---
title: 'MemGhost: Stealth Injection & KV-Cache Recovery'
url: https://www.emergentmind.com/topics/memghost
type: topic
---

# MemGhost: Stealth Injection & KV-Cache Recovery

MemGhost most directly denotes a one-shot payload generation framework for stealth memory injection against persistent personal agents [2607.05189]. In related work, the same label is also used to describe privacy leakage when “ghosts” of prior user inputs reappear through short-term context and long-term retrieval-augmented generation (RAG) memory [2410.14931], and, in a systems context, as a memory-centric, KV-cache ghosting and checkpointing design that extends GhostServe’s “in the shadow” parity protection of the streaming KV cache [2605.00831]. A closely related attack line is GhostWriter, a memory poisoning attack on long-term-memory LLM agents; that paper does not mention “MemGhost,” but it provides a reference blueprint for persistent memory compromise in tool-using personal agents [2607.06595]. This suggests that “MemGhost” is not yet a fully stabilized term, but is already associated with persistent memory, delayed activation, and the security or reliability consequences of hidden state.

## 1. Terminological scope and conceptual boundaries

In the usage introduced by “When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents,” MemGhost is a one-shot payload generation framework for stealth memory injection. The adversary is remote and black-box, can place a single email into the victim’s inbox, and cannot interact with the agent, observe runtime feedback, or iterate on the target. The framework is therefore centered on single-email delivery, persistent state adoption, and later behavioral impact [2607.05189].

In “Ghost of the past,” MemGhost refers instead to the privacy leakage that arises when “ghosts” of prior user inputs reappear via an LLM’s memory, either directly as previously stated details or indirectly as inferences formed by aggregating multiple past inputs. The paper frames memory as two interacting layers: short-term memory in the context window and long-term memory implemented as RAG. Leakage can therefore arise from individually stored inputs, from retrieved long-term records, or from inferences formed by combining them [2410.14931].

In the GhostServe-derived systems interpretation, MemGhost is a memory-centric, KV-cache ghosting and checkpointing design for fault-tolerant LLM serving. Here, “memory” does not denote user facts or agent beliefs, but the streaming KV cache whose loss forces costly prefill recomputation. The design goal is to protect the KV cache “in the shadow” with lightweight erasure-coded parity, recover from failures cheaply, and minimize interference with GPU compute [2605.00831].

A common misconception is that these usages describe the same mechanism. They do not. One concerns stealthy state compromise in persistent personal agents, one concerns privacy leakage from memory resurfacing and inference, and one concerns reliability of the serving stack. The common denominator is the operational importance of hidden memory state.

## 2. MemGhost as stealth memory injection against persistent personal agents

The attack-framework definition of MemGhost formalizes a persistent personal agent as an agent $A$ with persistent state $s$, execution task $t$, external email $x$, and configuration $\omega$, producing a visible response $y$ and a state update $\Delta s$:
$$
(y,\Delta s)=A(s,t,x;\omega).
$$
An attack payload succeeds if it induces injection, remains stealthy, and causes later behavioral impact over an unknown configuration distribution $P^\star$:
$$
x^\star=\arg\max_{x\in \mathcal{X}} \mathbb{E}_{\omega\sim P^\star}\big[\mathbb{I}_{\text{inject}}\cdot \mathbb{I}_{\text{stealth}}\cdot \mathbb{I}_{\text{effective}}\big].
$$
The attack goals are threefold: injection, meaning a persistent memory write that semantically adopts the attacker’s target content $m$ as reusable agent knowledge; stealth, meaning the immediate user-visible response is non-diagnostic; and effectiveness, meaning the injected memory influences future behavior under a downstream trigger query in a separate session [2607.05189].

