When the Harm Is Split, Hidden, or Triggered
Persistent memory poisoning is difficult not because every malicious record is cleverly disguised, but because harmfulness can become visible at different points in the memory lifecycle. This chapter focuses on that structural difference. The L1–L3 model gives the reader a way to classify a case by where the harmful meaning appears—inside one record, between several records, or only under a later trigger—and to see why a filter at write time cannot observe all three conditions equally well.
Three structures, three locations of harmfulness
A memory defense often starts with a practical question: should this candidate record be admitted? That question is reasonable, but it assumes that the safety of a future memory can be judged from the record available now. MemPoison tests the assumption by varying not just the wording of an injection, but the structure of the information that will later reach the agent. Its three levels form a difficulty ladder because each one moves the decisive evidence farther away from the write boundary.
L1: the harmful meaning is visible in one record
At L1, or single-record corruption, one memory record directly contains the unsafe fact, preference, instruction, or state change. Imagine a candidate record that plainly redirects an operational workflow away from its approved destination. The record may still be written in natural language, but its harmful direction is present in the item itself. A consistency check can compare it with trusted existing information; a safety judge can inspect the proposed update; an anomaly detector can look for an unusual destination or an instruction to override a rule. All of those checks have at least a chance to see the relevant meaning before storage.
L1 is therefore the natural target for pointwise admission control. “Pointwise” means that the defense evaluates one candidate, or one materialized record, at a time. If the unsafe action is already expressed there, the defense does not need to predict a future retrieval set or a future task to identify the risk. Blocking the record can prevent it from entering persistent memory, and a later task cannot retrieve a record that was never admitted.
That does not make L1 harmless or universally easy. A record can be explicit about an unsafe action while using plausible workflow language, and a filter can miss it. A broad detector can also block unusual but legitimate technical information. The structural point is narrower: in L1, the risk-bearing semantics are local to the object being inspected. The write-time decision has access to the key evidence it needs, even if its classifier is imperfect.
The distinction between an accepted write and a safe write remains important. A memory interface may accept an L1 candidate, but that event proves only that the operation succeeded. Whether the harmful semantics persisted is a separate question, and whether they later influenced a task is another. The L1 label describes where the harmful meaning is concentrated; it does not by itself establish a completed attack.
L2: several harmless-looking pieces form the harmful meaning
At L2, or compositional corruption, the attacker distributes the conclusion across multiple records written over time. Each fragment can look like an ordinary observation or preference. One record may describe two available environments. Another may praise one environment's performance. A third may associate that environment with a destination that conflicts with the trusted workflow. No single fragment necessarily states the complete unsafe instruction. The harmful direction appears when a later query retrieves the relevant pieces together and the agent composes them.
This is a different problem from hiding a sentence with unusual wording. The sentence-level view is insufficient because the safety property belongs to a set of records. The first fragment can pass a plausibility check. The second can pass a consistency check because it does not yet contradict anything. The third may look like a factual detail. Only their joint interpretation creates a route, a recommendation, or an action that the defender would have rejected if it had been presented as one record.
The timing makes the blind spot structural. During the first write, the defense does not know whether related fragments will arrive later. Even when it can compare a new fragment with already admitted memory, it cannot see future fragments or the future trigger task. It must decide whether the current piece is useful on its own, not whether an unknown future combination will be harmful. If the defense blocks every fragment that could conceivably participate in a bad combination, it will also block ordinary facts that are meant to be combined in legitimate work.
Retrieval adds another condition. The fragments must not merely exist; the later query must expose enough of them at once for the model to connect them. A small retrieval set may return one piece but not the others, so the attempted corruption remains incomplete. A broader retrieval set increases the chance of co-retrieval, but it also increases the amount of context the model must sort and may introduce more benign material. L2 risk is consequently shaped by both memory composition and retrieval policy. A defense that stores fragments safely in isolation may still need to inspect the assembled context at use time.
L3: the record waits for a context that makes it harmful
At L3, or context-triggered dormant corruption, a memory record appears neutral or conditionally valid until a natural future context activates its unsafe effect. The record might describe a procedure that sounds ordinary in routine use but contains a concealed or overbroad instruction for a particular event. The trigger is not necessarily an explicit attack phrase. It can be a normal task condition—such as a monthly report, a special customer request, or the start of a workflow—that gives the dormant record an opportunity to influence action.
L3 moves the decisive evidence even farther from admission. In an ordinary context, the record may be retrieved without changing the response. Its harmfulness is not a stable property of the text alone; it is a relationship among the stored condition, the current task, and the action the agent chooses. A write-time judge that sees only the candidate record and a summary of existing memory does not see the future trigger. A behavioral check that tests only routine queries may observe no corruption. The record can appear quiet until the exact condition that gives it operational force arrives.
