Memory Injection Attacks on LLM Agents via Query-Only Interaction

Understand

Agents powered by large language models (LLMs) have demonstrated strong capabilities in a wide range of complex, real-world applications.

• However, LLM agents with a compromised memory bank may easily produce harmful outputs when the past records retrieved for demonstration are malicious.
• In this paper, we propose a novel Memory INJection Attack, MINJA, without assuming that the attacker can directly modify the memory bank of the agent.
• The attacker injects malicious records into the memory bank by only interacting with the agent via queries and output observations.