AuthorsHanling Tian, Gengyu Zhang, Zeyang Sha et al.
TL;DR
InjecMEM uses a retriever agnostic anchor plus a Multi GCG adversarial command to reach 76.6% ASR c and 35.4% RSR on MemoryOS.
Read our summary here, or open the publisher PDF on the next tab.
THE PROBLEM
Memory augmented agents continuously write and retrieve logs, creating a new attack surface where a single injected page can persist and steer future outputs.
InjecMEM shows that MemoryOS and MemGPT can be driven to a pre specified harmful answer on a topic, while non target queries remain unaffected, exposing a serious security boundary in agent memory.
HOW IT WORKS
InjecMEM builds a retriever agnostic anchor and an adversarial command using Multi GCG that are logged into MTM via the MemoryOS STM MTM LPM pipeline.
Think of the anchor as a broad topic label in a card catalog, and the adversarial command as a short but powerful instruction that always fires when that card is pulled.
This design lets InjecMEM survive memory drift and long fused prompts, enabling targeted steering that a plain context window or static RAG index cannot achieve.
DIAGRAM
This diagram shows how InjecMEM injects a poisoned page once and how later benign queries retrieve it to steer responses toward the target output.
DIAGRAM
This diagram shows how InjecMEM is evaluated on MemoryOS and MemGPT over synthetic multi domain dialogues and topic queries.
PROCESS
Write pipeline and STM enqueue
At dialogue turn t, InjecMEM crafts qadv so the resulting page pt is enqueued into Short Term Memory STM as part of the MemoryOS write pipeline.
MTM segment assignment
When pt ages out of STM, MemoryOS passes it to Mid Term Memory MTM, where similarity sim pt g with threshold theta assigns it to topic segments G.
Retriever agnostic anchor driven retrieval
For later user queries q on topic tau, InjecMEM relies on the retriever agnostic anchor so MTM segment selection and page retrieval include the poisoned page p star.
Multi GCG adversarial command steering
The Multi GCG optimized adversarial command inside p star ensures that when fused into C q M, the backbone LLM outputs the target answer A star with high ASR c.
KEY CONTRIBUTIONS
Formalizing memory injection vulnerability
InjecMEM identifies continuous writes plus hybrid retrieval in STM MTM LPM as a distinct attack surface, formalizing RSR and ASR c to quantify memory injection risk.
Retriever agnostic anchor plus adversarial command
InjecMEM introduces a retriever agnostic anchor and Multi GCG adversarial command that together achieve up to 35.4% RSR@50 and 76.6% ASR c on MemoryOS.
Transfer and concatenation across backbones
InjecMEM extends Multi GCG to Family Joint and Cross Family optimization, and shows concatenated commands can compromise Qwen Mistral and Llama backbones simultaneously.
RESULTS
RSR@50 Health
35.4%
+0.3 over Cent + GCG
ASR-c MemoryOS
76.6%
+76.6 over DPI
ASR-j MemoryOS
35.6%
joint end to end success with retrieval
RSR MemoryOS
46.5%
average retrieval success across domains
These metrics come from synthetic multi domain evaluations on MemoryOS and MemGPT, measuring retrieval success rate RSR and attack success rate ASR c and ASR j. The 76.6% ASR c and 35.6% ASR j show InjecMEM can reliably steer topic conditioned responses after a single injection.
BENCHMARK
These metrics come from synthetic multi domain evaluations on MemoryOS and MemGPT, measuring retrieval success rate RSR and attack success rate ASR c and ASR j. The 76.6% ASR c and 35.6% ASR j show InjecMEM can reliably steer topic conditioned responses after a single injection.
BENCHMARK
Retrieval Success Rate RSR@50 on health finance agriculture averaged over 19 domains.
KEY INSIGHT
InjecMEM’s Multi GCG command reaches 76.6% ASR c while DPI BadChain and vanilla GCG all collapse to 0.0% in memory augmented settings.
This is surprising because DPI and GCG are strong prompt injection baselines, yet memory drift and variable placement completely break them, revealing hidden assumptions about static prompts.
WHY IT MATTERS
InjecMEM provides a reproducible framework and metrics to stress test agent memory systems like MemoryOS and MemGPT under realistic single shot injection attacks.
Builders can now design and evaluate hardened memory write and retrieval policies, and reason about memory as a security boundary rather than just a capability module.
Peilin Feng, Suorong Yang, Soujanya Poria
arXiv 2026 · 2026
Σ-Mem maintains historical competence evidence matrices M_p, a peer relationship matrix G, a memory readout r_{p,t}, and residual steering δ_{p,t} to guide multi-agent trust decisions. On the mixed counterfactual benchmark, Σ-Mem raises Qwen3-0.6B accuracy at CF@90 from 46.22% with the base model to 71.10% with Σ w/ G.
Nikhil Verma
· 2026
Focus Agent adds start_focus, complete_focus, a persistent Knowledge block, and an optimized Persistent Bash plus String-Replace Editor scaffold to actively compress context during long software-engineering tasks. On five hard SWE-bench Lite instances against a Baseline ReAct agent, Focus Agent achieves 22.7% token reduction (14.9M → 11.5M) while matching 3/5 = 60% task success.
Xiaohui Zhang, Zequn Sun et al.
· 2026
ActMem transforms dialogue history into atomic facts via Memory Fact Extraction, groups them with Fact Clustering, links them through a Memory KG Construction module, and uses Counterfactual-based Retrieval and Reasoning for action-aware answers. On ActMemEval, ActMem reaches 76.52% QA accuracy with DeepSeek-V3, beating LightMem’s 63.97% by 12.55 points and NaiveRAG’s 61.54%.
Answers use this explainer on Memory Papers.
Checking…