Title: Memory Injection Attacks on LLM Agents via Query-Only Interaction
Venue: NeurIPS 2025
Accepted: yes
Keywords: LLM agent

LLM

Memory Injection

Trustworthy
Abstract: Agents powered by large language models (LLMs) have demonstrated strong capabilities in a wide range of complex, real-world applications.
However, LLM agents with a compromised memory bank may easily produce harmful outputs when the past records retrieved for demonstration are malicious.
In this paper, we propose a novel Memory INJection Attack, MINJA, without assuming that the attacker can directly modify the memory bank of the agent.
The attacker injects malicious records into the memory bank by only **interacting with the agent via queries and output observations**.
These malicious records are designed to elicit a sequence of malicious reasoning steps corresponding to a different target query during the agent's execution of the victim user's query.
Specifically, we introduce a sequence of *bridging steps* to link victim queries to the malicious reasoning steps.
During the memory injection, we propose an *indication prompt* that guides the agent to autonomously generate similar bridging steps, with a *progressive shortening strategy* that gradually removes the indication prompt, such that the malicious record will be easily retrieved when processing later victim queries.
Our extensive experiments across diverse agents demonstrate the effectiveness of MINJA in compromising agent memory.
With minimal requirements for execution, MINJA enables any user to influence agent memory, highlighting the risk.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe authors proposed an memory injection attack against LLM agents where the attacker injects\n malicious records into the memory bank by only interacting with the agent via queries and output observations.\nThe authors introduced a sequence of bridging steps to link victim queries to the malicious reasoning steps.\n\nSTRENGTHS AND WEAKNESSES:\nPros:\nThe agent memory injection attack problem is very intriguing. The authors pointed out and explored a novel and practical setting, compared with existing work AgentPoison, which assumed the attacker can directly manipulate the memory bank, which is not possible in practice. From my opinion, formulating the problem from this perspective is highly novel and presenting techniques to resolve this problem is a large step-forward on making attacks to agents more close to real-world. Studying agent attacks under this setting will make the public more aware of attacks against agents and LLMs, largely benefiting the LLM security community.\n\nThe method designed based on bridging steps is also neat.\n\nCons:\n\nThe idea of attacking based on bridging steps does not seem completely new. For example, in [A], the authors explored decomposing jailbreak questions into smaller reasoning steps and making the attack less easier to be detected. \n\n[A] PANDORA: Detailed LLM Jailbreaking via Collaborated Phishing Agents with Decomposed Reasoning\n\nIn general, the evaluation is less comprehensive. \n\nA lot of existing agents are not based on reasoning models but based on normal LLMs. Through reading the paper, I feel unsured about whether the attacker's techniques heavily rely on reasoning LLMs, or they are also transferable to normal LLMs like Llama-2. Thus, it is less justified to explore only reasoning-based agents.\n\nThe involved LLMs in the evaluation is limited to GPT4 and GPT4o. However, there are many existing reasoning-based LLMs, e.g., DeepSeek.\n\nIt is also unclear how the model performs on smaller models, at the scale of 7B or 14B.\n\nQUESTIONS:\nWhat is the major technical difference between filling the logical gap by bridging steps with [A]?\n[A] PANDORA: Detailed LLM Jailbreaking via Collaborated Phishing Agents with Decomposed Reasoning\n\nWhy do the authors only explore reasoning-based agents?\n\nDoes the attack leverage specific properties of reasoning models? \n\nIs the attack method generalizable to non-reasoning model-based agents? How does it perform and transfer?\n\nHow does the method perform on other reasoning models except GPT4 and GPT4o, e.g., DeepSeek.\n\nHow does the method perform on small-scale distilled models, e.g., DeepSeek-R1-Distill-Qwen-14B? Does model scale generally impact the performance of your attack?\n\nIs it possible to design potential strategies to defend this attack?\n\nLIMITATIONS:\nThe paper also lacks a discussion of whether it is possible for agent builders to defend against this attack. Will defending these attacks hinder the agent's performance?", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 4, "ORIGINALITY": 3, "DATE": "2025-06-06"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presents MINJA, a novel memory injection attack against large language model agents. Unlike previous work, it relies solely on query-based interaction to inject malicious records that can later influence the agent’s behavior during other users’ interactions. The authors introduce techniques like bridging steps, an indication prompt, and a progressive shortening strategy to craft effective injections. The experiments across multiple agents (e.g., healthcare, QA, shopping) show high success rates in both injection and downstream attacks, while preserving the agent’s original utility.