---
title: "InjecMEM: Memory Injection Attack on LLM Agent Memory Systems"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2608.23471v1"
permalink: "https://feed.astralor.com/items/itm_e79f503d2d4e9aea7c8803ae"
published: "2026-08-24T16:37:50.000Z"
score: 76
channel: "ai"
tags: ["arXiv","InjecMEM","LLM Agent","Prompt Injection","Memory System"]
---

# InjecMEM: Memory Injection Attack on LLM Agent Memory Systems

## AI commentary

> What stands out most is how the paper avoids hype and targets a real blind spot—memory systems that are rapidly becoming the default in deployed agents. For teams building personalized agents, this is a threat model they need to understand early, especially those relying on vector stores and RAG for long-term memory; retrieval trust boundaries may need a fundamental rethink.

## At a glance

Memory is becoming a default subsystem in deployed LLM agents to provide persistent personalization and continuity, yet it may introduce new security vulnerabilities. This paper proposes InjecMEM, a novel memory injection attack paradigm that requires only a single interaction (no read/edit access to memory store) to steer later responses of related queries toward a pre-specified output. Guided by the retrieval-then-generate mechanism of memory systems, the injection consists of a retriever-agnostic anchor and an adversarial command. The anchor contains high-recall topical cues so that downstream retrieval consistently associates the record with the target topic; the command is a short sequence optimized via gradient-based coordinate search to remain effective under uncertain fused contexts, variable placements, and long prompts. Evaluated across multiple memory systems and backbone models, InjecMEM achieves reliable topic-conditioned retrieval and targeted generation, remains effective under memory drift, and leaves non-target queries unaffected. The results underscore the need to harden memory systems and provide a reproducible framework for studying agent memory security.

## Key points

- Attack requires only a single interaction with no read/edit access to the memory store, creating a broad attack surface.
- Combines retriever-agnostic anchors with adversarially optimized commands via gradient-based coordinate search, enabling cross-model transfer.
- Validated across multiple memory systems and backbones, achieving reliable targeted generation while leaving non-target queries unaffected and remaining robust to memory drift.

## Full text

Memory is becoming a default subsystem in deployed LLM agents to provide persistent personalization and continuity. This naturally prompts a question: will memory system introduce new vulnerabilities into agents? Thus we propose InjecMEM, a novel memory injection attack paradigm that requires only a single interaction (no read/edit access to memory store) to steer later responses of related queries toward a pre-specified output. Guided by the retrieval-then-generate mechanism of memory systems, we craft the injection with a retriever-agnostic anchor and an adversarial command. The anchor contains high-recall topical cues so that downstream retrieval consistently associates the record with the target topic. The command is a short sequence optimized to remain effective under uncertain fused contexts, variable placements, and long prompts so that it reliably steers outputs once retrieved. We learn the command via gradient-based coordinate search, averaging over synthetic prompt templates and insertion positions, and extend it to joint optimization across backbones to study transfer. Evaluated across multiple memory systems and backbone models, InjecMEM achieves reliable topic-conditioned retrieval and targeted generation, remains effective under memory drift, and leaves non-target queries unaffected. Our results underscore the need to harden memory systems and provide a reproducible framework for studying agent memory.

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_e79f503d2d4e9aea7c8803ae