1 Introduction↩︎

Large Language Model (LLM)-based agents increasingly rely on external tools to complete tasks beyond text generation [1]. In such tool-augmented setting, agent’s performance highly depends on making correct action-routing decisions, including planing multi-step behaviors, decomposing tasks, and selecting an appropriate tool at each step [2]. [3] identify tool selection as a key bottleneck for agent reliability, especially in safety-critical workflows: a single misuse can propagate across subsequent steps, amplifying a local error into a system-level breakdown. More importantly, tool misuse can cross security boundaries: invoking an unintended tool may expose sensitive data, mutate protected state, or execute actions beyond the user’s intended privilege level, turning a reliability failure into a security incident [4]. These risks are amplified in autonomous settings where tool invocations proceed without immediate human review. For these reasons, tool selection is not a peripheral implementation detail, but a core control mechanism governing agent behavior, efficiency, and security.

Unfortunately, recent work [5]–[7] shows that existing tool selection mechanisms are vulnerable: an attacker can easily manipulate the agent’s tool choice by injecting adversarial content into the metadata, thereby compromising the tool retrieval and selection process toward attacker-injected tools. Despite the high attack success rates, these approaches share three practical limitations. (i) Easy to be detected: these attacks introduce explicit prompt-like artifacts in tool descriptors, which can be captured by anomaly-oriented defenses and system-level auditing. (ii) Fragility to memory updates: as agents increasingly leverage memory management and self-reflection to refine tool-use policies [8], [9], static injection patterns can be overridden by the agent’s own accumulated experience. (iii) Non-persistence: once the agent observes execution outcomes or accumulates tool-use experience, an induced preference from a poisoned descriptor attenuates unless the attacker continually re-adapts the injected content. These limitations raise a research question: Can an attacker achieve persistent and stealthy tool-selection manipulation without modifying the tool descriptors or relying on explicit prompt artifacts?

Our answer is affirmative. We identify the agent’s long-term memory module as a more potent attack surface for compromising tool selection. This component has been widely adopted by modern agent frameworks to stabilize behavior and improve decisions via stored experience, state, and reflection [8], [10]. The attacker can inject malicious data into the memory, which will be retrieved as internal guidance during the agent’s reasoning process, shaping how the agent interprets the current situation before it selects the tool (Figure 1). This vector is inherently (i) stealthier, as memories are natural-language records indistinguishable from legitimate experience; (ii) more durable, as once written to the long-term store, the memories can be consulted repeatedly across future tasks; and (iii) more robust to agent self-correction, as the agent’s reflection mechanisms treat retrieved memories as authoritative evidence rather than external instructions.

We propose MemMorph, a new attack framework that compromises tool selection by injecting a small number of crafted records into the agent’s long-term memory store. Instead of directly specifying which tool the agent should select, these injected memory records subtly alter the agent’s interpretation of the current context, steering its internal reasoning process toward an attacker-intended tool choice. The attack proceeds in three stages. First, we approximate the retrieval-query distribution for a target scenario via LLM-based generation and embedding-space clustering, producing compact optimization targets. Second, following the CoALA taxonomy [11], we generate memory seeds in three styles (factual, episodic, and policy), each composed of a topical frame, a preservation anchor, and an attack payload, so that the agent’s memory module \(\mathcal{W}\) retains the attack-critical content during its rewriting process. Third, we refine each memory through block-scoped optimization under a monotonically relaxed attack-utility constraint verified through a shadow agent. The resulting records are benign-looking, topically relevant, and \(\mathcal{W}\)-robust: once retrieved, they steer the agent toward the attacker-specified tool without any trigger phrase or explicit instruction.

We evaluate MemMorph on three benchmarks spanning ten mainstream agent backbone LLMs and four attack baselines. MemMorph outperforms the strongest baseline by up to 25% in attack success rate while requiring only a 1% poison rate. The attack retains potency under indirect injection through natural conversation, across three different memory-module implementations, and against three representative defense techniques, revealing systematic vulnerabilities in current LLM agent framework. Our main contributions are as follows:

• We identify long-term memory as a practical and under-explored attack surface for compromising tool selection in LLM agents

• We propose MemMorph, the first memory poisoning attack targeting agent’s tool-selection featuring structured memory design and block-scoped gradient-projected optimization with end-to-end effectiveness verification.

