MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval

May combine two claims.

Existing memory systems assume stored experiences are trustworthy and rarely track provenance.

“Existing memory systems assume stored experiences are trustworthy and rarely track provenance.”

• Also stated in: § 2 Related Work · p. 3 · plain

  “These systems significantly improve reasoning and personalization, yet they implicitly assume that stored experiences are trustworthy and do not incorporate provenance or adversarial filtering.”

• cites [1] [1] Wanjun Zhong, Lianghong Guo, Qiqi Gao, He Ye, and Yanlin Wang. Memorybank: Enhancing large language models with long-term memory. arXiv preprint arXiv:2305.10250 , 2023. - sourceCould not verify

  Section 2.1 describes MemoryBank storing conversations with timestamps, and Section 2.3 describes updating memories based on time and recall. Neither passage says that existing memory systems assume stored experiences are trustworthy or rarely track provenance; searches for those points found no supporting passage. Page numbers were unavailable in our copy. (LLM, conf=0.72)

  Experimental — accuracy not yet measured
• cites [2] [2] Charles Packer, Sarah Wooders, Kevin Lin, Vivian Fang, Shishir G. Patil, Ion Stoica, and Joseph E. Gonzalez. Memgpt: Towards llms as operating systems. arXiv preprint arXiv:2310.08560 , 2023. - sourceCould not verify

  The Introduction (pp. 1–2) and Related Work (p. 8) discuss extending LLM memory and retrieving stored information, but do not say that existing systems assume stored experiences are trustworthy or rarely track provenance. Searches for provenance, trustworthiness, and source attribution found no passage making that claim. (LLM, conf=0.73)

  Experimental — accuracy not yet measured
• cites [3] [3] Wujiang Xu, Zujie Liang, Kai Mei, Hang Gao, Juntao Tan, and Yongfeng Zhang. A-mem: Agentic memory for llm agents. arXiv preprint arXiv:2502.12110 , 2025. - sourceCould not verify

  The Introduction and Related Work discuss limitations of existing memory systems in storage, retrieval, organization, and adaptability. Neither those passages nor searches for provenance, trustworthiness, source attribution, and reliability address whether systems treat stored experiences as trustworthy or track their provenance. (LLM, conf=0.73)

  Experimental — accuracy not yet measured

May combine two claims.

MINJA shows that agents treat retrieved memories as ground truth and imitate them because memory retrieval is based purely on embedding similarity without provenance checks or sanitization.

“MINJA[7] shows that agents treat retrieved memories as ground truth and imitate them because memory retrieval is based purely on embedding similarity without provenance checks or sanitization.”

• cites [7] [7] Shen Dong, Shaochen Xu, Pengfei He, Yige Li, Jiliang Tang, Tianming Liu, Hui Liu, and Zhen Xiang. A practical memory injection attack against llm agents. arXiv preprint arXiv:2503.03704 , 2025. - sourcePartly supported

  Section 5.1 (p. 6) says the tested agents retrieve similar records as demonstrations using text-embedding similarity, supporting the claim that retrieved memories can influence their behavior. But Appendix I (p. 30) says the attack also works without embedding-based retrieval and may remain effective under filtering or security checks. The paper does not establish that agents treat memories as ground truth or that retrieval is always purely similarity-based and lacks sanitization. (LLM, conf=0.88)

  Experimental — accuracy not yet measured

May combine two claims.

Nearly half of all retrieved records originated from the poisoned set, despite poisoned items forming only a small minority of the overall memory.

“Thus, nearly half of all retrieved records originated from S poison , despite poisoned items forming only a small minority of the overall memory.”

May combine two claims.

Despite n_p << n_b, the union retrieval mechanism assigns disproportionately high similarity scores to poisoned items, resulting in a global PRP approaching 50% and substantial per-query poisoned fractions.

“Even though n p ≪ n b , the union retrieval mechanism assigns disproportionately high similarity scores to poisoned items. This results in a global PRP approaching 50%, and substantial per-query poisoned fractions.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Across the full evaluation set, the agent retrieved a total of 48 records.

“Across the full evaluation set Q = { q (1) , . . . , q ( N ) } , the agent retrieved a total of T tot = ∑ N i =1 t i = 48 records”

May combine two claims.

Poisoned entries surfaced not only for tasks closely related to the injected patterns, but also for schema validation, anonymization, reporting, EDA sampling, and pipeline inspection.

“Poisoned entries surfaced not only for tasks closely related to the injected patterns, but also for schema validation, anonymization, reporting, EDA sampling, and pipeline inspection.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

These documents induce the agent to read and execute their contents, which triggers automatic writes to long-term memory.

“These documents induce the agent to read and execute their contents, which in turn triggers automatic writes to longterm memory.”

• AssumptionThe authors state this as an assumption: The agent may execute code embedded in notes or markdown files, enabling indirect construction of poisoned RAG stores.

May combine two claims.

MemoryGraft closes the gap by presenting a single-shot, indirect memory grafting attack that persists across sessions and activates naturally through semantic similarity.

