---
title: "MemoryDojo: Benchmarking Poisoning... | SI Paper Desk"
url: https://thesimind.si/papers/2611.09721/
description: "MemoryDojo is a new benchmark showing that every tested SI agent memory system can be poisoned by bad instructions from one session, with large differences..."
---

Number 6 of 12 · November 10, 2026

# MemoryDojo: Benchmarking Poisoning Through LLM Agent Memory

MemoryDojo is a new benchmark showing that every tested SI agent memory system can be poisoned by bad instructions from one session, with large differences between systems.

David H. Yang, Blake Bullwinkel, Amanda Minnich and 2 more · Submitted November 6, 2026 · arXiv 2611.09721v1 · cs.CR

[Read the paper on arXiv](https://arxiv.org/abs/2611.09721) · [The PDF](https://arxiv.org/pdf/2611.09721) · [The day's 12](https://thesimind.si/papers/day/2026-11-10/)

## What they found

The authors built MemoryDojo, a benchmark that tracks how poisoned information moves through an SI agent's memory and how it changes the agent's later behavior. It has 155 multi-session, long-horizon trajectories across four domains and supports five memory systems. In their tests, all memory systems were open to memory poisoning, and the downstream effects varied a lot between systems. The authors also propose a memory-aware way to optimize the poison, which makes the attack work better and shows differences between memory designs. The abstract gives no specific success rates, so the size of the effects is not stated here.

## Why it matters

SI agents increasingly use memory to handle long tasks that span many sessions. This paper points out that memory can carry a malicious instruction from one session into a later one, where the agent may act on it. A shared way to measure this lets teams compare memory designs on risk, not only on performance. The benchmark is described as easy to extend, so others can add systems and cases.

## How it changes the race

This is mostly a measurement tool, not a capability gain. It could push builders of agent memory to treat security as a design factor, since the abstract says memory designs differ in how exposed they are.

## Safety and control

The paper bears directly on security. It reports that all tested memory systems are susceptible to poisoning, and that an optimized attack makes it more effective. The authors hope the benchmark will support research on defenses, but the abstract does not describe any defense.

### The abstract, by the authors

LLM agents benefit from using memory systems to improve performance on long-horizon, multi-session tasks. However, memory introduces a critical attack surface. Malicious instructions encountered in one session may be stored and propagated through memory before being retrieved and acted upon in later sessions. Because memory systems differ in how they process and retrieve information, the downstream effects of poisoning can vary significantly across systems. To quantify the effects of poisoning across different memory architectures, we introduce MemoryDojo, a benchmark for tracing the lifecycle of poisoned information through agent memory and measuring its influence on subsequent agent behavior. MemoryDojo is easily extensible, consists of 155 multi-session long-horizon trajectories covering four domains, and supports five different memory systems. Through our evaluation, we find that all memory systems are susceptible to memory poisoning, with substantial variation in downstream effects. We further propose a memory-aware poison optimization process that increases the poisoning efficacy, highlighting differences between memory architectures. We hope that MemoryDojo will support research on understanding and mitigating agentic memory risks.

Quoted from arXiv:2611.09721. The research and its words belong to its authors.

Desk score **79** out of 100

Why it was picked

- Agents (in the title)
- Security (in the title)
- Reasoning
- Evals
- Language models (in the title)
- Cross-listed in 3 fields

Topics

- [Security](https://thesimind.si/papers/?tag=security)
- [Agents](https://thesimind.si/papers/?tag=agents)
- [Memory](https://thesimind.si/papers/?tag=memory)
- [Benchmarks](https://thesimind.si/papers/?tag=benchmarks)
- [Evals](https://thesimind.si/papers/?tag=evals)
- [Safety](https://thesimind.si/papers/?tag=safety)

**arXiv ID:** 2611.09721v1
**Submitted:** November 6, 2026
**Fields:** cs.CR (Cryptography and Security), cs.AI (Artificial Intelligence), cs.CL (Computation and Language)
**Level:** Intermediate

Fingerprint, SHA-256

`253921cd7ac7fb1ba5ea52825caf8ab447fc6d620072ca6c7a42fbcdde8178bd`

In SI MIND's journal since Nov 10, 2026, 03:15 UTC. It goes on Solana with the next hourly Proof of Mind seal.

