mlsanityData to 7 Oct 2026

ADAM: A Systematic Data Extraction Attack on Agent Memory via Adaptive Querying

arXiv 2604.09747 ↗First posted 10 Apr 2026cs.CR cs.AIcited by 5

On the map: LLM agents and tool use → Agent threats, guardrails and governance

also in 1 more
Abstract (arXiv)

Large Language Model (LLM) agents have achieved rapid adoption and demonstrated remarkable capabilities across a wide range of applications. To improve reasoning and task execution, modern LLM agents would incorporate memory modules or retrieval-augmented generation (RAG) mechanisms, enabling them to further leverage prior interactions or external knowledge. However, such a design also introduces a group of critical privacy vulnerabilities: sensitive information stored in memory can be leaked through query-based attacks. Although feasible, existing attacks often achieve only limited performance, with low attack success rates (ASR). In this paper, we propose ADAM, a novel privacy attack that features data distribution estimation of a victim agent's memory and employs an entropy-guided query strategy for maximizing privacy leakage. Extensive experiments demonstrate that our attack substantially outperforms state-of-the-art ones, achieving up to 100% ASRs. These results thus underscore the urgent need for robust privacy-preserving methods for current LLM agents.

Key facts. Cited by 5 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 27 of its 37 references that are in the map. First posted on arXiv 10 Apr 2026.

Builds on

27 of 37 references.

Closest ancestors · 2

Same direction, newest first

  1. 2025Unveiling Privacy Risks in LLM Agent Memory17 Feb
  2. 2024EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage17 Sep

Other references · 25

  1. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,160
  2. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,355
  3. 2024Evaluating Very Long-Term Conversational Memory of LLM Agentscited by 800
  4. 2025Mem0: Building Production-Ready AI Agents with Scalable Long-Term Memorycited by 722
  5. 2023Certifying LLM Safety against Adversarial Promptingcited by 248
  6. 2025Agentic Retrieval-Augmented Generation: A Survey on Agentic RAGcited by 242
  7. 2023Query Rewriting for Retrieval-Augmented Large Language Modelscited by 211
  8. 2025A Comprehensive Survey of Self-Evolving AI Agents: A New Paradigm Bridging Foundation Models and Lifelong Agentic Systemscited by 177
  9. 2023Defending Against Alignment-Breaking Attacks via Robustly Aligned LLMcited by 173
  10. 2023A Language Agent for Autonomous Drivingcited by 161
  11. 2024The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)cited by 159
  12. 2018Adversarial Active Learning for Deep Networks: a Margin Based Approachcited by 155
13 more
  1. 2025Advances and Challenges in Foundation Agents: From Brain-Inspired Intelligence to Evolutionary, Collaborative, and Safe Systemscited by 125
  2. 2024A Comprehensive Study of Jailbreak Attack versus Defense for Large Language Modelscited by 95
  3. 2024RAG-Driver: Generalisable Driving Explanations with Retrieval-Augmented In-Context Learning in Multi-Modal Large Language Modelcited by 91
  4. 2024Follow My Instruction and Spill the Beans: Scalable Data Extraction from Retrieval-Augmented Generation Systemscited by 76
  5. 2024Large Language Model Agent in Financial Trading: A Surveycited by 60
  6. 2024LegalAgentBench: Evaluating LLM Agents in Legal Domaincited by 56
  7. 2024Self-evolving Agents with reflective and memory-augmented abilitiescited by 52
  8. 2024Unleashing Worms and Extracting Data: Escalating the Outcome of Attacks against RAG-based Inference in Scale and Severity Using Jailbreakingcited by 30
  9. 2024DriVLMe: Enhancing LLM-based Autonomous Driving Agents with Embodied and Social Experiencescited by 27
  10. 2024Pirates of the RAG: Adaptively Attacking LLMs to Leak Knowledge Basescited by 17
  11. 2025LLM-Empowered Embodied Agent for Memory-Augmented Task Planning in Household Roboticscited by 15
  12. 2025Attack and defense techniques in large language models: A survey and new perspectivescited by 13
  13. 2025Procedural Memory Is Not All You Need: Bridging Cognitive Gaps in LLM-Based Agentscited by 9

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 5.

5 papers.

  1. 2026Safety in Self-Evolving LLM Agent Systems: Threats, Amplification, and Case Studiescited by 6
  2. 2026DP-MemView: A Memory Interface for Attribute-Level Transcript Privacy in Long-Term LLM Agentscited by 0
  3. 2026Extracting Knowledge from Tools in LLM Agentscited by 0
  4. 2026Inferring Hidden User Models from the Behavior of Personalized LLM Agentscited by 0
  5. 2026Connecting the Dots in Agentic AI Security: A Cross-Dimensional Threat Taxonomy, Evaluation Maturity, and Open Challengescited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents
  2. 2025Memory Injection Attacks on LLM Agents via Query-Only Interaction
  3. 2026Spore: Efficient and Training-Free Privacy Extraction Attack on LLMs via Inference-Time Hybrid Probing
  4. 2026AIM: A Privacy-Aware Interoperable Memory Framework for Multi-Agent Multi-User LLM Systems
  5. 2025Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks
  6. 2026Privacy-Preserving RAG via Multi-Agent Semantic Rewriting: Achieving Confidentiality Without Compromising Contextual Fidelity
  7. 2026FragFuse: Bypassing Access Control of Large Language Model Agents via Memory-Based Query Fragmentation and Fusion
  8. 2026Confuse the Model, Control the Flow: Understanding and Mitigating Privacy Leakage from LLM Agents with Information Flow Control