研究揭示 LLM 智能体记忆可被用于“内生授权洗白”，提出 EAL-Bench 基准

View PDF HTML (experimental)

Abstract:Long-running LLM agents rely on persistent memory to preserve not only task context but also the permissions and restrictions governing their actions. When memory misrepresents this evolving authorization state, the agent's own records can make unauthorized actions appear permitted, resulting in misaligned behavior without any external attacks.
We term this failure endogenous authorization laundering, where memory creates or retains false authority through semantic misinterpretation or failed updates, and executors act on that authority. We then introduce EAL-Bench to measure how accurately persistent memory preserves evolving authorization state and whether memory errors propagate to unauthorized actions.
We evaluate seven LLMs as memory writers and two as executors across procurement, cybersecurity, and finance tasks. Under incremental typed-memory updates, writers create false authority for up to 45.4% of unauthorized requests, and once false authority is present, executors act on it in 99.0% of trials. Memory-level safeguards reduce laundering but can reject legitimate actions, exposing a safety-utility tradeoff. Persistent memory is therefore part of an LLM agent's effective authorization policy, not merely a performance component.

Comments:	Accepted at the NeurIPS 2026 PALM Workshop (Personalized, Aligned, Long-Term Memory for AI Systems). Revised camera-ready version with expanded experiments, analyses, and appendices. 51 pages, 10 figures
Subjects:	Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)
Cite as:	arXiv:2609.01836 [cs.CR]
	(or arXiv:2609.01836v2 [cs.CR] for this version)
	https://doi.org/10.48550/arXiv.2609.01836 arXiv-issued DOI via DataCite

Submission history

From: Tommaso Cerruti [view email]
[v1] Tue, 1 Sep 2026 20:12:08 UTC (2,098 KB)
[v2] Sat, 24 Oct 2026 12:57:58 UTC (2,391 KB)