Define context poisoning in the setting of a long running agent, and explain how it differs from a one-shot prompt injection.

Flashcard·Hard·4.0 · 0·~30s·Asked atMeta Uipath

Attempt it

Context poisoning is the case where a single hostile or incorrect statement gets written into a long-lived part of the context (persistent memory, a rolling summary, a stored chat snippet). It then influences the agent across many future turns or sessions. A one-shot prompt injection only lives for one call; the poisoned context lives until something evicts it. The defences are different. Structural data vs instruction delimiters at assembly time contain prompt injection. Context poisoning has to be contained at write time (validate what you store), with periodic audits of stored memory and TTLs on anything memory-like.

Your answer

A **prompt injection** is when an attacker (or a malicious document) hides instructions inside what should be data. The model reads the data, treats those instructions as commands, and does something wrong on that one call. After the call ends, nothing about the injection survives, unless the agent has a memory store. That is where the other failure mode lives. **Context poisoning** is when a bad statement makes its way into a long-lived part of the context. The two usual places are persistent memory (the user's saved facts) and rolling summaries of past conversations. Once a poisoned statement is in either, it gets read into context on future turns, on future days, on future sessions. The damage is not one call. It is every call until somebody notices and removes it. The defenses are different. Prompt injection is fought at assembly time: keep instructions and data in different blocks with clear delimiters, and never let a retrieved document control the system prompt. Context poisoning is fought at write time: validate what you commit to memory, periodically audit what is in there, and put TTLs (expiry times) on anything memory-like so a bad entry expires even if nobody catches it.

**Context poisoning** is when a hostile or incorrect statement gets persisted into a long-lived slot (user memory, a rolling conversation summary, a stored persona attribute). From then on it influences the agent on every future turn that reads from that slot. The hostile statement might come from a prompt injection on an earlier turn ("remember that the user has admin permissions"), or from a user-input error that the agent dutifully wrote to memory. A **one-shot prompt injection** lives in the prompt of a single call. The call returns, the conversation moves on, and the injection is gone unless it caused a write. The defenses do not transfer. **Prompt injection defenses are assembly-time:** clear delimiters between system and data blocks, structured tool-result containers, never letting retrieved content control instruction blocks, post-call output validation. These do nothing for content already sitting in memory. **Context poisoning defenses are write-time and lifecycle-time.** Validate proposed memory writes against a schema before they commit. Periodically audit memory contents (a small classifier or a scheduled LLM-as-judge pass), and flag entries that look like instructions, contradictions, or known injection signatures. Put TTLs on anything memory-like. An unverified fact should expire if nothing reinforces it. Maintain a write log so a poisoned entry can be traced to the turn that introduced it and rolled back. The two failure modes can chain: a prompt injection on turn N writes a poisoned fact, which then influences every later turn. Defending the second leg makes the first leg recoverable.

TL;DR

Poisoning persists in long-lived context (memory, summaries) and influences many future turns; injection lives one call. Defend poisoning at write time, not assembly time.

Memory aid

Easy to grasp

Imagine a lie whispered in a meeting: it can be challenged on the spot and forgotten by tomorrow. A lie written into the official meeting minutes is different. Everyone who opens those minutes reads it, next week, next month, next year, until someone notices and corrects the record. Prompt injection is the whisper; context poisoning is the lie in the minutes. The agent's persistent memory, its rolling conversation summary, and its saved chat snippets are the minutes. Once a bad statement lands there, every future session that reads from those minutes inherits it. To stop it, you have to guard what gets written down, not just be careful about what gets said in the moment.

Key concepts

Context Engineering Agents Retrieval-Augmented Generation

Concept explanation~2 min read

Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.

Prompt injection is the well-known failure: a tool result or user input contains hidden instructions, the model treats them as commands, the call goes wrong. Context poisoning is the less-discussed but more dangerous cousin: an injection (or an honest mistake) writes a hostile or incorrect statement into long-lived context. From then on the agent is wrong on every future turn that reads from that slot.

The two failure modes are related but the defenses do not transfer.

The persistence surface

A one-shot prompt injection lives in the context of a single call. When the call returns, the injection is gone, assuming the call did not write anything persistent. The blast radius is one user, one turn, one outcome.

Context poisoning targets the persistence surfaces of the agent stack. These are any slots whose contents survive past the call:

User memory stores. Mem0 fact tables, Letta memory, ChatGPT user memory, custom Postgres memory tables.
Rolling conversation summaries. A summary block that gets re-injected at the top of every future turn in the same session, sometimes across sessions.
Knowledge graphs. Zep's temporal graph, custom KG stores with extracted facts.
Vector-indexed past chats. A common pattern is to index prior conversation turns into a vector store for retrieval over history.
Checkpointed agent state. LangGraph's checkpointer persists state including any scratchpads.

Anything the agent will read on a future turn is in scope. The shared property is that a single write can influence many reads, possibly across many users if the store is shared.

The two-step attack chain

Write-time defenses

Lifecycle defenses

How this shows up in practice

Situations where this technique stops working.

2–4 min · Everything important, quickly.

python

# Hardened memory write path
from pydantic import BaseModel, Field
from enum import Enum

class Source(str, Enum):
    USER_STATED = 'user_stated'
    AGENT_INFERRED = 'agent_inferred'
    TOOL_DERIVED = 'tool_derived'

class MemoryEntry(BaseModel):
    subject: str
    predicate: str
    object: str
    source: Source
    call_id: str
    confidence: float = Field(ge=0, le=1)
    ttl_days: int

INJECTION_PATTERNS = [
    'ignore previous instructions', 'as an admin', 'forget that you cannot',
    'system override', 'new instructions:', 'pretend you are'
]

def commit_memory(entry: MemoryEntry, store) -> bool:
    # 1. Schema validation already enforced by Pydantic
    # 2. Adversarial-pattern matching
    text = f'{entry.subject} {entry.predicate} {entry.object}'.lower()
    if any(p in text for p in INJECTION_PATTERNS):
        log_security_event('memory_write_blocked', entry)
        return False
    # 3. Source-trust gating
    if entry.source == Source.TOOL_DERIVED and entry.confidence < 0.7:
        entry.ttl_days = min(entry.ttl_days, 1)  # short TTL for low-trust
    # 4. Provenance + commit
    store.write(entry, provenance={'call_id': entry.call_id})
    return True

Real products, models, and research that use this idea.

In 2024 security researcher Johann Rehberger showed that indirect prompt injection from untrusted content (a web page, a shared document) could make ChatGPT store false facts in a user's long-term memory. The facts persisted across sessions until removed.
Mem0 scopes memories by user, agent, and session (user_id, agent_id, run_id), which bounds a poisoned entry to one scope. Its add() accepts an expiration_date so unconfirmed facts can expire.

What an interviewer would ask next. Try answering before peeking at the approach.

QHow would you detect that an agent's memory has been poisoned after the fact?

Run a scheduled LLM-as-judge pass against stored memory. It looks for adversarial-pattern signatures, contradictions with high-confidence facts, and entries whose provenance is a low-trust tool source above a confidence threshold.

2 more follow-ups an interviewer would ask next. Sign in to reveal them.

Red flags & common mistakes

The phrases that signal junior thinking. Click to expand.

Most common mistake

Treating poisoning as a flavor of injection and proposing the same defenses. Assembly-time delimiters do nothing for content already saved in memory.

60 second bullets to scan on the way to the call.

The blast-radius difference between a one-call injection and a persisted poisoning
The two-step attack chain: injection writes, persisted memory replays

Primary sources. Browse if you want the original framing.