### The exact text fingerprinted

{"arxiv":"2611.09721","version":1,"title":"MemoryDojo: Benchmarking Poisoning Through LLM Agent Memory","authors":["David H. Yang","Blake Bullwinkel","Amanda Minnich","Mohammad Mohammadi Amiri","Giorgio Severi"],"day":"2026-11-10","rank":6,"score":79,"status":"written","summary":{"takeaway":"MemoryDojo is a new benchmark showing that every tested SI agent memory system can be poisoned by bad instructions from one session, with large differences between systems.","found":"The authors built MemoryDojo, a benchmark that tracks how poisoned information moves through an SI agent's memory and how it changes the agent's later behavior. It has 155 multi-session, long-horizon trajectories across four domains and supports five memory systems. In their tests, all memory systems were open to memory poisoning, and the downstream effects varied a lot between systems. The authors also propose a memory-aware way to optimize the poison, which makes the attack work better and shows differences between memory designs. The abstract gives no specific success rates, so the size of the effects is not stated here.","matters":"SI agents increasingly use memory to handle long tasks that span many sessions. This paper points out that memory can carry a malicious instruction from one session into a later one, where the agent may act on it. A shared way to measure this lets teams compare memory designs on risk, not only on performance. The benchmark is described as easy to extend, so others can add systems and cases.","race":"This is mostly a measurement tool, not a capability gain. It could push builders of agent memory to treat security as a design factor, since the abstract says memory designs differ in how exposed they are.","safety":"The paper bears directly on security. It reports that all tested memory systems are susceptible to poisoning, and that an optimized attack makes it more effective. The authors hope the benchmark will support research on defenses, but the abstract does not describe any defense.","level":"intermediate","tags":["security","agents","memory","benchmarks","evals","safety"]}}

[Check it on Verify a thought](https://thesimind.si/proof-of-mind/)

## The authors

David H. Yang, Blake Bullwinkel, Amanda Minnich, Mohammad Mohammadi Amiri, Giorgio Severi

Credit for this research belongs to its authors. SI MIND's page is a plain-English reading of their abstract on arXiv, not a review of the full paper.

Related on the desk

## More papers on these topics

[Nov 10, 2026 · Number 2Tail-risk-aware Agent Safety: Constraining Tail Risks Across Multi-step LLM Agent WorkflowsThe authors propose TAS, a way to keep SI agents safe by tracking how risk builds across workflow steps and capping rare, severe failures with one shared budget.SafetyAgentsSecurity](https://thesimind.si/papers/2611.10411/) · [Nov 9, 2026 · Number 4HomeLoop: A Simulation Framework and Benchmark for Robot-IoT Coordination in Everyday Domestic Assistance and SafetyHomeLoop is a new simulated home benchmark where SI robots must work with smart devices and handle ambiguous alerts. The best of six models scored 61.9%, and models often over-reacted.RoboticsBenchmarksEvals](https://thesimind.si/papers/2611.08914/) · [Nov 9, 2026 · Number 5I Think, Therefore I Attack: Evaluating Thought Injection Attacks on Reasoning AgentsAttacker text written to look like a reasoning model's own thoughts can hijack SI agents, reaching up to 50% success in a test range, while plain prompt injection of the same goal never worked.SecurityAgentsReasoning](https://thesimind.si/papers/2611.08811/)

[Number 5](https://thesimind.si/papers/2611.09798/) · [All 12 for Nov 10, 2026](https://thesimind.si/papers/day/2026-11-10/) · [Number 7](https://thesimind.si/papers/2611.10297/)