• We conduct comprehensive experiments across three benchmarks, three memory modules and three defense techniques, demonstrating the efficacy and robustness of MemMorph under a minimal poisoning budget.

2 Related Work↩︎

2.1 Prompt Injection against Tool Selection↩︎

Existing attacks on tool selection target the tool library by embedding malicious instructions into tool metadata. ToolHijacker [5] shows that inserting adversarial tool documents can bias the retriever-and-ranker pipeline, causing the agent to select injected tools. ToolCommander [6] demonstrates a related mechanism where injected tool metadata act as “commanding” interfaces that distort tool orchestration and lead to unsafe invocations. However, as discussed in §1, these attacks face stealthiness and effectiveness challenges when targeting new stateful agents. This motivates attacks targeting the agent’s internal state rather than the tool interface alone.

2.2 Memory Mechanisms and Poisoning↩︎

To sustain long-horizon behaviour, modern agent systems incorporate explicit memory modules that persist interaction traces and retrieve relevant items to condition subsequent planning [12], making retrieved content part of the agent’s effective state. This retrieval dependence introduces a corresponding attack surface. PoisonedRAG [13] demonstrates that injecting adversarial passages into a RAG knowledge base corrupts generations for targeted queries, and MINJA [14] further shows that adversarial records can be implanted through normal user interactions. These studies establish memory as a high-impact attack surface but focus on corrupting general outputs and assume records are stored verbatim, without accounting for the memory processing stage that modern agents apply before persistence.

3 Preliminary↩︎

3.1 System Setting↩︎

We consider an LLM agent augmented with a tool set \(\mathcal{T}=\{t_1,\dots,t_{N_T}\}\) and a long-term memory store \(\mathcal{D}\) that persists across interaction sessions. Given an environment state \(s \in \mathcal{X}\), the agent first retrieves a small set of memory records \(\mathcal{M}=\mathcal{G}(\mathcal{R}_{\mathrm{q}}(s),\mathcal{D})\) with retrieval query \(q\), where \(\mathcal{R}\) is the retriever with a dense encoder \(f_\theta\) and \(\mathcal{G}\) denotes the memory retrieval-and-selection pipeline. Then the agent selects a tool \(t\!\in\!\mathcal{T}\) according to \(\pi(t\mid s,\mathcal{M})=\Pr[a\!=\!t\mid s,\mathcal{M}]\).

Before storage, each raw record \(m\) passes through a memory module \(\mathcal{W}\), typically a prompted LLM call that may summarize, extract facts, or rewrite, yielding the stored form \(\bar{m}=\mathcal{W}(m)\). All records in \(\mathcal{D}\), whether benign or adversarial, undergo the same transformation.

3.2 Threat Model↩︎

Attack Scenarios. We consider scenarios where tool choice is safety-critical: selecting the wrong tool may cause data loss, service disruption, or security breach. Let \(S\) denote a target attack scenario. We target \(\mathcal{X}_{\mathrm{S}} \subset \mathcal{X}\), where the agent is expected to prefer a non-destructive tool \(t_{\mathrm{safe}} \in \mathcal{T}\) (e.g., diagnose_process(): inspecting logs to identify the cause before acting) over a hazardous but legitimate alternative \(t_{\mathrm{risk}} \in \mathcal{T}\) (e.g., terminate_instance(): immediately shutting down the server).

Attacker’s Objective. The attacker injects a small poison set \(\mathcal{M}_p=\{\tilde{m}_1,\dots,\tilde{m}_n\}\) with budget \(n\ll|\mathcal{D}|\), producing the poisoned store \(\mathcal{D}^*\!=\!\mathcal{D}\cup\bigl\{\mathcal{W}(\tilde{m})\!:\tilde{m} \!\in\!\mathcal{M}_p\bigr\}\). The goal is to maximize the risky-tool selection on safety-critical states: \[\begin{align} \max_{\mathcal{M}_p} \;&\; \mathbb{E}_{s \sim \mathcal{X}_{\mathrm{S}}} \bigl[\pi(t_{\mathrm{risk}} \mid s, \mathcal{G}(\mathcal{R}_{\mathrm{q}}(s),\mathcal{D}^*))\bigr] \label{eq:obj95target} \end{align}\tag{1}\]

