CAPTURE: Disentangling Preference Drift from Memory Poisoning in Personalized LLM Agents
S M Asif Hossain, Ruksat Khan Shayoni, Md Kishor Morol
cs.LG
Quick verdict
提出了一种区分偏好漂移与投毒的记忆网关（11.5% ASR, 83.5% 合规率）；评估严谨且诚实地指出了局限性，但核心证据是合成的。
Summary
本文将个性化 LLM 智能体中真实偏好漂移与对抗性记忆投毒之间的模糊性形式化为连续时间部分可观测决策问题，并证明了任何仅依赖新近度和来源的更新规则，其错误率下界取决于对手对合法修订统计数据的模仿程度。提出的 CAPTURE 系统结合了神经 ODE 信念跟踪器、具有衰减的三层（稳定/上下文/瞬时）记忆账本、熵触发的澄清问题、安全受限选择器以及引用记忆的反事实审计。在包含 2,400 个回合的合成基准测试 D-PREFGUARD 上，CAPTURE 的胜率达到 71.5%（LLM 评判），而监督匹配的 Transformer 基线为 69.3%，StateMem 为 66.1%；同时将固定策略投毒率控制在 11.5%，并接受 83.5% 的真实更新。一个具备权重感知能力的自适应攻击者将投毒率提高到 24.7%，此时来源过滤器在安全性方面在统计上难以区分；作者报告了这一不利的数据，而非仅报告有利数据。外部有效性通过零样本 HorizonBench（矛盾解决率 0.72 对比 StateMem 的 0.65，无攻击存在）和一项为期两到三周的 40 名参与者重放研究（重放胜率 67.5% 对比 63.0%；投毒率 12% 对比 28%）进行了探索。局限性：主要基准是带有程序派生标签的自生成合成数据；没有外部设置能测试带有独立生成攻击的投毒鲁棒性；且报告的单轮延迟不一致（第 1 节为 630 毫秒，附录 B 为 2,480 毫秒）。
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Any memory-update rule reading only recency and provenance satisfies FUR+RRL ≥ 1−δφ against a feasible adversary (Theorems 1–2), so heuristic memory defenses cannot resolve the preference-authenticity ambiguity.
- CAPTURE (neural-ODE belief tracker + multi-timescale ledger + entropy-triggered clarification + counterfactual audit) reaches 71.5% win rate and 11.5% fixed-policy poisoning on D-PREFGUARD's 480 held-out episodes, beating a supervision-matched Transformer (69.3%) and the best heuristic (66.1%).
- The architectural increment over identical supervision is real but modest (+2.2 win points p=0.011; −4.4 poisoning p=0.003) and transfers to independent data, significantly on contradiction resolution and replay win.
- An adaptive attacker with released weights doubles poisoning to 24.7%, at which point a provenance filter is statistically indistinguishable on security while CAPTURE retains an adherence advantage (83.5% vs 74.1%).
- External validity holds in attenuated form: zero-shot HorizonBench contradiction resolution 0.72 vs StateMem 0.65, and a 40-participant replay study showing replay win 67.5% vs 63.0% and poisoning 12% vs 28%.
Strengths
Supervision-matched baseline isolates architecture from labels
The Sup. Transformer-Δt (Appendix E: 4.31M params, explicit log(1+Δt), same six-class labels, extractor, selector and safety scorer) reaches 69.3% win / 15.9% poisoning, so the architectural residual is quantified: +2.2 win points [0.6, 3.9] p=0.011 and −4.4 poisoning [−7.0, −1.9] p=0.003 (Q4). Few method papers separate supervision from architecture at all.
Honest reporting of unfavorable adaptive-attack results
Table 2 and Q5 state that an adaptive weight-aware attacker raises CAPTURE's ASR from 11.5% to 24.7% [20.6, 29.1], reversing the fixed-policy ordering: Provenance-only lands at 22.1%, difference 2.6 points [−1.9, 7.2] at p=0.29, i.e. not separated. This admission appears in the abstract and conclusion, not buried.
Preregistered falsification criteria with narrow-pass disclosure
Layered leakage control on synthetic data
Above-norm statistical protocol
Weaknesses
Core evidence is entirely self-generated
Internal latency contradiction in a headline cost claim
Security margin is fragile and partly selector-level
Architectural increment is modest with several non-significant externalizations
Clarification analysis rests on a stipulated channel
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
CAPTURE (arXiv 2609.02265) targets what the authors name the preference-authenticity ambiguity: in a personalized agent with persistent memory, a contradiction can be genuine drift, a context switch, sarcasm, or injected poison, all observationally identical within a turn (the four-case example opening Section 1). The claims are fourfold: (i) a formal impossibility result for any update rule reading only recency and provenance (Theorems 2–4, Appendix A); (ii) an architecture that resolves the ambiguity; (iii) a purpose-built benchmark, D-PREFGUARD, isolating it; (iv) empirical superiority under fixed-policy attack with an honestly reported adaptive-attack caveat. The conclusion is appropriately hedged: 'Most of that gain comes from supervised temporal tracking... the ledger and continuous-time update add a smaller increment that survives on independently built data.'
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is CAPTURE in LLM agent research?
CAPTURE is a memory-management architecture for personalized LLM agents that decides whether conflicting new information is a genuine user preference change, a temporary context shift, or an adversarial memory-poisoning injection. It combines a neural-ODE belief tracker, a multi-timescale memory ledger, uncertainty-triggered clarifying questions, a safety-bounded response selector, and counterfactual audits of cited memories.
What is the D-PREFGUARD benchmark?
D-PREFGUARD is a synthetic benchmark of 2,400 longitudinal episodes (480 held-out test episodes from 96 users) with five tracks: stationary preferences, four shapes of genuine preference drift, benign ambiguity, three attack families (indirect injection, poisoned summaries, same-origin writes), and utility-safety conflicts. Episode text is LLM-generated, seeded from PRISM, PersonalLLM and LaMP user profiles, with a held-out generator family for the test split.
How well does CAPTURE resist memory poisoning attacks?
On D-PREFGUARD, CAPTURE limits fixed-policy attack success to 11.5% at response level (18.8% at memory level) while accepting 83.5% of genuine preference updates. However, an adaptive attacker with access to the released weights raises success to 24.7%, at which point a simple provenance filter (22.1%) is statistically comparable on security; CAPTURE's remaining advantage is higher genuine-update adherence.
Is the code and data for CAPTURE available?
The paper states that source code, D-PREFGUARD construction scripts, and trained adapter weights are included in the supplementary material with public release promised. The attack payload generator is gated: it is available on request to researchers with institutional affiliation, per the ethics statement.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures 1–2 are unavailable as images; their content was assessed from captions plus the underlying numbers, which also appear in Tables 1–2 and Appendix B.
- PDF extraction linearizes some table layouts (e.g., the Table 3 gate-confusion matrix and Table 6 ablation); cell values were cross-checked against in-text statements where available, and no text appears cut off at the end of the extraction.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.