mlsanityData to 7 Oct 2026

Memory Injection Attacks on LLM Agents via Query-Only Interaction

arXiv 2503.03704 ↗First posted 5 Mar 2025cs.LGcited by 127

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Agents powered by large language models (LLMs) have demonstrated strong capabilities in a wide range of complex, real-world applications. However, LLM agents with a compromised memory bank may easily produce harmful outputs when the past records retrieved for demonstration are malicious. In this paper, we propose a novel Memory INJection Attack, MINJA, without assuming that the attacker can directly modify the memory bank of the agent. The attacker injects malicious records into the memory bank by only interacting with the agent via queries and output observations. These malicious records are designed to elicit a sequence of malicious reasoning steps corresponding to a different target query during the agent's execution of the victim user's query. Specifically, we introduce a sequence of bridging steps to link victim queries to the malicious reasoning steps. During the memory injection, we propose an indication prompt that guides the agent to autonomously generate similar bridging steps, with a progressive shortening strategy that gradually removes the indication prompt, such that the malicious record will be easily retrieved when processing later victim queries. Our extensive experiments across diverse agents demonstrate the effectiveness of MINJA in compromising agent memory. With minimal requirements for execution, MINJA enables any user to influence agent memory, highlighting the risk.

Key facts. Cited by 127 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 28 of its 50 references that are in the map. First posted on arXiv 5 Mar 2025.

Builds on

28 of 50 references.

Closest ancestors · 1

Same direction, newest first

  1. 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases17 Jul

Other references · 27

  1. 2022Chain-of-Thought Prompting Elicits Reasoning in Large Language Modelscited by 12,302
  2. 2020Measuring Massive Multitask Language Understandingcited by 7,768
  3. 2020Dense Passage Retrieval for Open-Domain Question Answeringcited by 3,779
  4. 2020REALM: Retrieval-Augmented Language Model Pre-Trainingcited by 2,126
  5. 2023WebArena: A Realistic Web Environment for Building Autonomous Agentscited by 1,908
  6. 2023MetaGPT: Meta Programming for A Multi-Agent Collaborative Frameworkcited by 1,761
  7. 2022WebShop: Towards Scalable Real-World Web Interaction with Grounded Language Agentscited by 1,197
  8. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  9. 2020Approximate Nearest Neighbor Negative Contrastive Learning for Dense Text Retrievalcited by 846
  10. 2023ExpeL: LLM Agents Are Experiential Learnerscited by 814
  11. 2024A Survey on the Memory Mechanism of Large Language Model based Agentscited by 622
  12. 2024GPT-4V(ision) is a Generalist Web Agent, if Groundedcited by 547
15 more
  1. 2023MemoryBank: Enhancing Large Language Models with Long-Term Memorycited by 539
  2. 2024MapCoder: Multi-Agent Code Generation for Competitive Problem Solvingcited by 177
  3. 2023A Language Agent for Autonomous Drivingcited by 161
  4. 2021Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfercited by 147
  5. 2024Efficient Adversarial Training in LLMs with Continuous Attackscited by 104
  6. 2020Trojaning Language Models for Fun and Profitcited by 80
  7. 2024RAP: Retrieval-Augmented Planning with Contextual Memory for Multimodal LLM Agentscited by 80
  8. 2024EHRAgent: Code Empowers Large Language Models for Few-shot Complex Tabular Reasoning on Electronic Health Recordscited by 75
  9. 2024Robust LLM safeguarding via refusal feature adversarial trainingcited by 60
  10. 2023Personalized Autonomous Driving with Large Language Models: Field Experimentscited by 46
  11. 2024On the Structural Memory of LLM Agentscited by 37
  12. 2024INMS: Memory Sharing for Large Language Model based Agentscited by 31
  13. 2023TrojText: Test-time Invisible Textual Trojan Insertioncited by 26
  14. 2024KoMA: Knowledge-driven Multi-agent Framework for Autonomous Driving with Large Language Modelscited by 16
  15. 2025Episodic memory in AI agents poses risks that should be studied and mitigatedcited by 11

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 13; 2026: 114.

127 papers.

Sort:

By area:

  1. 2025A-MemGuard: A Proactive Defense Framework for LLM-Based Agent Memorycited by 61
  2. 2026A Survey of Agent Memory in the Second Half: Towards Self-Evolving and Long-Horizon Agentscited by 40
  3. 2026AgentLAB: Benchmarking LLM Agents against Long-Horizon Attackscited by 31
  4. 2026From Agent Traces to Trust: A Survey of Evidence Tracing and Execution Provenance in LLM Agentscited by 29
  5. 2025LLM Agents Should Employ Security Principlescited by 28
  6. 2025Real AI Agents with Fake Memories: Fatal Context Manipulation Attacks on Web3 Agentscited by 23
  7. 2026From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agentscited by 23
  8. 2026Hidden in Memory: Sleeper Memory Poisoning in LLM Agentscited by 22
  9. 2026A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecyclecited by 21
  10. 2026Your Agent, Their Asset: A Real-World Safety Analysis of OpenClawcited by 19
  11. 2025A Survey on Agentic Security: Applications, Threats and Defensescited by 17
  12. 2026From Storage to Steering: Memory Control Flow Attacks on LLM Agentscited by 17
38 more
  1. 2026A Framework for Formalizing LLM Agent Securitycited by 16
  2. 2025SafeScientist: Toward Risk-Aware Scientific Discoveries by LLM Agentscited by 14
  3. 2026Ghost in the Agent: Redefining Information Flow Tracking for LLM Agentscited by 14
  4. 2026MemLineage: Lineage-Guided Enforcement for LLM Agent Memorycited by 14
  5. 2026Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guaranteescited by 14
  6. 2026ARGUS: Defending LLM Agents Against Context-Aware Prompt Injectioncited by 13
  7. 2026Trojan Hippo: Weaponizing Agent Memory for Data Exfiltrationcited by 12
  8. 2026The Evolution of Tool Use in LLM Agents: From Single-Tool Call to Multi-Tool Orchestrationcited by 11
  9. 2025Context manipulation attacks : Web agents are susceptible to corrupted memorycited by 10
  10. 2025Agent Safety Alignment via Reinforcement Learningcited by 10
  11. 2025Topology Matters: Measuring Memory Leakage in Multi-Agent LLMscited by 9
  12. 2026A Systematic Survey of Security Threats and Defenses in LLM-Based AI Agents: A Layered Attack Surface Frameworkcited by 9
  13. 2026OEP: Poisoning Self-Evolving LLM Agents via Locally Correct but Non-Transferable Experiencescited by 9
  14. 2026SOK: A Taxonomy of Attack Vectors and Defense Strategies for Agentic Supply Chain Runtimecited by 8
  15. 2026MemMorph: Tool Hijacking in LLM Agents via Memory Poisoningcited by 8
  16. 2026Forget to Improve: On-Device LLM-Agent Continual Learning via Budget-Curated Memorycited by 8
  17. 2026FlowSteer: Prompt-Only Workflow Steering Exposes Planning-Time Vulnerabilities in Multi-Agent LLM Systemscited by 7
  18. 2026Poise: Position-Aware One-Instruction Skill Injection for Silent Execution on LLM Agentscited by 7
  19. 2025Takedown: How It's Done in Modern Coding Agent Exploitscited by 6
  20. 2026No Attacker Needed: Unintentional Cross-User Contamination in Shared-State LLM Agentscited by 6
  21. 2026When Does Belief-Based Agent Memory Help? Reliability-Conditional Updating and Provenance-Capped Poisoning Defensecited by 6
  22. 2026When Memory Becomes Authority: Benchmarking Authority Collapse at the Memory Consolidation Boundarycited by 6
  23. 2026Mind Your HEARTBEAT! Claw Background Execution Inherently Enables Silent Memory Pollutioncited by 5
  24. 2026Contextual Agentic Memory is a Memo, Not True Memorycited by 5
  25. 2026Injection-Execution Dissociation: A Mechanistic Evaluation of Persistent Memory Attacks and Defenses in Stateful LLM Agentscited by 5
  26. 2026Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluationcited by 5
  27. 2026TRUSTMEM: Learning Trustworthy Memory Consolidation for LLM Agents with Long-Term Memorycited by 5
  28. 2025Evo-MARL: Co-Evolutionary Multi-Agent Reinforcement Learning for Internalized Safetycited by 4
  29. 2026ER-MIA: Black-Box Adversarial Memory Injection Attacks on Long-Term Memory-Augmented Large Language Modelscited by 4
  30. 2026Memory poisoning and secure multi-agent systemscited by 4
  31. 2026Visual Inception: Compromising Long-term Planning in Agentic Recommenders via Multimodal Memory Poisoningcited by 4
  32. 2026SMSR: Certified Defence Against Runtime Memory Poisoning in Persistent LLM Agent Systemscited by 4
  33. 2026FragFuse: Bypassing Access Control of Large Language Model Agents via Memory-Based Query Fragmentation and Fusioncited by 4
  34. 2025VerificAgent: Domain-Specific Memory Verification for Scalable Oversight of Aligned Computer-Use Agentscited by 3
  35. 2026An AI Agent Execution Environment to Safeguard User Datacited by 3
  36. 2026MEMSAD: Gradient-Coupled Anomaly Detection for Memory Poisoning in Retrieval-Augmented Agentscited by 3
  37. 2026EquiMem: Calibrating Shared Memory in Multi-Agent Debate via Game-Theoretic Equilibriumcited by 3
  38. 2026Dissociative Identity: Language Model Agents Lack Grounding for Reputation Mechanismscited by 3

50 most cited of 127 All 127 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2025Unveiling Privacy Risks in LLM Agent Memory
  2. 2025MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval
  3. 2026Hijacking Agent Memory: Stealthy Trojan Attacks Through Conversational Interaction
  4. 2026ADAM: A Systematic Data Extraction Attack on Agent Memory via Adaptive Querying
  5. 2025A Multi-Agent LLM Defense Pipeline Against Prompt Injection Attacks
  6. 2025Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks
  7. 2024Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems
  8. 2026AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Management