3.2.0.1 Attacker’s Capabilities.

The attacker cannot modify the tool set \(\mathcal{T}\), the encoder \(f_\theta\), or the agent’s internal weights and prompts. The attacker’s sole capability is injecting a small number of crafted records into \(\mathcal{D}\). This is realistic because modern memory modules automatically ingest and persist content without provenance verification [14]. We consider two injection channels: (i) Direct poisoning–the attacker writes to \(\mathcal{D}\) directly, modelling a compromised memory backend; (ii) Indirect poisoning–the attacker interacts as an ordinary user, crafting dialogue turns that the agent organically memorizes as legitimate experience [14]. In the indirect setting, records must survive \(\mathcal{W}\)’s full processing pipeline before being persisted. Also, we assume white-box access to \(\mathcal{W}\): since it is typically a prompted LLM call whose template is part of the agent framework’s public repo [10], the attacker can replicate and execute it locally. Because repeatedly querying the deployed agent is impractical, the attacker maintains a local shadow agent \(\pi_{\mathrm{sh}}\) with the same tool set \(\mathcal{T}\) and system-prompt template.

4 Methodology↩︎

Directly optimizing Eq.@eq:eq:obj95target in an end-to-end manner is intractable, as the agent’s policy \(\pi\) and memory module \(\mathcal{W}\) are non-differentiable. We therefore decompose the attacker’s objective into two requirements on each poisoned record: it must be retrievable (involved in the agent’s retrieved set \(\mathcal{M}\) for safety-critical queries), and effective (biasing tool selection toward \(t_{\mathrm{risk}}\) once retrieved). Both requirements must hold after \(\mathcal{W}\)’s rewriting while maintaining fluency.

Our attack differs from prior memory poisoning in two respects. First, it is trigger-free: existing methods require either an explicit adversarial trigger in the user’s query or a predefined activation pattern at inference time, limiting their practicality in open-ended agent interactions. MemMorph activates whenever any natural query falls within the target scenario \(S\). Second, it explicitly accounts for the memory module \(\mathcal{W}\) that rewrites every record before storage that prior RAG poisoning methods do not address.

As shown in Figure 1, the overall pipeline of MemMorph consists of three stages: potential query modeling, structured memory initialization, and constrained memory optimization.

4.1 Potential Query Modeling↩︎

Since the attacker cannot observe the agent’s retrieval queries at inference time, we adapt the query modeling technique from [15] to approximate the distribution of queries \(q=\mathcal{R}_{\mathrm{q}}(s)\) induced by states \(s\in\mathcal{X}_S\). We prompt an LLM with a structured description of \(S\) and sample \(N_q\) diverse queries \(\mathcal{Q}_S=\{q_1,\dots,q_{N_q}\}\), using temperature and nucleus sampling. Each query is embedded via \(f_\theta\); we apply \(k\)-means on the \(\ell_2\)-normalized embeddings to obtain \(K\) centroids \(\{\mu_1,\dots,\mu_K\}\), each summarizing a distinct query pattern for \(S\). Clustering compresses a large query set into compact differentiable targets and prevents the optimizer from overfitting to any single phrasing. These centroids are used as optimization targets in §4.3.

4.2 Structured Memory Initialization↩︎

Naively crafted adversarial content is brittle: \(\mathcal{W}\) routinely distorts the attack signal during processing. We counter this by designing records whose semantic structure aligns with what \(\mathcal{W}\) is built to preserve the stylistic diversity that hedges against unpredictable information loss. Each memory seed is composed of three functionally distinct segments: \[m = m_{\mathrm{frame}}\oplus m_{\mathrm{anchor}}\oplus m_{\mathrm{payload}}, \label{eq:seed95structure}\tag{2}\] where \(\oplus\) denotes string concatenation.

• \(m_{\mathrm{frame}}\): a benign, style-appropriate description that grounds the record in \(S\), providing topical relevance to the retriever and making the record indistinguishable from legitimate memory entries.

