An agent that learns preferences from social posts can be taught to believe an attacker's instruction came from its own user
AspireAI community · arXiv (Bu, Shen, Zhang, Hu, Zhang)
As LLM agents start sharing experiences on social platforms and storing new preferences in memory, a role-to-principal attribution flaw opens up. The paper names it Role Grounding Misattribution and formalizes a Role Grounding Attack: an attacker publishes an experience-sharing post that quotes a conversation between the attacker's own agent and the attacker's user, explicitly naming its publisher. When the victim agent ingests that nested structure, the memory loses its context binding and grounds the attacker's preference to the victim's user instead. Two instantiations are demonstrated - tool selection manipulation, where a tool-call preference is misattributed and steers the victim toward an attacker-controlled tool, and privacy leakage, where both a tool-call and a task-requirement preference are misattributed so the victim picks the attacker's tool and then puts sensitive data into the tool arguments to satisfy the task. Evaluated across five mainstream memory systems and six language models, both attacks achieved high success rates. The limitation is that the attack needs a platform where agents can read each other's posts, and the paper does not report how widely deployed systems expose that surface today.
Read the story and explore more from the AspireAI community.
Two sparse-autoencoder analyses have resisted scaling: matching semantically similar features across layers, and compressing large feature circuits into interpretable supernodes. This paper argues both are the same underlying problem, estimating semantic distances between SAE features that sit on different activation manifolds. Its representation treats each feature not as a single decoder vector but as an activation-weighted distribution over the hidden states expressing it, projects those distributions into a shared reference space, and compares them with Wasserstein distance. The representation is proved invariant to activation rescaling and stable under perturbation, and recovers true matches under finite-sample margin conditions. Empirically it outperformed decoder-vector and LLM-based baselines and captured subtle functional distinctions between related features, and it compressed large feature circuits into interpretable supernodes automatically. The limitation is that this is interpretability tooling: the paper demonstrates better feature matching and circuit compression, not that downstream interpretability claims become more accurate.