Injection-Execution Dissociation: A Mechanistic Evaluation of Persistent Memory Attacks and Defenses in Stateful LLM Agents

Abstract

In LLM agents with persistent memory, whether a model stores an injected instruction and whether it later acts on it are separable safety properties. We call this the injection-execution dissociation. We evaluate 29 frontier endpoints with the malicious document in the retrieval corpus (N=10 each, four topped up to N=40; an earlier bug-affected collection is superseded). Execution is common: 7 endpoints exfiltrate in at least 9 of 10 runs and 11 more in some but fewer. Zero exfiltration is weak evidence of resistance: GPT-5.4, GPT-5.6-sol and Claude Haiku 4.5 never exfiltrate in 40 draft-only runs each but send almost no email, and in an exploratory follow-up that supplies the content and asks for a send they exfiltrate in 20 of 20, 5 of 20 and 6 of 20 runs. Anthropic's Opus and Sonnet models mostly store no forwarding directive and exfiltrate in at most 1 of 10 draft-only runs. We test six defences at four architectural layers in a 5,040-run factorial on nine open-weight models (N=40 per cell); these models store the instruction in every run, so it tests execution only. Input filters never see the payload, which arrives through retrieval. Retrieval-layer classifiers see it but, at the small operating points tested, do not flag it; frontier judges did. Only Memory Sandbox, which removes the recall tool, blocks the attack (0% ASR for eight of nine models). It is bypassed when a model rebuilds the instruction from the retrieval corpus: three Bedrock-served models do so (32.5-97.5% ASR), and a causal-mediation study on two OpenAI models attributes every success under the sandbox to this path. Stored but dormant instructions may create a cross-model risk; transfer was not demonstrated. Defences should be evaluated at both stages.

arXiv comment44 pages, 1 figure. v6 corrects the causal-mediation baseline and re-collects the frontier evaluation after the same tool-wrapper bug (its conclusions change); adds new frontier endpoints, tool ablations, a cross-model test, frontier judges and a payload study. Code and data: https://github.com/junwenleong/stateful-agent-security-eval