• \(m_{\mathrm{anchor}}\): a short structural marker (e.g., “KEY FACT:”, “Lesson learnt:”, “User Prefer:”) placed before the payload. LLMs exhibit well-documented tendencies to treat structural labels as salience cues during summarization [16]; the anchor exploits this bias so that \(\mathcal{W}\) disproportionately retains the subsequent payload. We validate this effect in §5.3; the full marker set and selection process are detailed in Appendix §8.2.

• \(m_{\mathrm{payload}}\): content carrying an attack signal to bias the agent’s reasoning toward \(t_{\mathrm{risk}}\) once retrieved. The payload is the only component to be optimized to maximize the retrieval relevance and remain effective.

This separation allows the optimizer to focus on a compact text span without risking the structural integrity that shields the record against \(\mathcal{W}\).

Real-world long-term memory stores typically contain a mix of factual knowledge, experiential records, and procedural guidelines. Specifically, the CoALA framework [11] decomposes an agent’s long-term memory into semantic (world knowledge), episodic (past experiences), and procedural (learned rules) modules. We mirror this trichotomy so that our poisoned seeds are structurally indistinguishable from each memory type the agent is designed to store and trust:

• Factual (semantic): a verifiable assertion or operational statistic relevant to tool choice.

• Episodic: a past-case summary whose lesson serves as precedent.

• Policy (procedural): a best-practice rule or procedural recommendation.

This design is motivated by two hypotheses. First, multi-style records provide corroborating evidence from independent angles: when the agent retrieves a statistic, an incident report, and a policy recommendation all pointing toward \(t_{\mathrm{risk}}\), the apparent consensus is more convincing than any single record. Second, it strengthens robustness: since \(\mathcal{W}\)’s processing may favor certain content types over others, stylistic diversity hedges against unpredictable information loss, increasing the probability that at least some payloads survive intact (§5.3).

Not all seeds effectively steer tool selection. We evaluate each by its standalone attack utility under the shadow agent: \[\mathcal{U}(m;S) =\frac{1}{|\mathcal{Q}_S|} \sum_{q\in\mathcal{Q}_S} \pi_{\mathrm{sh}}\!\bigl( t_{\mathrm{risk}}\mid q,\bigl\{\mathcal{W}(m)\bigr\} \bigr), \label{eq:seed95utility}\tag{3}\] We retain the top-\(n_{\mathrm{s}}\) seeds as starting points for optimization.

4.3 Constrained Memory Optimization↩︎

The retained seeds achieve high attack utility \(\mathcal{U}\) but may not be retrievable. We now optimize each seed’s retrieval relevance while preserving the effectiveness and fluency.

Given a seed \(m^{(0)}=m_{\mathrm{frame}}\oplus m_{\mathrm{anchor}}\oplus m_{\mathrm{payload}}^{(0)}\) and its nearest centroid \(c=\arg\max_{\mu_k}\,\mu_k^{\!\top}f_\theta(m^{(0)})\), we optimize the payload (\(m_{\mathrm{frame}}\) and \(m_{\mathrm{anchor}}\) frozen) as: \[\begin{align} m^{*} &\;=\;\arg\max_{\hat{m}_{\mathrm{payload}}} \;\mathcal{J}_{\mathrm{retr}}\!\bigl(m;\;c\bigr), \label{eq:opt95main} \\[2pt] \text{s.t.}\quad &\mathcal{L}_{\mathrm{ppl}}(m)\le\eta_{\mathrm{ppl}},\;\; \mathcal{U}(m;S)\ge\beta_{\mathrm{eff}}, \notag \end{align}\tag{4}\] The retrieval objective is a centroid-softmax proxy for retrieval ranking: \[\mathcal{J}_{\mathrm{retr}}(m;\,c) \;=\;\frac{ \exp\!\bigl(c^{\!\top}f_\theta(m)/\tau\bigr) }{ \sum_{k=1}^{K} \exp\!\bigl(\mu_k^{\!\top}f_\theta(m)/\tau\bigr) }, \label{eq:retrieval95utility}\tag{5}\] where \(\tau\) is a temperature scalar.