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n* The attack assumes no privileged access and is executed only through queries, making it more realistic than prior works.\n* The introduction of bridging steps and progressive shortening demonstrates careful and creative thinking in constructing the attack.\n* The paper evaluates MINJA on multiple agents and datasets, showing consistent effectiveness and generalization.\n* The paper is well-written and easy to follow, even for readers not deeply familiar with LLM agent systems.\n\nWeakenss:\n* A key assumption in the paper is that the LLM agent uses a shared memory bank across users. However, in many real-world applications (such as ChatGPT) each user typically has a private memory that is not accessible or shared without explicit permission. This limits the direct applicability of the proposed attack. The authors acknowledge this assumption and justify it with examples of shared memory systems, so while it is a valid limitation, it may be more relevant in future or specialized deployments.\n* The attacker is assumed to be able to inject a relatively large number of interaction records into the system, which may not always be feasible, especially in high-security or rate-limited environments. This constraint is worth discussing more in terms of attack scalability.\n* The paper briefly discusses possible defenses (like prompt-level detection), but more detailed analysis of practical defense mechanisms, such as memory isolation, permission control, or system-level safeguards, is lacking. This would help better assess the practical risk and how MINJA can be mitigated in real-world systems.\n* The success of the attack depends on how the agent retrieves memory records (e.g., based on query similarity). While the paper explores several embedding models, if real-world systems use stricter or more diverse filtering methods, the effectiveness of the attack may drop.\n* In the method section, both q (italic) and q (regular) are used to denote different queries. Could you consider clarifying or changing the notation? It’s easy to confuse them when reading.\n\nQUESTIONS:\nPlease answer how you may address the weaknesses above.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-25"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a novel attack on the memory module of reasoning-enabled LLM agents. The attacker is assumed to lack direct access to the memory bank and can only influence it through interactions with the agent. The objective is to poison the memory such that, when a victim query comes, the agent: (1) interprets the victim’s query (q_v) as a target query (q_t), and (2) generates a response aligned with the attacker’s intent. To achieve this, the authors introduce a “bridging step”—a generic but coherent reasoning step that subtly links the attacker’s query to the target intent. Without direct memory access, the attacker induces the agent to generate these bridging steps autonomously by prepending crafted chain-of-thought reasoning to their queries. To improve stealth and efficiency, the authors propose a Progressive Shortening Strategy, which iteratively reduces the length of the poisoned queries while retaining their effect, ultimately producing prompts that appear benign. Experiments across multiple agents and datasets, along with ablation studies, demonstrate the effectiveness of the attack and provide preliminary evaluations of potential defenses.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n\n+ The paper introduces a novel and practical threat model in which the attacker has no access to the memory bank and no direct write access to storage or model weights. This setting closely mirrors realistic deployment constraints. \n\n+ The attack is well-motivated; it leverages agent logging and retrieval mechanisms cleverly, enabling memory poisoning purely through interaction. The bridging sentences are effective in making the injected reasoning logical, increasing the plausibility of the attack. \n\nWeaknesses:\n\n+ The paper would benefit from more extensive evaluation of potential (adaptive) defenses, particularly those that may be deployed in realistic LLM agent systems, see more details in the question section.\n\n+  It remains unclear how robust the attack is when the agent incorporates noise, relevance scoring, or temporal decay in its memory retrieval logic—such factors may affect the long-term impact of poisoning.