提出新型内存攻击框架，可绕过审计在大模型代理中注入恶意记忆。
MAFIA: Query-Only Memory Attacks via Probing and Factual Injection against Audited LLM Agents
- 通过探测与调度实现高竞争力记忆注入
- 攻击成功率最高达90.7%，检测率从83.3%降至7.4%
- 适合研究大模型安全与对抗攻击的学者使用
增强记忆的大型语言模型代理依赖丰富上下文实现长周期推理与决策，但其记忆模块易成为恶意记录的持久攻击面，因此研究记忆污染威胁至关重要。然而，现有仅查询攻击在大规模良性记忆池和主动输入审计等现实场景下常失效，难以应对高检索竞争性与严格语义校验的双重挑战。为此，我们提出MAFIA：一种针对审计机制的查询式内存攻击框架，通过探测与事实注入实现有效攻击。具体包括：（1）基于探测、预算分配与调度的记忆注入策略，确保注入内容具有强检索竞争力；（2）采用紧凑的事实伪装包设计，绕过审计检测，在保持高语义相似度的同时保留恶意效果。大量实验表明，MAFIA在多种场景下攻击成功率最高达90.7%，同时将审计检测率从峰值83.3%压制至最多7.4%，暴露出智能体记忆系统的严重漏洞。代码将公开于https://github.com/JiamingChen1234/MAFIA。
原文摘要 · Abstract (English)
Memory-augmented LLM agents rely on rich context for long-horizon reasoning and acting, yet their memory modules expose a persistent attack surface for malicious records, making the study of memory poisoning threats imperative. However, existing query-only attacks often fail to remain effective in two realistic and prevalent settings: large-scale benign memory pools and active input auditing. Consequently, current approaches fall short when facing the dual challenges of high retrieval competitiveness and rigorous semantic checks. To overcome these limitations, we propose MAFIA, a query-only Memory Attack framework via probing and Factual Injection against Audit, tailored to this extended threat model. Specifically, MAFIA introduces: (1) a placement strategy that ensures retrieval-competitive injection via memory probing, budget allocation, and scheduling; and (2) a payload design that bypasses audits using compact factual cloaks, preserving malicious effects while maintaining high semantic similarity. Extensive evaluations reveal that MAFIA achieves up to a 90.7% attack success rate while suppressing audit detection from a peak of 83.3% to at most 7.4%, exposing critical vulnerabilities across agentic memory systems. Code will be made publicly available at https://github.com/JiamingChen1234/MAFIA.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。