Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents

2026-07-25

AI Summary

This work addresses a critical privacy vulnerability in large language model (LLM) agents: although their isolated long-term memory is decoupled from user sessions, it can be inadvertently leaked through tool-calling interfaces. The paper introduces SPORE, the first extraction attack targeting such memory, which temporarily stores malicious instructions in short-term memory and leverages tool responses to generate semantically clean retrieval anchors. By integrating geometric coverage optimization in embedding space with a memory persistence mechanism, SPORE enables automated, cross-session memory extraction while decoupling attack instructions from retrieval signals. The method achieves an 80.0% memory extraction rate without trigger constraints (47.0% with 20 triggers) and successfully links memory records to user identities in multi-user settings, exposing tool interfaces as a pivotal privacy attack surface.

Abstract

LLM-based agents extend large language models with long-term memory (LTM) that persists privacy-sensitive user data across sessions. Production systems mitigate extraction risks through memory isolation, binding each user's LTM to a unique identifier. This defense has blocked known attacks on shared storage, fostering the assumption that isolated LTM is secure. We identify the tool interface as an overlooked attack surface. Agents routinely embed LTM-retrieved data in tool invocation parameters, enabling a malicious tool to exfiltrate private memory without violating user-level isolation. Naive adaptations of user-side extraction techniques fail because the adversarial command's semantics interfere with retrieval precision, and platform-imposed tool-call limits constrain the extraction budget per trigger. We present SPORE, the first extraction attack designed for this threat model. SPORE decouples the adversarial command from retrieval anchors by persisting the command in short-term memory and emitting semantically pure anchors in tool responses. The restored retrieval precision enables a geometric coverage optimization over the embedding space that systematically steers anchors toward unexplored memory regions. To sustain extraction beyond tool-call limits, SPORE persists reactivation payloads in memory that automatically resume the attack within and across sessions without additional user triggers. SPORE achieves an 80.0% record extraction rate with unlimited triggers and 47.0% with only 20 triggers. In multi-user deployments, attackers can link extracted records to user identities, enabling targeted surveillance. These results demonstrate that memory isolation alone is insufficient and call for reexamining tool-side trust boundaries in agent architectures.

Problem

• memory isolation
• LLM agents
• privacy leakage
• tool interface
• memory extraction

Innovation

• memory extraction attack
• LLM agents
• tool interface vulnerability
• persistent memory
• SPORE