\n\nQUESTIONS:\n+ How sensitive is the attack to changes in the retriever design? Would switching to a different similarity metric, e.g., switching from cosine similarity to dot product, influence the ASR?\n\n+ What is the minimum retrieval rank at which the poisoned record must appear for the attack to succeed? Does attack success drop off significantly as the poisoned record moves past the top-k?\n\n+ How many interaction rounds does the PSS typically require in practice? Would aggressive rate limiting (e.g., 5 queries/hour) substantially hinder the attack’s feasibility?\n\n+ How effective would a simple defense be that detects and then rejects chain-of-thought or multi-step reasoning from user input? Will the attack still stay effective? Additionally, simple rule-based checks (e.g., enforcing that the primary entity mentioned in the answer matches that in the query) could prevent certain examples, like the medical scenario shown in the paper. How does this defense affect its effectiveness?\n\nLIMITATIONS:\nYes.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-06-28"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nLLM agents with compromised memory banks can generate harmful outputs when the retrieved past records are malicious. This paper proposes a novel method for injecting such malicious records into the memory bank indirectly, solely through interaction with the agent. Unlike previous works that assume the attacker has direct access to the agent’s memory bank, this approach addresses a more realistic and easily exploitable injection pathway.\nThe proposed method works by injecting indication prompts that guide the agent to autonomously generate malicious reasoning steps. This process involves scenarios where a victim term in the query is implicitly transitioned into a target term, thereby leading to harmful outcomes.\n\nSTRENGTHS AND WEAKNESSES:\nstrengths\n\n- In addition to injecting indication prompts that guide the agent to follow malicious reasoning steps, the authors introduce a progressive shortening strategy that gradually removes the prompt. This strategy enhances the likelihood of the victim term being seamlessly replaced by the target term during future queries.\n\n- By eliminating the need for direct access to the memory bank and relying solely on queries to inject malicious records, the proposed method increases the practicality and real-world feasibility of memory poisoning attacks.\n\n- The authors conduct extensive experiments using metrics such as Inject Success Rate (ISR), Attack Success Rate (ASR), and Utility Drop (UD) across various conditions, including different embedding models and prior poisoning scenarios, demonstrating the effectiveness and robustness of the proposed approach.\n\n\nweaknesses\n\n- While Section 4.2 states that “PSS enables the injection of a greater number of relevant malicious records into the memory bank,” the paper lacks an ablation study directly isolating and quantifying the impact of the progressive shortening strategy on injection performance.\n\n- Although the Inject Success Rate (ISR) is consistently high across experiments, the Attack Success Rate (ASR) shows considerable variance, indicating instability in actual malicious influence over agent outputs.\n\n- While MINJA demonstrates high success rates, its reliance on semantically plausible victim-to-target transitions limits its applicability. The attack assumes that a logically coherent bridging can be constructed between the victim and target terms. This could be an assumption that may not hold in many real-world settings where such transitions are implausible or nonsensical.\n\n- The requirement for human-designed prompt presents a limitation in terms of scalability and automation. This hand-engineered component demands attacker expertise and domain knowledge, making the approach less viable in broader or more complex scenarios.\n\n- The trigger design in MINJA is inherently tied to specific victim terms for which semantically plausible bridging to target terms can be crafted. This dependence limits the flexibility and generalizability of trigger word selection.\n\nQUESTIONS:\n- The Utility Drop (UD) appears to be a metric where lower values are better, yet Table 1 labels it as “UD↑”. Could the authors clarify why it is presented this way?\n\n- Is it possible to automate the process of crafting the indication prompt, rather than relying on human design? Additionally, how does the degree of logical implausibility in these bridging steps affect the injection success?\n\nLIMITATIONS:\n- The requirement for manually crafted bridging steps imposes limitations in terms of attack automation and scalability.\n\n- The assumption that the attack only works when a semantically plausible connection between the victim and target terms exists may not hold in many real-world scenarios, making the method less generalizable in practice.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 4, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-29"}