“MemoryGraft closes this gap by presenting a single-shot, indirect memory grafting attack that persists across sessions and activates naturally through semantic similarity, expanding the known threat surface for LLM agents.”

• AssumptionThe authors state this as an assumption: The agent maintains a durable long-term memory store M (BM25 index and FAISS vector store) reused across sessions.
• AssumptionThe authors state this as an assumption: Retrieval is based on semantic as well as lexical similarity, so malicious entries crafted to be near common analytic or engineering queries appear in retrieval for many clean queries.

May combine two claims.

MemoryGraft requires access to write to surface files such as README but modifies no queries.

“MemoryGraft requires access to write to the surface files(such as README ) but modifies no queries.”

• AssumptionThe authors state this as an assumption: The attacker has no privileged access to internal system files, memory stores, or other users' interactions, and cannot directly edit M, modify retrieval hyperparameters, or override system instructions.

Probably not a substantial claim: may not pass S4 (based).

The attacker can supply crafted documents that embed malicious yet plausible success examples.

“Specifically, the attacker can supply crafted documents d ∈ D adv that embed malicious yet plausible success examples.”

• AssumptionThe authors state this as an assumption: The agent may execute code embedded in notes or markdown files, enabling indirect construction of poisoned RAG stores.

May combine two claims.

Once retrieved, poisoned records induce drift through the agent's imitation heuristic; the agent treats them as trusted examples of successful past solutions and incorporates the unsafe pattern into its current reasoning.

“Once retrieved, poisoned records induce drift through the agent's imitation heuristic. The agent treats ( q ( j ) p , R ( j ) p ) as a trusted example of a successful past solution and incorporates the unsafe pattern encoded in R ( j ) p into its current reasoning.”

Probably not a substantial claim: may not pass S4 (based).

Because the memory store M persists across sessions, poisoned experiences continue to influence future interactions even after the attacker has disengaged.

“Because the memory store M persists across sessions, poisoned experiences continue to influence future interactions even after the attacker has disengaged.”

• AssumptionThe authors state this as an assumption: The agent maintains a durable long-term memory store M (BM25 index and FAISS vector store) reused across sessions.

Classified as probably not a substantial claim.

In all experiments, the agent operated under its standard ingestion pipeline without any modification to internal parameters, retrieval thresholds, or tool-calling behaviour.

“In all experiments, the agent operates under its standard ingestion pipeline without any modification to internal parameters, retrieval thresholds, or tool-calling behaviour.”

May combine two claims.

Compromising long-term memory, not the prompt, can quietly redirect agent behavior, yielding a more persistent and covert attack than existing techniques.

“We show that compromising long-term memory, not the prompt, can quietly redirect agent behavior, yielding a more persistent and covert attack than existing techniques.”

• AssumptionThe authors state this as an assumption: The agent maintains a durable long-term memory store M (BM25 index and FAISS vector store) reused across sessions.
• AssumptionThe authors state this as an assumption: Retrieved items are interpreted as trusted prior successes, and the agent imitates their procedural structure without verifying correctness or provenance.

May combine two claims.

In the absence of a purge or replacement mechanism, the grafted experiences continue to influence retrieval indefinitely, making MemoryGraft a stealthy and durable attack vector.

“In the absence of such a mechanism, the grafted experiences continue to influence retrieval indefinitely, making MemoryGraft a stealthy and durable attack vector.”

Probably not a substantial claim: may not pass S4 (based).

The attack operates solely by contaminating the agent's ingestion pipeline.

“The attack operates solely by contaminating the agent's ingestion pipeline.”

• AssumptionThe authors state this as an assumption: The attacker has no privileged access to internal system files, memory stores, or other users' interactions, and cannot directly edit M, modify retrieval hyperparameters, or override system instructions.

May combine two claims.

The dense benign cover prevents trivial anomaly detection while still allowing poisoned entries to surface due to their tailored semantic proximity to common queries.

“The dense benign cover prevents trivial anomaly detection while still allowing poisoned entries to surface due to their tailored semantic proximity to common queries.”

May combine two claims.

Semantic similarity becomes a heuristic for reliability and makes the system susceptible to poisoned examples.

“This way, semantic similarity becomes a heuristic for reliability and makes the system susceptible to poisoned examples.”

• AssumptionThe authors state this as an assumption: Retrieval is based on semantic as well as lexical similarity, so malicious entries crafted to be near common analytic or engineering queries appear in retrieval for many clean queries.
• AssumptionThe authors state this as an assumption: The agent does not track the origin of stored records or evaluate whether they were produced safely, so benign and malicious successes are indistinguishable.

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

By repeating this process, the attacker can increase the concentration of malicious memory entries in the similarity space, increasing the likelihood that poisoned records are retrieved during subsequent tasks.

“By repeating this process, the attacker can increase the concentration of malicious memory entries in the similarity space. This increases the likelihood that poisoned records are retrieved during subsequent tasks.”

• AssumptionThe authors state this as an assumption: Retrieval is based on semantic as well as lexical similarity, so malicious entries crafted to be near common analytic or engineering queries appear in retrieval for many clean queries.