This explains why “it behaved harmlessly before” is weak evidence. A dormant record is designed, by its structure, to have little influence outside its activation context. The absence of an unsafe response under ordinary queries does not show that the record is safe under the task for which its condition matters. The relevant test must include the trigger and must examine what the agent does after the record becomes influential.
The three levels can be shown as different paths through the same write boundary:
The diagram is not a ranking of three attack recipes. It identifies three locations of decisive information. L1 exposes the risk inside the candidate. L2 hides the decisive relationship in the later set of retrieved records. L3 hides it in the relationship between a record and a future context. The same words could participate in different levels depending on how they are stored and what the later task makes available. Classification therefore follows memory structure, not how exotic or obfuscated the text looks.
Why a pointwise filter loses the future
A write-time defense operates under a strict information limit. It can inspect the candidate memory, the source channel, and whatever trusted memory state is available at that moment. It cannot normally inspect a future user request, a future retrieval result, or the model's eventual response without turning the defense into an oracle. That limit is not an incidental implementation weakness; it follows from the order of events. The decision to store comes before the query that might reveal why the record is dangerous.
For L1, the necessary evidence is often already present. The record can contradict a trusted destination, introduce a standing instruction, or ask for an unauthorized change. A consistency checker or a broader admission judge may catch the contradiction. In MemPoison's experiments, write-time consistency checking suppresses direct L1 corruption far more effectively than the harder levels. That result fits the mechanism: the filter is looking at the same object that carries the risk.
For L2, the filter has to predict an interaction. It would need to know not only whether the current fragment is safe, but which later fragments will be retrieved with it and how the agent will combine them. The answer depends on the retriever's relevance function, the number of returned records, the representation used by the substrate, and the current task. A record that is safe in one retrieval set can become part of an unsafe conclusion in another. Admission-time inspection cannot settle a property that is defined over a future set it has not seen.
For L3, the filter has to predict a conditional response. It would need to determine whether a record that appears legitimate under ordinary circumstances becomes unsafe when a later task satisfies its condition. That requires knowledge of the trigger, the current authority, and the downstream action. If the filter rejects all conditional procedures, it destroys useful memory: real workflows contain instructions that apply only to certain dates, customers, exceptions, or operating states. If it admits them without preserving and checking those conditions, it risks allowing a dormant rule to become a standing or unauthorized direction.
The resulting trade-off is not simply between a strong filter and a weak filter. It is between two kinds of error under incomplete information. A permissive filter admits locally plausible content that may become harmful through composition or activation. An aggressive filter treats unusual, conditional, or cross-referencing content as suspicious and may discard benign knowledge needed for continuity. The system cannot eliminate the uncertainty by changing the threshold alone because the missing evidence is about future context.
This is why a defense must move with the risk. At admission, it can check origin, authority, contradiction, and obvious unsafe changes. At retrieval, it can retain provenance, reduce unjustified trust in lower-authority sources, and look at the assembled memory context rather than only its records in isolation. At the point of action, it can require current authorization and validate concrete recipients, destinations, parameters, or submissions. After a suspected compromise, it can compare the final memory state with the poisoned state and verify that the target semantics are no longer operative. Each stage sees a different part of the causal chain.
MemPoison's Mechanistic Influence Decomposition, or MID, helps explain these differences after a response has been produced. The diagnostic removes one retrieved record and observes how much the poisoned behavior changes. That is informative for L1, where one record should carry most of the influence. For L2, MID can remove a designated pair or fragment set together; a large joint change when individual changes are small is evidence that the interaction matters. For L3, it compares a record's influence in a normal context with its influence under the designated trigger; a large increase indicates conditional activation.
MID is not a write-time defense and does not give an agent permission to remove arbitrary memory in production. It is a way to locate residual influence in a controlled evaluation. Its conditional analysis also matters: it studies poison units that were admitted and retrieved, while separately accounting for records blocked at admission or absent from retrieval. Otherwise, a result about the causal effect of a retrieved record could be mistaken for an overall attack rate.
The same reasoning explains why a single safety score can mislead. A defense may block many L1 records and lower the final corruption rate, yet leave the structural route for L2 or L3 open. A retrieval policy may prevent a pair of fragments from appearing together in one task but fail under a broader query. A dormant record may have no measurable effect until the exact trigger arrives. Security evidence must therefore identify the stage at which the system stopped the chain, not merely whether the final answer looked safe in one test.
The L1–L3 ladder leaves a practical rule: inspect the object at the boundary where its risk becomes meaningful. If harmfulness is local, admission checks can be decisive. If it is compositional, inspect relationships in the retrieved set. If it is conditional, evaluate the trigger and the current authority before allowing the memory to govern action. The more deferred the harmfulness, the less a pointwise write-time decision can establish on its own.
This structural view prepares the next question. Once risk can be visible at admission, emerge during co-retrieval, or wait for a trigger, benchmark results must tell us which transition actually limits a completed attack—and whether removing the target later is enough to make the memory safe again.