Agent Memory Poisoning

Follow this topic Ask about this topic

Momentum

4 papers in the last four weeks, against 2 the four weeks before. 0.0% of all new papers.

Jul 13Week of Sep 28

Latest papers 54

All topics

VirusCascade: Hijacking Collaborative Reflection in LLM-Powered Recommender Agents
Sep 29, 2026Yurong Hao, Wen Zhou, Guowei Guan +3Adversarial Attacks Agent Memory Poisoning
College of Computing and Data Science, Nanyang Technological University
Share-Borne AI Virus: Memory-Hopping Attacks Across LLM Agents
Sep 28, 2026Sidharth Pulipaka, Ansh Sharma, Stanislau Hlebik +4AI Agent Security Agent Memory Poisoning
SPAR · University of Cambridge · APTA AI +1
From Attack Success to Attack Severity: Counterfactual Memory Attacks on LLM Agents
Sep 28, 2026Mingxi Zou, Langzhang Liang, Zhuo Wang +3Adversarial Attacks Agent Memory Poisoning
Shanghai Academy of AI for Science (SAIS) · Fudan University · Monash University
Emergence World: Adversarial Stress-Testing of Long-Horizon Multi-Agent Systems
Sep 15, 2026Deepak Akkil, Tamer Abuelsaad, Karthik Vikram +5Multi-Agent LLM Systems Long-Horizon Agent Evaluation
Emergence AI
CAPTURE: Disentangling Preference Drift from Memory Poisoning in Personalized LLM Agents
Sep 2, 2026S M Asif Hossain, Ruksat Khan Shayoni, Md Kishor MorolAgent Memory Poisoning LLM Agents
From Faulty Memories to Corrected Actions: Dependency-Guided Rollback Repair for Memory-Augmented Agents
Aug 11, 2026Caili Yu, Yiqi Wang, Jiaqi Zhang +5Agent Memory Poisoning Agent Memory Management
Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario
Aug 8, 2026Satoshi MatsuokaLLM Agent Security Agent Memory Poisoning
RIKEN Center for Computational Science, Kobe, Japan
Persistent Semantic Entities in Tool-Augmented LLM Systems
Aug 8, 2026Zhaohui WangAgent Memory Tool-Augmented Language Model Agents
USC Viterbi School of Engineering, University of Southern California, Los Angeles, CA, USA.
Controlled Memory Interference in Continual LLM Agents
Aug 7, 2026Ao Ding, Hongzong LI, Shiqin Tang +4Continual Learning for LLM Agents Agent Memory Poisoning
China University of Geosciences (Beijing) · Northwestern Polytechnical University · The Hong Kong University of Science and Technology +4
MAFIA: Query-Only Memory Attacks via Probing and Factual Injection against Audited LLM Agents
Aug 4, 2026Jiaming Chen, Yisen Gao, Yanping Li +3Agent Memory Poisoning Memory-Augmented Language Model Agents
The Hong Kong University of Science and Technology · Hong Kong SAR, China
MutMem: Cryptographically Authorized Mutation in Persistent Agent Memory
Aug 3, 2026Walid SaidiLLM Agent Memory Agent Memory Poisoning
Independent researcher
Salami Attack: Stealthy Collusive Memory Poisoning against OpenClaw
Aug 3, 2026Zheng Lin, Yuzhe Huang, Zhenxing Niu +2Agent Memory Poisoning Automated Red Teaming
Xidian University Xi’an, Shaanxi, China
MAPLE-Guard: Memory-Aware Link Enforcement Against Memory-Link Poisoning in Multi-Agent Systems
Aug 1, 2026Wenjun Xiong, Yijin Zhou, Jiaqian Wang +6Multi-Agent LLM Systems Agent Memory Poisoning
Shanghai Jiao Tong University · Shanghai Innovation Institute · Xidian University +2
Memory Provenance Laundering in LLM Agents: A Non-Amplification Firewall for Persistent Memory
Jul 31, 2026Jinghan Xu, Yiyong Xiao, Wanru Shao +2Persistent Memory for Language Models Agent Memory Poisoning
MIND: Lightweight and Effective Memory Injection Defense for LLM Agents via Intent-Aware Information Bottleneck
Jul 30, 2026Dongyi Liu, Haixing He, Xiaobao Wu +1Agent Memory Poisoning LLM Agent Safety
The Hong Kong University of Science and Technology (Guangzhou) · Shanghai Jiao Tong University · The Hong Kong University of Science and Technology
MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair
Jul 29, 2026Xuanze Chen, Xukang Xie, Wentao Fu +3Agent Memory Poisoning Memory Agent Benchmarks
Institute of Cyberspace Security, Zhejiang University of Technology, Hangzhou 310023, China · Binjiang Institute of Artificial Intelligence, ZJUT, Hangzhou 310056, China · College of Information Engineering, Zhejiang University of Technology, Hangzhou 310023, China
The Chronos Vulnerability: A Taxonomy of Temporal Persistence and Memory-Based Deception in Agentic AI
Jul 20, 2026Om Narayan, Ramkinker Singh, Praveen BaskarAdversarial Attacks AI Agent Security
Department of Computer Science New York University New York, NY, USA · Carnegie Mellon University Pittsburgh, PA, USA · Independent Researcher Chicago, IL, USA
Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?
Jul 20, 2026Yimeng Chen, Nathanaël Denis, Roberto Di Pietro +1AI Agent Security Agent Memory Poisoning
Center of Excellence for Generative AI, King Abdullah University of Science and Technology · The Swiss AI Lab, IDSIA-USI/SUPSI
Do Agents Dream of False Memories? Black-box Visual Attacks on Long-term Memory in Multimodal AI Agents
Jul 17, 2026Halima Bouzidi, Mboutidem Ekemini Mkpong, Mohammad Abdullah Al FaruqueMultimodal Memory Agent Memory Poisoning
University of California, Irvine
MemPoison: Uncovering Persistent Memory Threats and Structural Blind Spots in LLM Agents
Jul 16, 2026Jifeng Gao, Kang Xia, Yi Zhang +5LLM Agent Memory LLM Agent Security
State Key Laboratory for Novel Software Technology, Nanjing University, China · NARI Group Corporation/State Grid Electric Power Research Institute, China
Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems
Jul 16, 2026Soham Gadgil, David Alexander, Sai Sunku +1AI Agent Security Agent Memory Poisoning
University of Washington Seattle, WA, USA
The Compliance Trap: Diagnosing How AI Agents Consume Conflicting Memory
Jul 12, 2026Yixiong Chen, Xinyi Bai, Alan YuilleWeb Agent Benchmarks Long-Horizon Agent Evaluation
1Johns Hopkins University · 2Cornell University
When Agents Remember Too Much: Memory Poisoning Attacks on Large Language Model Agents
Jul 6, 2026George Torres, Sharad Shrestha, Satyajayant MisraAI Agent Security LLM Agent Security
‡∗§Department of Computer Science, §Klipsch School of Electrical and Computer Engineering New Mexico State University, Las Cruces, New Mexico, USA · §Klipsch School of Electrical and Computer Engineering New Mexico State University, Las Cruces, New Mexico, USA
When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents
Jul 6, 2026Yechao Zhang, Shiqian Zhao, Jiawen Zhang +5AI Agent Security Benchmarks Agent Memory Poisoning
Nanyang Technological University · CFAR, A*STAR · Johns Hopkins University
Your Agent's Memories Are Not Its Own: Forged Reasoning Attacks on LLM Agent Memory and Defenses
Jul 6, 2026Neeraj Karamchandani, Piyush Nagasubramaniam, Sencun Zhu +1LLM Agent Memory Agent Memory Poisoning
The Pennsylvania State University, University Park, PA, USA
ElephantAgent: Contextual State Continuity in Agentic Systems
Jul 2, 2026Jiankai Jin, Xiangzheng Zhang, Zhao Liu +4Adversarial Attacks AI Agent Security
AI Security Lab · Beijing, China
Retrieval Observability Bounds on Provenance Detection for Agent Memory Poisoning: Measured Coverage and a Falsified Standalone Detector
Jun 29, 2026Jun Wen LeongRAG Poisoning Attacks Agent Memory Poisoning
Manufactured Confidence: How Memory Consolidation Turns Hearsay into Confident Facts
Jun 28, 2026Alex KwonAI Agent Reliability LLM Agent Memory
Independent Researcher
Memory as an Attack Surface in LLM Agents: A Study on Multiple-Choice Question Answering
Jun 27, 2026Shahnewaz Karim Sakib, Anindya Bijoy DasAgent Memory Poisoning LLM Agent Reliability
University of Tennessee at Chattanooga, TN 37403, USA · The University of Akron, OH 44325, USA
Forget to Improve: On-Device LLM-Agent Continual Learning via Budget-Curated Memory
Jun 23, 2026Beining Wu, Zihao Ding, Jun Huang +1Continual Learning for LLM Agents LLM Agent Memory
Department of Electrical Engineering and Computer Science, South Dakota State University, Brookings, SD 57007, USA · Virginia Commonwealth University, Richmond, VA, USA

