AuthorsMitchell Piehl, Zhaohan Xi, Zuobin Xiong et al.
TL;DR
ER-MIA exploits similarity-based memory retrieval with adversarial memory injection, driving Mem0’s overall F1 on LoCoMo from 23.60% down to 2.87% (-87.6%).
Read our summary here, or open the publisher PDF on the next tab.
THE PROBLEM
ER-MIA shows that similarity-based retrieval alone can induce harmful failures, with Mem0’s overall F1 collapsing from 23.60% to 2.87% under ensemble attacks.
When long-term memory systems like Mem0 and A-mem retrieve adversarial memories, downstream reasoning and question answering degrade persistently across multi-hop, temporal, and open-domain tasks.
HOW IT WORKS
ER-MIA centers on Content-Based MIAs, Question-Targeted MIAs, and an attack Arsenal of primitive and ensemble strategies that generate adversarial memories under black-box constraints.
You can think of ER-MIA as quietly slipping corrupted “cards” into a library catalog, so every future lookup retrieves misleading entries alongside the correct ones.
This KEY_MECHANISM lets ER-MIA degrade global reasoning across sessions without touching parameters, internals, or training data, something a plain context window cannot achieve.
DIAGRAM
This diagram shows how ER-MIA injects adversarial memories via normal interactions and how long-term memory systems retrieve them alongside clean memories over time.
DIAGRAM
This diagram shows how ER-MIA is evaluated across A-mem and Mem0 on LoCoMo using different attack types, models, and retrieval hyperparameters.
PROCESS
Memory-Augmented Inference in LLMs
ER-MIA assumes a long-term memory system retrieves top k memories via cosine similarity and concatenates them with the query for LLM reasoning.
Black-Box Adversarial Memory Injection Attacks
ER-MIA defines adversarial memory sets M′ that are embedding-close to clean memories, satisfying an imperceptibility threshold σs while changing future responses.
Attack Scenarios in ER-MIA
ER-MIA instantiates Content-Based MIAs using past interactions and Question-Targeted MIAs that restate questions with fabricated answers.
Attack Arsenal in ER-MIA
ER-MIA’s Arsenal generates instruction-based, factual manipulation, and non-semantic adversarial memories, and composes them into ensemble attacks to maximize degradation.
KEY CONTRIBUTIONS
Systematic Study of Black-Box AMIAs
ER-MIA formulates adversarial memory injection attacks over dynamically written memories and shows similarity-based retrieval alone can cause large F1 drops, up to -87.6% on Mem0.
ER-MIA Attack Framework and Arsenal
ER-MIA introduces Content-Based MIAs, Question-Targeted MIAs, and an Arsenal of eight primitive plus ensemble attacks that require no parameter or retrieval access.
Extensive Evaluation on LoCoMo
ER-MIA evaluates across A-mem and Mem0 with Llama3.2, Gemma3, and GPT-oss, quantifying reasoning degradation using F1 and BLEU-1 and analyzing retrieval hyperparameters k.
RESULTS
Overall F1
23.60% vs 2.87%
-20.73 F1 under Ignore & General Negation on Mem0
Multi-Hop F1
19.51% vs 3.96%
-15.55 F1 for Ignore & General Negation on Mem0
Single-Hop F1
25.46% vs 2.87%
-22.59 F1 for Ignore & General Negation on Mem0
Temporal F1
26.06% vs 1.87%
-24.19 F1 for Ignore & General Negation on Mem0
These numbers come from Mem0 with Llama3.2 on the LoCoMo benchmark, which tests single-hop, multi-hop, temporal, and open-domain QA. ER-MIA proves that small sets of adversarial memories can almost collapse long-term reasoning in memory-augmented LLMs.
BENCHMARK
These numbers come from Mem0 with Llama3.2 on the LoCoMo benchmark, which tests single-hop, multi-hop, temporal, and open-domain QA. ER-MIA proves that small sets of adversarial memories can almost collapse long-term reasoning in memory-augmented LLMs.
BENCHMARK
Overall F1 on LoCoMo for Mem0 with Llama3.2 under ER-MIA ensemble attacks.
KEY INSIGHT
ER-MIA’s non-semantic attacks like Embedding-Close Noise still drop Mem0’s overall F1 from 23.60% to 13.57% in multi-hop and 10.29% overall.
This is surprising because the adversarial text is essentially gibberish, yet similarity-based retrieval treats it as relevant, breaking the assumption that high embedding similarity implies useful semantics.
WHY IT MATTERS
ER-MIA reveals that long-term memory systems need robust memory sanitization, contradiction detection, and retrieval defenses, not just better storage and extraction.
Builders can now use ER-MIA’s arsenal as a stress-test suite to evaluate and harden new memory architectures against realistic black-box adversaries before deployment.
Guilin Zhang, Wei Jiang et al.
· 2026
A-MAC scores candidate memories using Utility, Confidence, Novelty, Recency, and Type Prior combined by a learned linear admission policy with Algorithm 1 A-MAC Memory Admission. On the LoCoMo benchmark, A-MAC achieves F1 0.583 and 2644 ms latency, improving F1 by 0.042 and reducing latency by 1187 ms compared to A-mem.
Robbyant Team, Zelin Gao et al.
arXiv 2026 · 2026
LingBot-World combines a Data Engine, Fundamental World Model, Action-Conditioned World Model, and Post-Training causal adaptation to turn a 28B-parameter video generator into a real-time interactive world simulator. On the VBench benchmark, LingBot-World achieves a dynamic degree of 0.8857 versus 0.7612 for Yume-1.5, while also improving imaging quality to 0.6683.
Manoj Madushanka Perera, Adnan Mahmood et al.
· 2026
AgenticAI-DialogGen chains ChatPreprocessor, KnowledgeExtractor, TopicAnalyzer, KnowledgeGraphBuilder, PersonaGenerator, DuelingChat Agent, ConversationValidator, ConversationRefiner, QAGeneration, and PostProcessing to turn raw multi-session chats into topic-guided, persona-grounded conversations with explicit short- and long-term memories. On the TGC / KG memory QA benchmark, Mistral-7B fine-tuned within AgenticAI-DialogGen achieves 87.36 F1, compared to GPT-4’s 83.77 F1 in a zero-shot setting on the same task.
Answers use this explainer on Memory Papers.
Checking…