Memory is becoming a default subsystem in deployed LLM agents to provide persistent personalization and continuity. This naturally prompts a question: will memory system introduce new vulnerabilities into agents? Thus we propose InjecMEM, a novel memory injection attack paradigm that requires only a single interaction (no read/edit access to memory store) to steer later responses of related queries toward a pre-specified output. Guided by the retrieval-then-generate mechanism of memory systems, we craft the injection with a retriever-agnostic anchor and an adversarial command. The anchor contains high-recall topical cues so that downstream retrieval consistently associates the record with the target topic. The command is a short sequence optimized to remain effective under uncertain fused contexts, variable placements, and long prompts so that it reliably steers outputs once retrieved. We learn the command via gradient-based coordinate search, averaging over synthetic prompt templates and insertion positions, and extend it to joint optimization across backbones to study transfer. Evaluated across multiple memory systems and backbone models, InjecMEM achieves reliable topic-conditioned retrieval and targeted generation, remains effective under memory drift, and leaves non-target queries unaffected. Our results underscore the need to harden memory systems and provide a reproducible framework for studying agent memory.
Figures & tables
Figure 1: InjecMEM attack pipeline. The attacker inputs adversarial prompt, memory logs it. Benign users query about τ , the poisoned page will be retrieved and thus steers responses.
Table 1: RSR(%) across domains. Para: on-topic paragraph anchor. Cent: centroid anchor. @1 counts the first hit after injection; @k aggregates over the first k topic queries since injection.
Method
ASR-c
ASR-j
DPI
0.0
0.0
BadChain
0.0
0.0
GCG
0.0
0.0
Multi-GCG
76.6
35.6
Table 2: Average ASR(%) across domains. Multi-GCG succeeds whereas DPI, BadChain, and GCG fail.
System
RSR
ASR-c
ASR-j
MemoryOS
46.5
76.6
35.6
MemGPT
37.2
48.6
18.1
Table 3: Average attack performance on different memory systems.
Table 5
Figure 2: An example of indirect memory injection through compromised tools.
Appendix figures & tables9 assets
Supplementary material from the paper’s appendix.
Appendix
Defense
RSR ↓
ASR-j ↓
ASR-c ↓
BBR ↓
No defense
46.5
35.6
76.6
0.0
LLM-as-a-Judge
36.2
27.3
75.4
0.65
ProtectAI
39.1
29.8
76.3
0.0
PromptGuard
35.2
26.7
76.6
0.0
Perplexity
0.0
—
—
71.8
Appendix
Table 6: Evaluation under retrieve-time defenses (all values in %).
Domain
#Conv
Avg. pages/conv
Avg. words/conv
#Eval queries
agriculture
50
4.00
159.7
100
arts
50
3.26
84.2
105
beverage
50
3.00
79.2
102
education
50
3.00
77.6
98
energy
32
4.00
174.9
97
entertainment
50
3.08
135.0
96
Appendix
Table 7: Summary statistics of the released synthetic corpora. Avg. words/conv is a rough length proxy.
Topic
RSR@1
ASR-c
ASR-j
Health
64.7±7.02
71.1±2.06
46.0±5.29
Finance
60.0±8.00
67.5±2.71
40.7±7.02
Appendix
Table 8: Attack performance (%) using real-user WildChat conversations. Results are reported as mean ± standard deviation over three random seeds.
Method
Store access
Attack process
Activation
Primary goal
DPI / GCG
–
Single prompt
Immediate
Current-output steering
AgentPoison
Yes
Direct record poisoning
Backdoor trigger
Retrieval and action backdoor
MINJA
No
Progressive multi-turn injection
Victim term
Malicious reasoning and actions
InjecMEM
No
Single-shot anchor and command
Target topic
Retrieval and targeted generation
Appendix
Table 9: Comparison with representative prompt-injection and memory attacks.
Figure 3: High-level agent architecture. Left shows the agent core. Middle shows external modules including RAG and the memory system. Right illustrates the memory organization (STM, MTM, LPM). Other subsystems can poison memory via logged interactions.
Table 10: RSR(%) across Arts, Beverage, Education, and Energy domains.
Table 11: RSR(%) across Entertainment, Environment, Fashion, and Gaming domains.
Table 12: RSR(%) across Legal, Marketing, News, and Recruiting domains.
Table 13: RSR(%) across Security, Sports, Transportation, and Traveling domains.
Memory-augmented LLM-based agents are vulnerable to memory injection attacks: Agents may retrieve poisoned memory from attackers, which diverts their behavior from initial user intent and finally causes task failure. However, existing defense mechanisms either incur high computational cost or suffer from information redundancy in multi-turn contexts. To address these challenges, we propose Memory Intent-Aware Neural Denoising(MIND), a lightweight defense framework for memory injection attack. Our preliminary analysis reveals that benign and poisoned trajectories exhibit distinguishable relationships between the initial user intent and subsequent behavior. Building on this observation, MIND employs an intent-aware Information Bottleneck(IB) to extract compact intent--behavior representations from the initial intent and turn-level behavior. The IB preserves intent-relevant cross-turn attack signals while filtering task-irrelevant and repetitive information, and a lightweight detector identifies malicious memories from the resulting representations. As such, MIND mitigates information redundancy in multi-turn contexts while avoiding the overhead of repeated LLM auditing. Extensive experiments show that MIND reduces attack success rates while preserving task accuracy and inference efficiency. Notably, on ReAct-StrategyQA, MIND reduces mean ASR-r and ASR-a by 58.1% and 53.5%, respectively, while matching the undefended agent in average accuracy and latency.
Dongyi Liu, Haixing He, Xiaobao Wu +1
The Hong Kong University of Science and Technology (Guangzhou) · Shanghai Jiao Tong University · The Hong Kong University of Science and Technology
Memory is a core component of AI agents, enabling them to accumulate knowledge across interactions and improve performance. However, persistent memory introduces the risk of memory poisoning, where a single adversarial memory write can exert long-term influence over agent behavior. We present a systematic study of memory poisoning in LLM-based agents. We identify four memory write channels and nine structural vulnerabilities in model capabilities, system prompt design, and agent system architecture that make these channels exploitable. Based on these vulnerabilities, we develop a taxonomy of six classes of memory poisoning attacks. Furthermore, we design MPBench -- a benchmark for evaluating memory poisoning attacks, and show that agents designed to write and retrieve memory more aggressively are more exploitable. We also show that existing prompt injection defenses fail to cover memory poisoning attacks. Our findings provide a foundation for understanding and mitigating memory poisoning attacks against AI agents.
Pritam Dash, Tongyu Ge, Aditi Jain +2
Huawei Canada · University of Waterloo, Canada · Work done during an internship at Huawei.
Large language models are increasingly augmented with persistent memory, allowing assistants to store user-specific information across sessions for personalization and continuity. This statefulness introduces a new security risk: adversarial content can corrupt what an assistant remembers and thereby influence future interactions. We propose and study sleeper memory poisoning, a delayed attack in which an adversary manipulates external context, such as a document, webpage, or repository, to cause the assistant to store a fabricated memory about the user. Unlike conventional prompt injection, the attack can remain dormant and re-emerge across multiple later conversations. We evaluate the full attack pipeline: whether poisoned memories are written, later retrieved, and ultimately used to steer the following conversations. Across stateful LLM assistants, poisoned memories were added up to 99.8% on GPT-5.5 and 95% on Kimi-K2.6. Crucially, among successful retrievals, poisoned memories cause attacker-intended agentic actions in 60-89% of evaluations across models. These results show that persistent memory can act as a long-term attack surface across multiple future conversations.