The fluency constraint \(\mathcal{L}_{\mathrm{ppl}}(m) =\exp\bigl({-}\frac{1}{|m|}\sum_i\log p_{\mathrm{ref}}(w_i\mid w_{<i})\bigr)\) bounds perplexity under a reference LM \(p_{\mathrm{ref}}\). The utility constraint \(\mathcal{U}(m;\,S)\!\ge\!\beta_{\mathrm{eff}}\) (Eq. 3 ) provides end-to-end verification.

We solve this optimization through block-scoped Iterative refinement. \(\mathcal{W}\) rewrites text at semantic granularity (summarization, fact extraction, or paraphrasing) so scattered token edits create distributional artifacts that \(\mathcal{W}\) distorts. We therefore segment the payload into clause-level blocks \(m_{\mathrm{payload}} =b_1 \oplus \cdots \oplus b_M\) via dependency parsing (Appendix §8.3) and restrict each iteration to a single block, ensuring every edit stays within a meaning-bearing unit that \(\mathcal{W}\) processes holistically.

At each iteration \(t\), we perform a single backward pass through \(f_\theta\) to obtain the per-token retrieval gradient \(g_r\!=\!\partial\log\mathcal{J}_{\mathrm{retr}}(m;\,c)/\partial\,\mathbf{e}_{w_r}\), where \(\mathbf{e}_{w_r}\!\in\!\mathbb{R}^{d_e}\) is the encoder input embedding of token \(w_r\). We select the highest-gradient block: \[b^*\!=\!\arg\max_{b_j}\!\sum_{w_r\in b_j} \!\lVert g_r\rVert_2. \label{eq:block95selection}\tag{6}\]

Within \(b^*\), we project the retrieval gradient onto the encoder vocabulary to score each candidate token \(v\!\in\!V\) at position \(r\): \[\mathrm{Score}(v,r) \;=\;g_r^{\!\top}\,\mathbf{e}_v, \label{eq:alignment95score}\tag{7}\] Then we retain the top-\(k_{\mathrm{sub}}\) tokens per position and discard those over the fluency bound: \[{!}{ \hat{\mathcal{C}}_r \!=\! \bigl\{v \!\in\! \mathrm{top}\text{-}k_{\mathrm{sub}} (\mathrm{Score}(\cdot,r)) :\, \mathcal{L}_{\mathrm{ppl}}(m|_{w_r\to v}) \!\le\! \eta_{\mathrm{ppl}} \bigr\}, } \label{eq:candidate95set}\tag{8}\] where \(m|_{w_r\to v}\) denotes \(m\) with position \(r\) replaced by \(v\). Since a substitution at one position alters the contextual encoding of neighbours, we process positions sequentially in descending \(\lVert g_r\rVert_2\) order, recomputing the gradient after each accepted edit. To avoid greedy collapse to a single trajectory, we maintain a beam of width \(b\): at each position, every current variant is expanded with its \(\hat{\mathcal{C}}_r\) substitutions and only the top-\(b\) variants by \(\mathcal{J}_{\mathrm{retr}}\) are retained. After all positions in \(b^*\) are processed, the surviving beams form the candidate set \(\mathcal{C}^{(t)}\).

Since \(|\mathcal{C}^{(t)}|\!\le\!b\) is small, We evaluate each candidate’s attack utility \(\mathcal{U}(m';\!S)\) via a single batched shadow-agent call. Because early iterations may not satisfy \(\beta_{\mathrm{eff}}\) directly, we apply a monotonic relaxation, retaining candidates that improve over the previous iteration: \[{!}{ \hat{\mathcal{C}}^{(t)} \!=\! \bigl\{m' \!\in\! \mathcal{C}^{(t)} \;\big|\; \mathcal{U}(m';\!S) \!\ge\! \mathcal{U}(m^{(t-1)};\!S) \;\text{or}\; \mathcal{U}(m';\!S) \!\ge\! \beta_{\mathrm{eff}} \bigr\}. \label{eq:soft95constraint} }\tag{9}\] Then we select: \[m^{+} \!=\!\arg\max_{m'\in\hat{\mathcal{C}}^{(t)}} \mathcal{J}_{\mathrm{retr}}(m';\,c). \label{eq:final95select}\tag{10}\] We update \(m\!\leftarrow\!m^+\) and iterate until \(T_{\max}\) iterations elapse or convergence; the final record is added to \(\mathcal{M}_p\). The overall procedure of the optimization is detailed in Algorithm 8.1.

