MAFIA: Query-Only Memory Attacks via Probing and Factual Injection against Audited LLM Agents

2026-08-04

AI Summary

Existing query-based memory poisoning attacks exhibit limited efficacy under realistic conditions involving large-scale benign memory pools and active semantic auditing. This work proposes MAFIA, a novel framework that, for the first time, achieves effective memory injection within a practical threat model that simultaneously demands high retrieval competitiveness and robust semantic auditability. MAFIA integrates memory probing, dynamic budget allocation, and a compact factual camouflage mechanism to preserve semantic similarity while evading detection by auditing systems. Experimental results demonstrate that MAFIA attains a poisoning success rate of 90.7% and dramatically reduces the audit detection rate from 83.3% to 7.4%, thereby exposing critical security vulnerabilities in agent memory systems.

Abstract

Memory-augmented LLM agents rely on rich context for long-horizon reasoning and acting, yet their memory modules expose a persistent attack surface for malicious records, making the study of memory poisoning threats imperative. However, existing query-only attacks often fail to remain effective in two realistic and prevalent settings: large-scale benign memory pools and active input auditing. Consequently, current approaches fall short when facing the dual challenges of high retrieval competitiveness and rigorous semantic checks. To overcome these limitations, we propose MAFIA, a query-only Memory Attack framework via probing and Factual Injection against Audit, tailored to this extended threat model. Specifically, MAFIA introduces: (1) a placement strategy that ensures retrieval-competitive injection via memory probing, budget allocation, and scheduling; and (2) a payload design that bypasses audits using compact factual cloaks, preserving malicious effects while maintaining high semantic similarity. Extensive evaluations reveal that MAFIA achieves up to a 90.7% attack success rate while suppressing audit detection from a peak of 83.3% to at most 7.4%, exposing critical vulnerabilities across agentic memory systems. Code will be made publicly available at https://github.com/JiamingChen1234/MAFIA.

Problem

• memory poisoning
• query-only attacks
• LLM agents
• input auditing
• retrieval competitiveness

Innovation

• memory poisoning
• query-only attack
• factual cloaking
• LLM agents
• audit evasion