What the Experiments Reveal—and What They Do Not

The subject now is not only how persistent memory can be poisoned, but how researchers can tell which part of the delayed chain actually failed. This chapter reads MemPoison and MemSecBench as complementary measurements: one follows the change in a later answer under clean and poisoned conditions, while the other follows memory through persistence, recall, adoption, consequence, and repair. Keeping their questions and denominators separate lets the reader judge what the numbers establish—and what they leave unresolved.

Two experiments measure different slices of the same risk

A top-line attack number can hide several different events. A malicious record might be blocked before storage, stored but never retrieved, retrieved but rejected, adopted but unable to produce the intended external state, or repaired after the fact. Conversely, a clean answer can look correct even when a memory system has accepted a dangerous record that simply was not triggered by that task. The two studies make different parts of this chain visible.

MemPoison uses a paired behavioral protocol. For each case, the clean condition writes only the benign context to the memory substrate and runs a trigger task. The poisoned condition adds the adversarial memory-writing turns and runs the same downstream task. The model's response is then compared with two evaluator-only targets: the expected clean behavior and the attacker-specified poisoned behavior. Clean accuracy is the share of clean responses that match the clean target. Behavioral Corruption Rate, or BCR, is the share of poisoned responses that match the poisoned target.

That design answers a focused question: after the poisoned memory has gone through admission, storage, retrieval, and response generation, how often does the later behavior move to the specified poisoned target? It does not, by itself, say whether the memory was admitted, whether every designated fragment was retrieved, or which memory item caused the change. MemPoison adds diagnostic and counterfactual analyses for those questions, but BCR remains a final downstream-behavior measure.

That narrowness is useful rather than a defect. BCR is calculated over poisoned trigger evaluations, so a case can avoid a poisoned response because a defense blocked the write, because retrieval failed to expose the record, because the agent rejected what it saw, or because the final operation did not match the evaluator's poisoned target. Those outcomes are operationally different even though they all lower the same final percentage. The clean condition supplies a second reference point: if a method reduces BCR by discarding benign memory, a fall in poisoned behavior is not enough to call the method successful. Clean accuracy shows whether the system can still use the memory it is meant to retain.

The paired design also prevents a misleading comparison between a clean response and a poisoned response produced by different tasks. The trigger request is held constant while the memory condition changes, so the measured difference is attached to the persistent state rather than to a new user goal. Even then, the result remains a behavioral association at the end of a pipeline. It does not prove that the model “understood” the attack, identify an internal cause, or estimate what would happen under a different retrieval policy. Those stronger questions require the separate stage logs and counterfactual checks.