5 Experiment↩︎

5.1 Setup↩︎

Agent Framework. We instantiate our attack on a ReAct-style LLM agent [1] equipped with Mem0² as its long-term memory module. At each step the agent retrieves relevant records and selects a tool conditioned on the query and retrieved context. Each scenario’s store \(\mathcal{D}\) is seeded with 300 benign records from successful interaction trajectories.

Dataset. We evaluate MemMorph on MetaTool [3], \(\tau^2\)-Bench [17], and ToolBench [18]. For each dataset, we select 3 real-world scenarios and generate 200 safety-critical tasks per scenario, each requiring selection of \(t_{\mathrm{safe}}\) (e.g., diagnose_process()) over an available \(t_{\mathrm{risk}}\) (e.g., terminate_instance()). Details in §9.4.

Models. We use Llama-3-8B-Instruct as the shadow model and evaluate MemMorph across ten agent backbone LLMs spanning three families and five scales, including open-source (Llama-3-8B-Instruct, Llama-3-70B-Instruct, Qwen2.5-7B-Instruct, Qwen2.5-32B-Instruct, GPT-OSS-20B) and closed-source (GPT-o4-mini, GPT-4o, Claude-Sonnet-4.5, Claude-Haiku-4.5, Claude-Opus-4.1).

Attack Settings. We evaluate both injection channels defined in §3.2. Under direct poisoning, optimized records are inserted into \(\mathcal{D}\). Under indirect poisoning, the same records are delivered through multi-turn dialogue. We inject \(|\mathcal{M}_p|\!=\!3\) adversarial records per scenario. Full hyperparameters are in §9.1.

Baselines. We compare MemMorph against four methods spanning two attack categories. (1) Memory poisoning: GCG [19] crafts adversarial suffixes via greedy coordinate-gradient search; PoisonedRAG [13] optimizes passages for preferential retrieval in RAG pipelines. (2) Prompt injection: ToolHijacker [5] and ToolCommander [6] embed malicious instructions in tool descriptions or API metadata. Memory-poisoning baselines share the same budget and benign environment; prompt-injection baselines serve as reference points from a complementary attack surface.

Metric. We consider two metrics: (1) ASR: fraction of critical tasks where the agent selects \(t_{\mathrm{risk}}\); (2) AHR: fraction of tasks where at least one poisoned record appears in the retrieved context \(\mathcal{M}\).

4pt

5pt

5.2 Main Result↩︎

Table 1 reports ASR of different methods under direct poisoning. Each value is averaged over the target scenarios within a dataset. Comparisons with baselines. Memory-poisoning attacks (i.e., MemMorph, GCG, PoisonedRAG) consistently outperform prompt-injection methods (ToolHijacker, ToolCommander), confirming the importance of memory context on agent decision making than static tool descriptions. Among memory-poisoning methods, MemMorph surpasses the strongest baseline by 14.7-25.9% in average ASR across all three datasets. The critical difference lies in the record design: GCG and PoisonedRAG optimize raw adversarial strings that lack structural resemblance to genuine memory entries, making them less likely to persist in the memory store and less persuasive once retrieved. MemMorph’s structured initialization produces records that are both retrievable and effective, yielding consistent gains over unstructured perturbations.

Effectiveness across model families. MemMorph achieves ASRs of above 70% on 8 of the 10 LLM backbone evaluated. This indicates that the attack operates at the semantic level: structured records that read as legitimate technical facts, incident reports, and policy recommendations are persuasive to any instruction-following LLM, regardless of the architecture.

Retrieval hit rate. Table 2 reports the AHR averaged across three datasets. MemMorph achieves averaged 92.3% on three benchmarks, outperforming PoisonedRAG by 12.4% and GCG by 28.3%, confirming that our optimization effectively positions poisoned records within the retriever’s high-relevance region. Notably, retrieval alone is insufficient: PoisonedRAG achieves reasonable AHR of 80.0% but substantially lower ASR, indicating that its retrieved content lacks the persuasive structure needed to bias tool selection. MemMorph’s multi-style structured design bridges this gap.

