智能体记忆安全是实际部署中的盲区，MemAudit 解决了「事后追责」的难题，做 LLM 安全或智能体系统的团队可以直接参考其因果审计方法。
大语言模型智能体依赖持久记忆来存储历史交互并提升长任务执行能力，但这也带来了安全漏洞：对抗用户可通过正常交互向记忆库注入恶意记录，后续检索时操纵智能体行为。现有防御主要聚焦在线干预（如提示过滤），无法在有害行为发生后定位哪些记忆是罪魁祸首。MemAudit 提出后验因果审计框架，结合反事实记忆影响分数和记忆一致性图，从结构异常中识别恶意记忆。在 QA 和推理智能体场景下，MemAudit 将攻击成功率从 70% 和 83.3% 降至 0%，为智能体记忆安全提供了有效的审计工具。
MemAudit: Post-hoc Auditing of Poisoned Agent Memory via Causal Attribution and Structural Anomaly Detection
Large language model agents increasingly rely on persistent memory to store past interactions, retrieve relevant demonstrations, and improve long-horizon task execution. However, this memory mechanism also creates a practical security vulnerability: an adversarial user may inject malicious records into the agent's memory through ordinary interaction, and these records can later be retrieved to steer the agent's reasoning and actions. Existing defenses primarily focus on online intervention, such as prompt filtering or output blocking, but they do not address the post-hoc question of which stored memories are responsible after harmful behavior has already been observed. We propose \textbf{MemAudit}, a post-hoc causal memory auditing framework for memory-augmented LLM agents. The framework combines two complementary signals: (1) a counterfactual memory influence score that measures each memory's causal contribution to harmful outputs, and (2) a memory consistency graph that identifies structurally anomalous memories within the broader memory store. We evaluate MemAudit against MINJA, a query-only memory injection attack in which malicious records are generated and stored through normal agent interactions rather than direct memory-bank modification. Across both QA and reasoning-agent settings, MemAudit substantially reduces attack success rates under realistic post-hoc auditing scenarios. The results show that QA attack success is reduced from $70\%$ to $0\%$, while RAP attack success drops from $83.3\%$ to $0\%$.