MemGhost achieves this with two proxies. The environment proxy, or shadow agent, emulates persistent-agent execution with a persistent workspace, tool-mediated email ingestion, file tools, and user-visible filtering. The objective proxy converts memory adoption and conversational stealth into dense rubric-based rewards using an LLM judge. The reward definitions distinguish durable carriers from episodic storage:
$$
R_{\mathrm{inj}}(m,x)=
\begin{cases}
0, & \text{if } \Delta \hat{s}=\emptyset,\\[4pt]
\mu\cdot \mathcal{J}\!\big(m,x,\Delta \hat{s},\mathcal{Q}_{\mathrm{inj}}\big), & \text{otherwise,}
\end{cases}
$$
$$
R_{\mathrm{stl}}(m,x)=
\begin{cases}
1, & \text{if } \hat{y}=\emptyset,\\[4pt]
\mathcal{J}\!\big(m,x,\hat{y},\mathcal{Q}_{\mathrm{stl}}\big), & \text{otherwise,}
\end{cases}
$$
$$
R_{\mathrm{trace}}(m,x)=R_{\mathrm{inj}}(m,x)\cdot \big(R_{\mathrm{stl}}(m,x)+\lambda\big).
$$

Training proceeds in two stages. The attacker policy is a Qwen-4B model with LoRA adaptation. First, supervised fine-tuning is performed on high-scoring seeds discovered by rubric-guided search:
$$
\mathcal{L}_{\mathrm{SFT}}(\theta)=
-\mathbb{E}_{(m,x)\sim\mathcal{D}_{\mathrm{SFT}}}
\big[\log \pi_\theta(x\mid m)\big].
$$
Second, reinforcement learning with GRPO maximizes expected trace reward using clipping, KL regularization to a frozen SFT reference, and entropy regularization:
$$
\theta^\star=\arg\max_{\theta}\;
\mathbb{E}_{x \sim \pi_{\theta}(\cdot \mid m)}
\big[R_{\mathrm{trace}}(m,x)\big].
$$
At inference time, the model receives only the target memory $m$ and emits a single structured email payload: sender name/address, subject, and body. No inbox state or runtime feedback is available.

## 3. Benchmark design, transfer, and empirical behavior

The evaluation framework for MemGhost is WhisperBench, a 108-case benchmark spanning five risk categories: health and safety, financial loss, information integrity, cybersecurity, and operational disruption. Each case includes a target memory $m$ and is labeled as fact poisoning or preference poisoning. Delivery occurs through a real IMAP/SMTP workflow with a mixed inbox of benign emails plus one adversarial email, and processing is evaluated in both background and foreground execution [2607.05189].

WhisperBench measures ISR, SSR, ESR, and E2E. ISR is the Injection Success Rate, defined as the fraction of runs where $\Delta s$ contains $m$ as reusable persistent memory. SSR is the Stealth Success Rate, defined as the fraction of runs where the user-visible $y$ does not expose the source, target facts, or memory write. ESR is the Effectiveness Success Rate, defined as the fraction of runs where downstream behavior relies on $m$ with severity at least 3 on a 0–4 rubric. E2E requires all three simultaneously.

Across 56 held-out test cases, MemGhost achieves 87.5% end-to-end success on OpenClaw with GPT-5.4 and 71.4% on Claude Code SDK with Sonnet 4.6. The paper also reports OpenClaw with GPT-5.4 at E2E 87.5% in background and 75.0% in foreground, Claude Code SDK with Sonnet 4.6 at E2E 71.4% in background and 48.2% in foreground, Claude Code SDK with Sonnet 4.5 at E2E 80.4% in background and 71.4% in foreground, Grok 4.1 Fast at E2E 91.1% in background and 76.8% in foreground, DeepSeek v4 Flash at E2E 75.0% in background and 42.9% in foreground, and MiniMax-M2.5 at E2E 78.6% in background. In the MiniMax-M2.5 foreground setting, ISR remains very high at 98.2% but SSR collapses to 21.4%, yielding E2E 21.4% due to verbose reasoning leakage that exposes memory updates.

Transfer results indicate that the attack is not tied to a single framework or memory backend. Across filesystem-based frameworks, NanoClaw reaches E2E 80.4% in background and 78.6% in foreground, while Hermes Agent reaches E2E 82.1% in background and 51.8% in foreground. Across Mem0 vector-store backends, OpenClaw+Mem0 reaches E2E 85.7% in background and 80.4% in foreground, and Hermes+Mem0 reaches E2E 85.7% in background and 48.2% in foreground. The paper states that these results persist when native filesystem memory is disabled, indicating backend-agnostic adoption driven by semantic plausibility rather than platform-specific file names or APIs.

