Implement generative AI and agentic solutions 2.2 Build agents by using Foundry

A shopping agent uses Foundry Agent Service memory (preview) to remember user preferences.

Study guide skill: Build autonomous or semiautonomous workflows with safeguards and approval flow controls

Question B2-019

A shopping agent uses Foundry Agent Service memory (preview) to remember user preferences. You're worried that attackers could plant instructions in a conversation that get stored as memories and later steer the agent. Which two actions are recommended to mitigate this risk? (Choose two.)

Select 2 answers.

  • A Disable user profile memory and keep only procedural memory
  • B Validate prompts entering or leaving the memory system with Azure AI Content Safety prompt injection detection ✓ Correct answer
  • C Store memories in the agent's instructions instead of a memory store
  • D Regularly run attack and adversarial testing against the agent for injection vulnerabilities ✓ Correct answer
  • E Raise the memory update_delay so writes happen less often

Answer: B, D

Memories are extracted and consolidated by an LLM, so prompt injection and memory corruption can store harmful data that later influences responses. The recommended mitigations are to validate prompts entering or leaving memory with Azure AI Content Safety prompt injection detection and to regularly stress-test the agent with adversarial exercises. Changing memory types, delaying writes, or moving data into instructions doesn't detect injected content.

Deep dive

How it works

Foundry Agent Service memory (preview) is long-term memory. It extracts meaningful information from conversations, consolidates it into durable knowledge, and makes it available across sessions. That's what makes it useful, and also what makes it a target. If an attacker gets harmful text extracted as a "preference", it can influence later responses.

The memory page names these risks directly, prompt injection and memory corruption, and lists two mitigations:

  1. Validate with Azure AI Content Safety prompt injection detection. Check all prompts entering or leaving the memory system so malicious content doesn't get in or back out.
  2. Perform attack and adversarial testing. Regularly stress-test the agent for injection vulnerabilities with controlled adversarial exercises. The AI Red Teaming Agent is a natural tool for this.

Both target the content itself: one blocks it at the boundary, the other proves the defense works.

The other options, and when you'd use them

  • Disable user profile memory, keep procedural: Each memory type stores data inferred from conversations; procedural memory holds routines inferred from prior interactions. Changing type doesn't detect injected content.
  • Store memories in the instructions: It doesn't detect anything. The recommended defense is to validate prompts entering or leaving memory.
  • Raise update_delay: update_delay controls when memories are updated. It doesn't control what gets stored.

Exam tip

Memory poisoning = Content Safety prompt injection detection on memory input and output + regular adversarial testing. Timing and memory-type changes aren't defenses.

References

Last reviewed:

Ready to test yourself? The quiz asks this and every other AI-103 question, with instant feedback. Practice this in a quiz →

All Generative AI & agents questions · AI-103 study guide

Thanks for your feedback!