on the submission history for the first uploaded version. The timestamp is Friday, 6 Nov 2026, 17:00:09 UTC, and the file size on that upload is 418 KB. The version tag is v1, cited with the primary subject Cryptography and Security.

arXiv:2611.09721v1 [cs.CR]

That string cites this version. The record also prints a version-independent citation that keeps the same arXiv identifier and the cs.CR subject. The paper's subjects are Cryptography and Security (cs.CR), Artificial Intelligence (cs.AI), and Computation and Language (cs.CL), and the browse context shown for the record is cs.CR.

arXiv:2611.09721 [cs.CR]

The DOI is 10.48550/arXiv.2611.09721, an arXiv-issued DOI via DataCite with registration pending. The full text is offered as a PDF, as experimental HTML, and as TeX source, and the record lists an audio summary. The authors write: "We hope that MemoryDojo will support research on understanding and mitigating agentic memory risks."

10.48550/arXiv.2611.09721