Memory is becoming a default subsystem in deployed LLM agents to provide persistent personalization and continuity. This naturally prompts a question: will memory system introduce new vulnerabilities into agents? Thus we propose InjecMEM, a novel memory injection attack paradigm that requires only a single interaction (no read/edit access to memory store) to steer later responses of related queries toward a pre-specified output. Guided by the retrieval-then-generate mechanism of memory systems, we craft the injection with a retriever-agnostic anchor and an adversarial command. The anchor contains high-recall topical cues so that downstream retrieval consistently associates the record with the target topic. The command is a short sequence optimized to remain effective under uncertain fused contexts, variable placements, and long prompts so that it reliably steers outputs once retrieved. We learn the command via gradient-based coordinate search, averaging over synthetic prompt templates and insertion positions, and extend it to joint optimization across backbones to study transfer. Evaluated across multiple memory systems and backbone models, InjecMEM achieves reliable topic-conditioned retrieval and targeted generation, remains effective under memory drift, and leaves non-target queries unaffected. Our results underscore the need to harden memory systems and provide a reproducible framework for studying agent memory.
Figures & tables
Figure 1: InjecMEM attack pipeline. The attacker inputs adversarial prompt, memory logs it. Benign users query about τ , the poisoned page will be retrieved and thus steers responses.
Table 1: RSR(%) across domains. Para: on-topic paragraph anchor. Cent: centroid anchor. @1 counts the first hit after injection; @k aggregates over the first k topic queries since injection.
Method
ASR-c
ASR-j
DPI
0.0
0.0
BadChain
0.0
0.0
GCG
0.0
0.0
Multi-GCG
76.6
35.6
Table 2: Average ASR(%) across domains. Multi-GCG succeeds whereas DPI, BadChain, and GCG fail.
System
RSR
ASR-c
ASR-j
MemoryOS
46.5
76.6
35.6
MemGPT
37.2
48.6
18.1
Table 3: Average attack performance on different memory systems.
Table 5
Figure 2: An example of indirect memory injection through compromised tools.
Appendix figures & tables9 assets
Supplementary material from the paper’s appendix.
Appendix
Defense
RSR ↓
ASR-j ↓
ASR-c ↓
BBR ↓
No defense
46.5
35.6
76.6
0.0
LLM-as-a-Judge
36.2
27.3
75.4
0.65
ProtectAI
39.1
29.8
76.3
0.0
PromptGuard
35.2
26.7
76.6
0.0
Perplexity
0.0
—
—
71.8
Appendix
Table 6: Evaluation under retrieve-time defenses (all values in %).
Domain
#Conv
Avg. pages/conv
Avg. words/conv
#Eval queries
agriculture
50
4.00
159.7
100
arts
50
3.26
84.2
105
beverage
50
3.00
79.2
102
education
50
3.00
77.6
98
energy
32
4.00
174.9
97
entertainment
50
3.08
135.0
96
Appendix
Table 7: Summary statistics of the released synthetic corpora. Avg. words/conv is a rough length proxy.
Topic
RSR@1
ASR-c
ASR-j
Health
64.7±7.02
71.1±2.06
46.0±5.29
Finance
60.0±8.00
67.5±2.71
40.7±7.02
Appendix
Table 8: Attack performance (%) using real-user WildChat conversations. Results are reported as mean ± standard deviation over three random seeds.
Method
Store access
Attack process
Activation
Primary goal
DPI / GCG
–
Single prompt
Immediate
Current-output steering
AgentPoison
Yes
Direct record poisoning
Backdoor trigger
Retrieval and action backdoor
MINJA
No
Progressive multi-turn injection
Victim term
Malicious reasoning and actions
InjecMEM
No
Single-shot anchor and command
Target topic
Retrieval and targeted generation
Appendix
Table 9: Comparison with representative prompt-injection and memory attacks.
Figure 3: High-level agent architecture. Left shows the agent core. Middle shows external modules including RAG and the memory system. Right illustrates the memory organization (STM, MTM, LPM). Other subsystems can poison memory via logged interactions.
Table 10: RSR(%) across Arts, Beverage, Education, and Energy domains.
Table 11: RSR(%) across Entertainment, Environment, Fashion, and Gaming domains.
Table 12: RSR(%) across Legal, Marketing, News, and Recruiting domains.
Table 13: RSR(%) across Security, Sports, Transportation, and Traveling domains.