Sep 29, 2026, cs.CRJ/K move · Enter open · S save

VirusCascade: Hijacking Collaborative Reflection in LLM-Powered Recommender Agents

Yurong Hao, Wen Zhou, Guowei Guan, Tiantong Wu+2

College of Computing and Data Science, Nanyang Technological University

Adversarial Attacks Agent Memory Poisoning Large Language Model-Based Recommendation Black-Box Adversarial Attacks Multi-Agent System Security

Open paper AskPDF arXiv

Advancing beyond traditional static scoring models, LLM-powered agentic recommender systems (LLM-ARS) instantiate users and items as autonomous agents, whose semantic states are dynamically refined through a recurrent process known as collaborative reflection. While this mechanism improves recommendation quality, it simultaneously introduces a systemic vulnerability: adversarial evidence injected into a single agent can be rationalised into a legitimate preference narrative, written back into memory, and propagated to other agents through interaction contexts. We term the local rationalisation process reflection laundering, and its system-wide escalation through collaborative reflection collaborative-reflection hijacking. Existing attacks on recommender systems, whether based on interaction-level data poisoning or text-level adversarial perturbations, assume static pipelines and thus cannot exploit this recurrent, multi-agent amplification pathway. To bridge this gap, we first conduct a controlled vulnerability analysis that establishes two exploitable properties underlying collaborative-reflection hijacking: reflective persistence and cross-agent propagation. Then building on these findings, we propose VirusCascade, the first black-box targeted promotion attack that jointly shapes semantic and structural attack surfaces: the former ensures the target item is naturally rationalised as satisfying broad user preferences, the latter positions it for system-wide propagation. Extensive experiments on four real-world datasets across diverse LLM-ARS architectures demonstrate that VirusCascade consistently achieves state-of-the-art targeted exposure under evaluated stealth constraints, reaching a mean E@20 of 0.384 and surpassing the strongest baseline by an absolute margin of +0.185.

Momentum

Related topics

Latest papers 54