Backchain memory attacks expose hidden security risks in AI agents
BMA: Backchain Memory Attacks Create Unauthorized Control Paths in LLM Agents
Cryptography and Security
Summary
Large language model (LLM) agents remember past experiences to perform better, but this memory can be tricked. The authors show a new type of attack where bad information inserted earlier causes the AI to take unauthorized actions later, without changing the current task or memory directly. They created an attack method called Backchain Memory Attack (BMA) that figures out what memory would lead to a target action and then creates edits to trigger that. Their tests show BMA is more effective at making AI act wrongly through memory compared to other methods, but also suggest ways to reduce these risks.
What this means in practice
- •For ai security engineers: Detect and prevent attacks that use memory manipulation in AI systems controlling sensitive actions.
- •For enterprise ai system administrators: Implement memory-side protections and authorization controls to reduce unauthorized AI behaviors in deployed agents.
Authors
Kaisheng Fan, Yishu Gao, Xunzhu Tang, Tegawendé F. Bissyandé, Weizhe Zhang
Abstract
Persistent memory enables LLM agents to reuse prior experience, but creates a new security boundary: what an agent may remember is not what it should act on. We expose an unauthorized control path where edited low-trust evidence is consolidated into persistent memory, retrieved on a clean task, and used to drive a protected action. Crucially, the adversary neither writes memory nor alters the task. We introduce Backchain Memory Attack (BMA), a grey-box, LLM-driven inverse-planning attack that reasons backward from the target action to the memory that would trigger it, then to the evidence edit that would form it. BMA has two phases: preparation uses resettable trials to localize the first failed link and build experience; execution uses the frozen experience to rank and commit candidate edits without feedback. We introduce the Pathway-Certified Attack Success Rate (Path-CASR) to separate memory-mediated from coincidental hits: registered memory must form, be retrieved, drive the target behavior, and pass matched-intervention checks. Across four substrates and three decision backbones, BMA achieves 18.8% Macro Path-CASR, compared with 13.4% for the strongest access-matched baseline. Of BMA's behavioral hits, 60.3% pass all registered pathway and intervention checks versus 36.7% for the baseline. Frozen BMA edits retain 78.0% of their certified effect on average across four held-out consolidation policies. Representative memory-side controls leave 11.0% Path-CASR, whereas provenance-bound authorization reduces it to 2.0% while preserving 92.1% legitimate-action success.