InjecMEM: Memory Injection Attack on LLM Agent Memory Systems
2026-08-24 • Cryptography and Security
Cryptography and SecurityArtificial Intelligence
AI summaryⓘ
The authors study a new type of security risk in language model agents that use memory to remember past interactions. They introduce InjecMEM, an attack that changes future responses by adding a special harmful memory entry with just one interaction, without needing to read or edit the memory later. The attack tricks the system by including clues that make the harmful memory easy to find, plus a hidden command that steers answers toward a chosen output. Tests show InjecMEM works across different models and memories without affecting unrelated queries, highlighting the need to protect these memory systems.
Large Language ModelsMemory Injection AttackRetrieval-then-GenerateAdversarial CommandPersistent PersonalizationAgent MemoryGradient-based OptimizationMemory DriftTargeted GenerationBackbone Models
Authors
Hanling Tian, Gengyu Zhang, Zeyang Sha, Jingying Wang, Yuhang Liu, Zhehao Huang, Kun Yang, Xiaolin Huang
Abstract
Memory is becoming a default subsystem in deployed LLM agents to provide persistent personalization and continuity. This naturally prompts a question: will memory system introduce new vulnerabilities into agents? Thus we propose InjecMEM, a novel memory injection attack paradigm that requires only a single interaction (no read/edit access to memory store) to steer later responses of related queries toward a pre-specified output. Guided by the retrieval-then-generate mechanism of memory systems, we craft the injection with a retriever-agnostic anchor and an adversarial command. The anchor contains high-recall topical cues so that downstream retrieval consistently associates the record with the target topic. The command is a short sequence optimized to remain effective under uncertain fused contexts, variable placements, and long prompts so that it reliably steers outputs once retrieved. We learn the command via gradient-based coordinate search, averaging over synthetic prompt templates and insertion positions, and extend it to joint optimization across backbones to study transfer. Evaluated across multiple memory systems and backbone models, InjecMEM achieves reliable topic-conditioned retrieval and targeted generation, remains effective under memory drift, and leaves non-target queries unaffected. Our results underscore the need to harden memory systems and provide a reproducible framework for studying agent memory.