PipePoison treats memory poisoning as one end-to-end optimization and gains 19.1 points over stage-by-stage attacks

arXiv·high signalXBlueskyLinkedInCopy link

Indirect memory poisoning has to survive writing, retrieval, and utilization, and existing attacks optimize each stage in isolation so gains in one stage get erased by upstream transformations in another. PipePoison collects fine-grained stage feedback from local shadow systems, uses chain-structured losses to find the stage that actually bottlenecks end-to-end success, and applies stability-calibrated weights for transferability. Across three agent frameworks and four memory mechanisms it improves attack utilization rate by 19.1 percentage points, which matters for anyone giving an agent persistent memory fed by web or document content.