---
title: "InjecMEM：针对LLM智能体记忆系统的记忆注入攻击"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2608.23471v1"
permalink: "https://feed.astralor.com/items/itm_e79f503d2d4e9aea7c8803ae"
published: "2026-08-24T16:37:50.000Z"
score: 76
channel: "ai"
tags: ["arXiv","InjecMEM","LLM Agent","提示注入","记忆系统"]
---

# InjecMEM：针对LLM智能体记忆系统的记忆注入攻击

## AI 点评

> 这篇论文最值得关注的地方在于：它没有跟风炒作提示注入，而是精准切入了记忆系统这个正在成为Agent默认组件的盲区。对于正在搭建个性化Agent的团队来说，这是必须尽早了解的威胁模型，尤其是那些把用户长期记忆直接交给向量库和RAG的工程实践，恐怕需要重新审视检索的信任边界。

## 速览

记忆正成为已部署LLM智能体实现个性化和连续性的默认子系统，但这可能引入新的安全漏洞。本文提出InjecMEM，一种新颖的记忆注入攻击范式，仅需一次交互（无需读取或编辑记忆库）即可将后续相关查询的响应引导至预指定输出。利用记忆系统的检索-然后-生成机制，攻击者构造包含检索器无关锚点和对抗命令的注入内容。锚点包含高召回主题线索，使下游检索始终将记录与目标主题关联；命令是短序列，经梯度坐标搜索优化，能在不确定融合上下文、可变位置和长提示下保持有效性。评估表明InjecMEM在多种记忆系统和骨干模型上实现可靠的主题条件检索和定向生成，且不影响非目标查询。

## 关键点

- 仅需一次交互即可实施攻击，无需对记忆库的读写权限，攻击面大。
- 采用检索器无关锚点与对抗命令设计，结合梯度坐标搜索优化，实现跨模型迁移。
- 在多种记忆系统和骨干模型上验证了攻击有效性，且对非目标查询无影响，同时可抵御记忆漂移。

## 全文

Memory is becoming a default subsystem in deployed LLM agents to provide persistent personalization and continuity. This naturally prompts a question: will memory system introduce new vulnerabilities into agents? Thus we propose InjecMEM, a novel memory injection attack paradigm that requires only a single interaction (no read/edit access to memory store) to steer later responses of related queries toward a pre-specified output. Guided by the retrieval-then-generate mechanism of memory systems, we craft the injection with a retriever-agnostic anchor and an adversarial command. The anchor contains high-recall topical cues so that downstream retrieval consistently associates the record with the target topic. The command is a short sequence optimized to remain effective under uncertain fused contexts, variable placements, and long prompts so that it reliably steers outputs once retrieved. We learn the command via gradient-based coordinate search, averaging over synthetic prompt templates and insertion positions, and extend it to joint optimization across backbones to study transfer. Evaluated across multiple memory systems and backbone models, InjecMEM achieves reliable topic-conditioned retrieval and targeted generation, remains effective under memory drift, and leaves non-target queries unaffected. Our results underscore the need to harden memory systems and provide a reproducible framework for studying agent memory.

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_e79f503d2d4e9aea7c8803ae