The framework also remains effective against input-level, model-level, and system-level defenses. DataSentinel has a false-negative rate of 91.59%. Under Meta-SecAlign, ISR is 49.07% and SSR is 98.15%. AgentDoG has a false-negative rate of 93.46% on OpenClaw and 40.38% on Claude Code SDK. An adaptive foreground transparency prompt decreases SSR substantially, but MemGhost remains stealthy in 19–25% of runs on frontier systems. Proxy validation further reports strong correlations between shadow-environment proxy rewards and real-target metrics: $R_{\mathrm{inj}}$ vs ESR has Pearson 0.872 and Kendall 0.874; $R_{\mathrm{stl}}$ vs SSR has Pearson 0.785 and Kendall 0.803; and $R_{\mathrm{trace}}$ vs E2E has Pearson 0.839 and Kendall 0.852.

## 4. Relationship to GhostWriter and long-term-memory poisoning

GhostWriter, introduced in “When Agents Remember Too Much: Memory Poisoning Attacks on Large Language Model Agents,” is the closest directly related attack model when MemGhost is understood as persistent memory compromise rather than as a specific training pipeline [2607.06595]. GhostWriter targets long-term-memory agents in two phases: injection, where an adversary sends a hidden attack payload to the target agent, and activation, in which the poisoned memory is retrieved. The attack is motivated by personal assistant agents that sit at the convergence of conversational memory and action-planning memory, ingest untrusted information such as emails and calendar invites, and persist long-term state across sessions.

The injection phase chooses an adversary goal $g$, a target future prompt $t$, constructs a payload $p$, embeds it into believable content $x$, and relies on the agent to transform $x$ into a stored memory $m\in S$. The paper categorizes adversary goals into integrity corruption, sensitive information leakage, covert exfiltration, and scope escalation. To maximize future recall, the attacker can optimize semantic similarity between the payload and likely query topics using:
$$
\mathrm{Score}(p,T,E)=\frac{1}{|T|}\sum_{q_i\in T}\cos\!\big(E(p),E(q_i)\big),
$$
where the attacker used bge-small-en-v1.5 and the agents used all-MiniLM-L6-v2.

The activation phase begins with a benign user prompt $q$, after which the agent retrieves the top-$k$ memories $R=\mathrm{Retrieve}(q,k,S)$ and forms context $C=\{q\}\cup R$. If the poisoned memory is retrieved, the response may deviate from the user’s intent. The paper formalizes this via injection rate, retrieval rate, activation rate, and overall success:
$$
\mathrm{IR}=\frac{N_{\text{injected}}}{N_{\text{attempted}}},\qquad
\mathrm{RR}=\frac{N_{\text{retrieved}}}{N_{\text{poisoned}}},
$$
$$
\mathrm{AR}=\frac{N_{\text{activated}}}{N_{\text{poisoned}}},\qquad
S=\mathrm{IR}\times \mathrm{AR}.
$$

Empirically, GhostWriter reports approximately 98% average injection and approximately 60% average activation against A-Mem, Mem0, Letta (MemGPT), MemoryOS, and ExpeL. Retrieval is high under ChatGPT and DeepSeek, at 79–100% and approximately 94% average. ExpeL is least vulnerable, at 28–63% activation, because trajectory memories operate as exemplars rather than authoritative facts. The paper also reports that a benchmarked prompt-injection payload from AgentDojo had similar Phase-1 injection but very low Phase-2 activation across most fact-based agents, at 0–16.7%, whereas ExpeL was highly vulnerable at approximately 92% activation. This distinction matters: prompt injection modifies immediate generation via in-context adversarial text, while memory poisoning modifies persistent state via tool inputs and activates later on benign prompts.