Surviving memory processing pipeline. Figure 2 compares ASR under direct and indirect poisoning on three benchmarks with four backbone LLMs. Under indirect poisoning, adversarial records are delivered via MINJA’s interaction-based injection channel [14], where content must survive Mem0’s full processing pipeline before storage. MemMorph incurs only a 9.9% average ASR drop relative to direct poisoning, confirming that structured records survive \(\mathcal{W}\)’s rewriting with minimal loss of attack potency and posing a practical threat under realistic injection conditions.

4pt

4pt

5.3 Analysis↩︎

Persistence under continued operation. We simulate extended deployment by injecting \(n{=}3\) records once and scaling \(|\mathcal{D}|\) from 300 to 2,000 benign records while the agent continues accumulating new traces without further attacker intervention (Figure 3), full results in §9.2. Despite a 6.7\(\times\) memory growth, MemMorph sustains 43.1% ASR at \(|\mathcal{D}|=2000\), outperforming the strongest baseline 28.8%. Unstructured adversarial records from baselines are progressively diluted out of the retrieval window as benign entries accumulate. whereas MemMorph’s structurally legitimate records are neither flagged nor overwritten during routine operation; they remain inert during unrelated tasks, yet are reliably retrieved and effective when target-scenario queries arise, confirming that a one-time injection exerts lasting influence throughout extended deployment.

Component Ablation. Table 3 isolates three core design choices under both injection settings. Removing anchors has minimal impact under direct poisoning but causes an 8.2% ASR drop under indirect poisoning, confirming that structural markers primarily protect payload survival during \(\mathcal{W}\)’s rewriting. Also, Single-style poisoning (three records of the same style instead of one per style) retains reasonable AHR of 81.5% but drops ASR by 19.2%. This confirms that the multi-style design is critical for effectiveness, three records presenting the same type of evidence (e.g., three incident reports) are less persuasive than a statistic, an incident report, and a policy recommendation that independently corroborate the same conclusion. Removing block scoping causes the largest drops, as scattered token edits create distributional artifacts that \(\mathcal{W}\) aggressively rewrites, destroying both the retrieval signal and attack payload.

Memory module generalization. To assess generalization beyond Mem0, we evaluate the same records on two alternative memory modules: MemoryBank [20] and MemoryOS [21]. As shown in Table 4, MemMorph retains above 67% ASR on both memory modules, suggesting that anchors and style-appropriate frames exploit common properties of LLM-based memory processing. Embedding model transferability. Figure [fig:embedding] reports the attack transferability across four widely-used embedding models: E5 [22], BGE [23], Contriever [24], and MiniLM [25]. Off-diagonal entries show that records optimized for one encoder largely retain effectiveness on others, with most cross-transfer pairs exceeding 70% AHR. This is expected: encoders trained with similar contrastive objectives share overlapping high-relevance regions in the embedding space, and our topically grounded frames ensure records remain semantically relevant regardless of encoder-specific geometry.

5.4 Possible Defenses↩︎

We study three types of defense strategies: Perplexity Filter [26] that rejects records exceeding a fluency threshold, Distil Classifier [27] that is trained to distinguish adversarial texts from benign ones, and LLM-based Memory Auditor that prompts a separate LLM to flag suspicious entries. Implementation details are provided in §9.5. As shown in Table [tab:defense], MemMorph exhibits greater resilience against all three defenses compared to the other two baselines, because its poisoned records are fluent and semantically indistinguishable from legitimate experience records, leaving minimal distributional signal for surface-level detection. Memory Auditor, which performs semantic-level inspection, achieves the largest absolute reduction against MemMorph(-23.7% ASR), yet the attack still succeeds on over half the tasks. These results indicate that existing defenses remain insufficient against well-structured memory poisoning.

6 Conclusion↩︎

In this paper, we present MemMorph, a memory-poisoning attack that hijacks tool selection in LLM agents by injecting a small number of crafted records into long-term memory rather than modifying tool metadata. Our comprehensive evaluation results demonstrate the effectiveness of MemMorph compared to baselines. Furthermore, we find that current defenses are insufficient to prevent our attack, which calls for more advanced solutions to mitigate MemMorph as future work.

