MAFIA: Query-Only Memory Attacks via Probing and Factual Injection against Audited LLM Agents
Researchers propose MAFIA, a query-only memory attack framework against memory-augmented LLM agents. It introduces a placement strategy for retrieval-competitive injection via memory probing, budget allocation, and scheduling, and a payload design that bypasses audits using compact factual cloaks. Evaluations show up to 90.7% attack success rate while reducing audit detection from 83.3% to at most 7.4%.
Memory-augmented LLM agents are vulnerable to memory poisoning, but existing query-only attacks fail in realistic settings with large benign memory pools and active input auditing. MAFIA overcomes these limitations with a placement strategy ensuring retrieval-competitive injection and a payload design that evades semantic checks. The framework achieves high attack success while drastically lowering audit detection, exposing critical vulnerabilities in audited LLM agents.
MAFIA combines memory probing to identify optimal injection points with budget-aware scheduling to maximize retrieval competitiveness. Its payload uses factual cloaks—compact, semantically similar text—to preserve malicious intent while bypassing audit mechanisms. This dual approach effectively subverts both retrieval and auditing defenses.
The findings highlight a significant security gap in deployed LLM agent systems that rely on memory and auditing. Organizations using such agents for long-horizon tasks may need to reassess their trust in memory integrity and audit robustness, as current safeguards can be circumvented by sophisticated query-only attacks.
This research underscores the business risk of deploying LLM agents without robust memory security, as successful attacks could lead to data corruption, misinformation, or compromised decision-making. It creates opportunities for security vendors to offer memory protection solutions and for enterprises to invest in hardening their AI agent infrastructure.
Next signals include potential development of more resilient memory architectures and auditing techniques, as well as increased research into adversarial defenses for LLM agents. The attack framework may also spur red-teaming efforts and security benchmarks for memory-augmented systems.