The defense proposed in that paper, Agentic Memory Sentry (AM-Sentry), is explicitly memory-governance oriented. It combines a memory-saving policy with a retrieval screen. S2 computes usefulness and vulnerability as
$$
U=0.6u+0.4r,\qquad V=t\times(1-o),
$$
and admits only if $U>0.4$ and $V<0.6$. S3 adds a strict checklist, dual-judge structure, and aggregation
$$
C=\frac{s_2+s_3}{2},\qquad N=\frac{s_4+s_5+s_6+s_7}{4},\qquad F=0.6C+0.4N.
$$
End to end, S3+R reduces overall attack success below approximately 12% across most models, with Llama averaging approximately 20%, while utility loss is described as minimal. In the context of MemGhost as persistent memory compromise, this provides a concrete governance template: admission control, provenance-aware metadata, and pre-context retrieval filtering.

## 5. MemGhost as privacy leakage from context and RAG memory

In the privacy literature, MemGhost denotes the resurfacing and inference of sensitive user information from an LLM’s memory—short-term context plus long-term RAG—that users rarely perceive and cannot easily control [2410.14931]. Leakage occurs in two ways. Individually stored inputs may themselves contain sensitive content. Aggregated memories may allow the model to infer new sensitive attributes that the user never explicitly provided. The paper’s threat model is therefore not prompt injection or model-weight memorization, but memory generation and usage through context plus RAG.

The formative semi-structured interview study with $N=40$ documents strong opacity and low awareness. Thirty of forty participants were unaware that memory and context were being added without explicit notification, twenty-eight of forty were totally unaware of how memory was used, and thirty-five of forty had never clicked the management panel. Before the study, thirty of forty did not notice private information in past inputs, thirty-six of forty never noticed private information in memories, and no participant recognized that sensitive information could be inferred by combining inputs and memory until the inference process was explained. All participants wanted autonomy to edit, add, or delete memories; privacy was the primary motivator for thirty-five of forty, and thirty-six of forty wanted proactive modification permission.

MemoAnalyzer is proposed as a proactive, prompt-based system that identifies and visualizes sensitive information inferred from aggregated past inputs and long-term memories, then enables user modifications before future memory fusion or training. Its workflow consists of aggregation, prompt-based inference, sensitivity and confidence assignment, source tracking and span identification, and a user modification proxy. The visualization encodes sensitivity in color and confidence in transparency through:
$$
\mathrm{rgba}(c,s)=\big(109+s\cdot(255-109),\;172+s\cdot(117-172),\;255+s\cdot(117-255),\;c\big),
$$
with $s\in[0,1]$ and $c\in[0,1]$. By default, only inferred items are shown in the sidebar; clicking an item reveals contributing past inputs and memory entries, with key phrases highlighted in yellow.

The five-day in-lab evaluation with $N=36$ compares MemoAnalyzer to a GPT-like default memory setting and a Manual baseline. Privacy protection effectiveness is assessed by running privacy inference on Day-5 with GPT-4o, Qwen-72B, and Qwen-7B over participants’ past inputs and memory histories. For twenty-five randomly selected participants, each dialogue is analyzed five times. MemoAnalyzer significantly improves privacy awareness and protection without compromising interaction speed. The paper reports significant differences in total private inference for GPT-4o, with $F_{2,48}=4.35, p<.01$, and for Qwen-72B, with $F_{2,48}=4.45, p<.01$; Qwen-7B also shows a significant overall difference, with $F_{2,48}=2.67, p<.05$. The study further reports over 22.3% and 4.6% reductions in private information, evaluated using GPT-4o, across categories.

Time costs remain comparable. Total time is MemoAnalyzer $M=460.3\text{s}$ $(SD=58.6\text{s})$, GPT-4o $M=426.2\text{s}$ $(SD=50.6\text{s})$, and Manual $M=462.7\text{s}$ $(SD=55.6\text{s})$. Privacy protection time is MemoAnalyzer $M=29.9\text{s}$ $(SD=6.6\text{s})$ and GPT-4o $M=23.9\text{s}$ $(SD=4.3\text{s})$. Subjectively, MemoAnalyzer significantly increases satisfaction, perceived control, and perceived privacy-risk protection relative to Manual, and NASA-TLX ratings indicate reduced physical demand, mental demand, frustration, temporal demand, performance, and effort. The paper is also explicit that the system does not address extraction of training-set memorization inside the model; it mitigates future risk by enabling edits and deletions at the memory layer before aggregation and training.

