mlsanityData to 14 Oct 2026

MRMMIA: Membership Inference Attacks on Memory in Chat Agents

arXiv 2605.27825 ↗First posted 27 May 2026cs.CR cs.LGcited by 2

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

Membership inference attacks (MIAs) test whether a target data record belongs to a system's private data, and have become a standard tool to measure privacy leakage in machine learning systems. Prior work has primarily focused on training corpora or retrieval databases. However, MIAs against agent memory have received less attention, even though such memory can contain sensitive user-agent interactions, retrieved facts, and user preferences. Therefore, in this work, we focus on chat agent memory MIAs, where an adversary infers whether a candidate memory unit belongs to the chat agent's memory store. We propose Multi-Recall Memory MIA (MRMMIA), a unified attack that utilizes multiple recall probes to the agent to extract the membership signal across black-box, gray-box, and white-box settings. Our experiments demonstrate that MRMMIA consistently outperforms baselines. Our results expose the privacy risk in agents and provide an initial evaluation framework for membership leakage in chat-agent memory systems.

Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 22 of its 28 references that are in the map. First posted on arXiv 27 May 2026.

Builds on

22 of 28 references.

Closest ancestors · 9

Same direction, newest first

  1. 2026Five Queries Are Enough: Query-Efficient and Surrogate-Free Membership Inference Attacks on RAG via Entailment23 May
  2. 2025Riddle Me This! Stealthy Membership Inference for Retrieval-Augmented Generation1 Feb
  3. 2024Mask-based Membership Inference Attacks for Retrieval-Augmented Generation26 Oct
  4. 2024Generating Is Believing: Membership Inference Attacks against Retrieval-Augmented Generation27 Jun
  5. 2024Is My Data in Your Retrieval Database? Membership Inference Attacks Against Retrieval Augmented Generation30 May
  6. 2024Do Membership Inference Attacks Work on Large Language Models?12 Feb
  7. 2023Practical Membership Inference Attacks against Fine-tuned Large Language Models via Self-prompt Calibration10 Nov
  8. 2023Membership Inference Attacks against Language Models via Neighbourhood Comparison29 May
  9. 2021Membership Inference Attacks on Machine Learning: A Survey14 Mar

Other references · 13

  1. 2023Efficient Memory Management for Large Language Model Serving with PagedAttentioncited by 5,944
  2. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  3. 2023A Survey on Large Language Model based Autonomous Agentscited by 2,242
  4. 2020Extracting Training Data from Large Language Modelscited by 2,189
  5. 2024Evaluating Very Long-Term Conversational Memory of LLM Agentscited by 830
  6. 2025Mem0: Building Production-Ready AI Agents with Scalable Long-Term Memorycited by 779
  7. 2024A Survey on the Memory Mechanism of Large Language Model based Agentscited by 634
  8. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 498
  9. 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Basescited by 429
  10. 2023Detecting Pretraining Data from Large Language Modelscited by 387
  11. 2021Beyond Goldfish Memory: Long-Term Open-Domain Conversationcited by 267
  12. 2025Unveiling Privacy Risks in LLM Agent Memorycited by 101
1 more
  1. 2024Follow My Instruction and Spill the Beans: Scalable Data Extraction from Retrieval-Augmented Generation Systemscited by 76

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026Autonomous Research Agents: A Survey of AI Scientists and the Verification Gapcited by 9
  2. 2026Activity Frames: Deterministic Screen-Activity Compilation for Agent Memory and Replaycited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026AIM: A Privacy-Aware Interoperable Memory Framework for Multi-Agent Multi-User LLM Systems
  2. 2026What to Remember, What to Reveal: Privacy-Aware Memory for Conversational Agents
  3. 2025Evaluating the Defense Potential of Machine Unlearning against Membership Inference Attacks
  4. 2026CheckMIABench: Firm Foundations For Membership Inference Attacks on Language Models
  5. 2025Membership Inference Attacks on Large-Scale Models: A Survey
  6. 2025PerProb: Indirectly Evaluating Memorization in Large Language Models ↗
  7. 2025(Token-Level) InfoRMIA: Stronger Membership Inference and Memorization Assessment for LLMs
  8. 2026ADAM: A Systematic Data Extraction Attack on Agent Memory via Adaptive Querying