Classified as probably not a substantial claim. May combine two claims.

A higher value of PRP indicates that the poisoned memory entries dominate the retrieval distribution, meaning that the agent is frequently exposed to malicious successful experiences even when solving clean, semantically ordinary tasks.

“A higher value of PRP indicates that the poisoned memory entries dominate the retrieval distribution, meaning that the agent is frequently exposed to malicious successful experiences even when solving clean, semantically ordinary tasks.”

• AssumptionThe authors state this as an assumption: Retrieval is based on semantic as well as lexical similarity, so malicious entries crafted to be near common analytic or engineering queries appear in retrieval for many clean queries.

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

The code has no external dependencies and executes deterministically, guaranteeing that the resulting store contains exactly n_b + n_p records with the desired distribution of benign and poisoned entries.

“Crucially, the code has no external dependencies and executes deterministically, guaranteeing that the resulting store contains exactly n b + n p records with the desired distribution of benign and poisoned entries.”

May combine two claims.

The persistence mechanism ensures that M poison survives across agent sessions and becomes part of the global memory accessible to all users.

“The persistence mechanism ensures that M poison survives across agent sessions and becomes part of the global memory accessible to all users.”

• AssumptionThe authors state this as an assumption: The agent maintains a durable long-term memory store M (BM25 index and FAISS vector store) reused across sessions.

May combine two claims.

After construction, the poisoned store is serialized to disk and becomes part of the agent's persistent memory.

“After construction, the poisoned store is serialized to disk and becomes part of the agent's persistent memory.”

May combine two claims.

BM25 captures lexical overlap, allowing poisoned entries that share surface phrasing to be ranked highly, and FAISS captures semantic similarity, allowing poisoned entries that share deeper workflow-level meaning to appear even when wording diverges.

“This is because BM25 captures lexical overlap , allowing poisoned entries that share surface phrasing (e.g., quick fix, skip validation, sanitized) to be ranked highly, and FAISS captures semantic similarity , allowing poisoned entries that share deeper workflow-level meaning to appear even when wording diverges.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The evaluation relies on a relatively small set of handcrafted benign and poisoned seeds.

“First, our tests rely on a relatively small set of handcrafted benign and poisoned seeds.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The attack design is closer to a white-box or semi-white-box setting, in that the attacker knows which documentation files and scripts the agent will ingest and can target those artifacts directly.

“Finally, our attack design is closer to a white-box or semi-white-box setting, in that the attacker knows which documentation files and scripts the agent will ingest and can target those artifacts directly.”

May combine two claims.

Once injected into the long-term memory store, poisoned entries reliably outcompete benign experiences across a wide range of evaluation queries, consistently exposing the agent to unsafe procedural templates.

“Once injected into the long-term memory store, poisoned entries reliably outcompete benign experiences across a wide range of evaluation queries, consistently exposing the agent to unsafe procedural templates.”

May combine two claims.

Once written, these entries are treated as trusted prior examples, and the union of lexical and embedding-based similarity reliably retrieves them in exactly the scenarios the attacker targets.

“Once written, these entries are treated as trusted prior examples, and the union of lexical and embedding-based similarity reliably retrieves them in exactly the scenarios the attacker targets.”

May combine two claims.

Even if malicious records are physically written to storage, signature verification fails and the agent discards the poisoned observations before they can influence prompt construction.

“Consequently, even if malicious records are physically written to the storage medium, the verification step Verify( · ) fails, and the agent discards the poisoned observations before they can influence the prompt construction.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The study focuses primarily on aggregate retrieval statistics rather than more extensive metrics such as retrieval precision and recall, behavioral severity scores, and long-term stability measures.

“Second, we focus primarily on aggregate retrieval statistics; more extensive metrics such as retrieval precision and recall, behavioral severity scores, and long-term stability measures would offer a clearer picture of how quickly and strongly an agent becomes compromised.”

Classified as probably not a substantial claim.

Since the adversary interacts only through ingestion channels and lacks access to the private signing key, they cannot generate valid signatures for the poisoned set.

“Since the adversary A adv interacts only through ingestion channels (e.g., README fi les) and lacks access to K priv , they cannot generate valid signatures for the poisoned set S poison .”

Classified as probably not a substantial claim.

The evaluation used a standardized set of 12 queries designed to be semantically distinct from the specific phrasing of the poisoned seeds while mapping to the same underlying intents.

“To validate the effectiveness of the MemoryGraft attack, we utilized a standardized set of 12 evaluation queries. These queries were designed to be semantically distinct from the specific phrasing of the poisoned seeds while mapping to the same underlying intents”

May combine two claims.

The agent adopted unsafe shortcuts such as skipping validation, reusing stale results, or executing risky automation.

“leading the agent to adopt unsafe shortcuts such as skipping validation, reusing stale results, or executing risky automation.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The study focuses on a single agent within MetaGPT.

“Our study focuses on a single agent within MetaGPT, but many MetaGPT workflows involve multiple agents that share or read from the same memory resources.”