AgentPoison: Red-teaming LLM Agents via Memory/RAG Poisoning
Date: 2024-07
Affected: RAG-based driving agent, ReAct, EHRAgent
Attack vector: backdoor
Category: research
Severity: Critical

Chen et al. propose the first backdoor attack on RAG/memory-based LLM agents, optimizing triggers as a constrained embedding-space problem. Over 80 percent ASR with under 0.1 percent poison rate against autonomous driving, knowledge QA, and EHR agents. NeurIPS 2024.


Mitigations:

Architectural layers (MAESTRO):