Research map / Multi-agent systems and games / LLM agents
Memory Injection Attacks on LLM Agents via Query-Only Interaction
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes MINJA, a query-only memory injection attack that poisons an LLM agent's shared long-term memory via bridging steps, an indication prompt, and progressive shortening, redirecting victim queries to target entities.
Problem
LLM agents with retrieval-based long-term memory can be poisoned with malicious demonstrations; prior attacks assume direct memory write access, which is unrealistic. The paper asks whether an attacker who only interacts via normal queries can inject malicious records that later affect other users'
Approach
Injects malicious records solely through normal queries by appending an indication prompt that makes the agent generate 'bridging steps' linking the victim term to a target term, then progressively removes the indication prompt so the stored record resembles benign queries and is retrieved for victim queries.
Key results
- Across settings, MINJA achieves an average injection success rate (ISR) of 98.2% and average attack success rate (ASR) of 76.8%.
- On GPT-4o-based RAP on Webshop, ASR reaches 98.9% with ISR 99.3%.
- Utility drop is small for MIMIC-III, eICU and Webshop (under 2%) but reaches -10.0% on MMLU QA agent.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply MINJA query-only memory injection | EHR agent (GPT-4) · eICU | ISR: 98.5 | Helped |
| Apply MINJA query-only memory injection | RAP (GPT-4o) · Webshop | ASR: 98.9 | Helped |
| Apply MINJA query-only memory injection | QA Agent (GPT-4) · MMLU | UD: -10.0 | Hurt |
| Add prior poisoning to the memory bank before the subsequent injection (ablation) | MINJA on EHR agent · MIMIC-III (Pair 2) | ISR: 100.0 -> 93.3 | Hurt |
| Add prior poisoning to the memory bank before the subsequent injection (ablation) | MINJA on EHR agent · MIMIC-III (Pair 2) | ASR: 50.0 -> 30.0 | Hurt |
| Add Gaussian noise ($\sigma$ = 0.01) to retrieval embeddings (ablation) | MINJA on RAP (GPT-4o) · Webshop | ASR: 97.8 -> 95.6 | Hurt |
| Increase benign queries from 25 to 100 (ablation) | MINJA on EHR agent · MIMIC-III | ASR: 68.9 -> 31.1 | Hurt |
| Increase benign queries from 25 to 100 (ablation) | MINJA on EHR agent · eICU | ASR: 95.6 -> 88.9 | Mixed |
| Increase benign queries from 25 to 100 (ablation) | MINJA on RAP (GPT-4o) · Webshop | ASR: 98.9 -> 97.8 | No clear effect |
| Add Gaussian retrieval noise (ablation) | MINJA on RAP (GPT-4o) · Webshop | ISR: 100.0 -> 100.0 | No clear effect |
| Use alternative embedding models for memory retrieval (ablation) | MINJA on EHRAgent · EHRAgent settings | attack performance | No clear effect |
Surprising findings
- Embedding-level memory sanitization fails because malicious and benign records are highly entangled in embedding space.
- A targeted detection prompt catches nearly all EHR attacks but detects none on RAP or QA agent, while a general prompt raises false positives (34/50 on EHR-MIMIC).
Limitations
- Small models (Llama-2-7B) lack basic task utility, so the attack was not meaningfully evaluated on them.
- Prior poisoning and larger benign memory densities reduce ASR (e.g., MIMIC-III ASR falls to 31.1% at 100 benign queries).
- Defenses were only evaluated with prompt-level detection using GPT-4o; system-level defenses were discussed but not empirically tested.
Experimental setup
Datasets: MIMIC-III eICU Webshop MMLU
Benchmarks: MIMIC-III eICU Webshop MMLU
Metrics: ISR ASR UD
Baselines: AgentPoison
Builds on: ReAct RAP EHRAgent AgentPoison chain-of-thought
Closest papers by meaning
- A-MemGuard: A Proactive Defense Framework For LLM-Based Agent Memory (ICML 2026 · similarity 0.93)
- Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents (ICLR 2025 · similarity 0.89)
- AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents (NeurIPS 2024 · similarity 0.88)
- DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents (NeurIPS 2025 · similarity 0.88)
- Attractive Metadata Attack: Inducing LLM Agents to Invoke Malicious Tools (NeurIPS 2025 · similarity 0.88)
- AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents (ICLR 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.