## 6. MemGhost as KV-cache checkpointing and recovery in LLM serving

In the serving-systems interpretation derived from GhostServe, MemGhost is a memory-centric, KV-cache ghosting and checkpointing design for fault-tolerant LLM serving [2605.00831]. The motivating setting is million-token, agent-based applications in which inference runs for minutes to hours, the KV cache grows linearly with sequence length and batch, and a device or process fault risks losing the entire volatile state and restarting from scratch. The central design insight is to protect the streaming KV cache indirectly, by encoding distributed KV chunks into parity shards on the fly and storing only these parity shards in host memory.

Under chunked prefill, each GPU in a tensor-parallel group computes its shard of the KV cache for each chunk. The system gathers a chunk’s data shards onto one designated GPU, applies erasure coding to produce parity shards, and asynchronously offloads the parity to pinned host DRAM. Round-robin scheduling rotates the parity-generation duty across GPUs. On failure, the system detects the fault, chooses a prefix of earliest chunks to recompute, reconstructs later missing shards from surviving KV plus parity, and resumes inference. The failure model targets intra-node GPU memory “soft” faults such as silent data corruption, ECC errors, crashes, kernel faults, and resource leaks.

The erasure-coding formulation uses $k$ data shards, $r$ parity shards, shard length $m$, data matrix $D\in\mathbb{F}^{k\times m}$, and generator matrix $G\in\mathbb{F}^{r\times k}$ over $\mathbb{F}=GF(2^w)$. Encoding is
$$
P=GD,
$$
where $P\in\mathbb{F}^{r\times m}$ are parity shards. Recovery from up to $r$ missing shards is written as
$$
X_{\text{missing}}=M^{-1}Y.
$$
The design supports XOR parity for $r=1$, RDP for $r=2$, and Reed–Solomon over $GF(2^w)$ for up to $r$ failures. FP16 KV tensors are losslessly reinterpreted as fixed-width integer bit patterns so that parity operations act on integer representations and exact FP16 values are recovered after decoding.

Resource planning is explicit. Memory overhead fraction is $\alpha=r/k$; an 8:2 configuration yields $\alpha=0.25$, or 25% of the KV-cache footprint in parity, versus 100% for full replication. KV size per layer is
$$
S_{\mathrm{KV,layer}}=L\cdot n_{\mathrm{heads}}\cdot d_{\mathrm{head}}\cdot b_{\mathrm{bytes}}\cdot 2,
$$
and across all layers
$$
S_{\mathrm{KV,total}}=S_{\mathrm{KV,layer}}\cdot N_{\mathrm{layers}},\qquad
S_{\mathrm{parity}}=\alpha\cdot S_{\mathrm{KV,total}}.
$$
For the worked FP16 example with $L=10^6$, $n_{\mathrm{heads}}=32$, $d_{\mathrm{head}}=128$, $b_{\mathrm{bytes}}=2$, and $N_{\mathrm{layers}}=80$, the paper gives $S_{\mathrm{KV,total}}\approx 1.31\text{ TB}$ and, with $k=8$ and $r=2$, $S_{\mathrm{parity}}\approx 327.68\text{ GB}$.

GhostServe’s reported evaluation, which the MemGhost blueprint inherits, shows up to 2.7x lower checkpointing latency than CPU replication, 2.1x faster recovery for a single batch, and 1.2x median response-latency improvements under failures. In 1M-token prefill, overhead drops from 2.6 minutes to 9 seconds. The paper also reports that the 8:2 setting reduces host memory overhead by 75% and checkpointing latency by 73% compared to replication, and that Effective-Inference-Time-Ratio remains above 90% under failures. In this context, MemGhost refers not to adversarial compromise or privacy leakage, but to a lightweight mechanism for preserving and reconstructing the hidden state on which long-context inference depends.

Source: https://www.emergentmind.com/topics/memghost