MAFIA Probes Queries to Poison Agents’ Long-Term Memory, Achieving Attack Success Rates as High as 90.7%

Long-running LLM agents write conversations, tool outputs, and task experience to external memory, later retrieving them through vector or hybrid search. This means attackers do not need to modify the model or gain access to the memory database: as long as they can submit queries or content that will be stored, they may be able to make malicious records repeatedly influence the agent’s future tasks.

Submitted on August 4, MAFIA frames the problem in a way that more closely resembles real-world deployments. In a large memory pool, simply inserting prompt-injection text will typically be drowned out by a large volume of benign records; semantic auditors may also intercept obvious manipulation instructions before they are written. MAFIA therefore first probes retrieval behavior through query responses, estimating which wording and insertion timing are more likely to achieve high rankings, and then schedules multiple records according to the attack budget. Its payload compresses the manipulation objective into seemingly ordinary “facts,” preserving semantic similarity to the target query while reducing the likelihood of detection by input auditors.

The paper reports that MAFIA achieved an attack success rate of up to 90.7% on the evaluated agent memory systems. Audit detection rates that had reached as high as 83.3% fell to no more than 7.4% when the malicious instructions were packaged as facts. This suggests that deploying a content classifier only at the write stage is insufficient, because the attack simultaneously exploits retrieval ranking, accumulation over time, and the model’s trust in “known facts.”

From an engineering perspective, memory should be treated as a database with provenance and permissions, not as a harmless context cache. Potential safeguards include restricting persistence for low-trust sources, preserving provenance, requiring multiple independent pieces of evidence for high-impact memories, monitoring concentrated writes of similar records, and revalidating retrieved content before invoking sensitive tools. The main limitation is that all figures come from the authors’ experiments. Although the paper links to GitHub, at the time of verification the repository merely stated that the code was forthcoming, so the attack cannot yet be independently reproduced or the fairness of the defense configurations confirmed.