7 Limitation and Discussion↩︎

Our threat model assumes white-box access to the memory module \(\mathcal{W}\), which is realistic for open-source agent frameworks but may not generalize to proprietary systems. Additionally, our evaluation targets single-step tool-selection decisions. Multi-step agents with human oversight may partially correct a poisoned selection downstream; however, since memory-level bias persists across turns and re-activates independently at each retrieval, oversight provides only partial mitigation rather than systematic protection. Evaluating MemMorph in fully agentic multi-step settings is a direct extension of this work. While existing defenses prove insufficient to fully prevent the attack, we hope this work motivates the community to develop advanced memory-integrity framework, such as provenance tracking and semantic consistency verification, as foundational components of robust agentic systems.

8 Method Details↩︎

8.1 Algorithm↩︎

Algorithm 4 shows the details of constrained memory optimization (§4.3), which is the core procedure of MemMorph.

8.2 Anchor Markers↩︎

Table 5 lists the anchor markers used in MemMorph, grouped by category and aligned with their most natural seed style.

8.2.0.1 Selection process.

We derive the anchor set through two complementary analyses. First, we inspect the source code and system prompts of the memory module Mem0 to identify how it instructs its backbone LLM to process incoming records–specifically, which content types the prompts explicitly ask to preserve. Second, we conduct a controlled retention experiment: we construct 200 synthetic records, each prepended with a candidate marker drawn from a pool of 30 common discourse prefixes (e.g., “Note:”, “FYI:”, “Background:”), pass each record through all three modules, and measure post-marker content retention via ROUGE-L between input and output. Markers achieving \(>\)​80% retention rate across all modules are included in our final set, yielding the 12 markers across four categories in Table 5. The generalization of selected markers to MemoryBank and MemoryOS is evaluated as a held-out test in §5.3.

8.3 Block Segmentation↩︎

Since \(\mathcal{W}\) processes text at semantic granularity, scattered token edits create distributional artifacts that \(\mathcal{W}\) aggressively rewrites. Block segmentation restricts each optimization step to a single meaning-bearing unit, ensuring edits remain coherent after rewriting.

We apply a dependency parser to the payload and identify segmentation boundaries at two levels: (i) sentence level–periods, semicolons, and newlines–which divide the payload into coarse units; and (ii) clause level–tokens heading a clausal dependency relation (advcl, ccomp, relcl, conj)–which further subdivide each sentence into subordinate clauses, complement clauses, and coordinated structures.

Blocks shorter than \(L_{\min}{=}4\) tokens are merged with their left neighbour; blocks exceeding \(L_{\max}{=}25\) tokens are split at the nearest conjunction or comma. This yields blocks of typical length 6–20 tokens, each representing a coherent semantic unit. Boundaries are recomputed after each accepted edit, as token substitutions may shift local syntactic structure. If the parser returns a single-block parse, we fall back to whitespace-delimited bigrams. We use spaCy’s en_core_web_md model; parsing overhead is negligible (\(<\)​8 ms per payload).

9 Experiments and Additional Results↩︎

9.1 Hyperparameters↩︎

Table 6 lists all hyperparameters used in MemMorph. We keep the poison budget fixed at \(n{=}3\) records per scenario (one per style) across all experiments, corresponding to a 1.0% poison ratio relative to the 300 benign records in \(\mathcal{D}\).

9.2 Additional Results↩︎

Figure 5 reports additional result for the persistence experiment (§5.3). Results are shown separately for MetaTool, \(\tau^2\)-Bench, and ToolBench under three backbone LLMs.

9.3 Prompt Templates↩︎

All prompts are executed with Claude Sonnet 4.6 via the Anthropic API. The query generation prompt (§4.1) samples with temperature \(T{=}0.9\) and nucleus threshold \(p{=}0.95\) in batches of 20.

The seed generation prompts (§4.2) produce records following the \(m_{\mathrm{frame}} \oplus m_{\mathrm{anchor}} \oplus m_{\mathrm{pay}}\) structure at temperature \(T{=}0.7\); the shared header (scenario, tools, sample queries) is identical across all three style prompts.

Full prompts are shown in Figures [fig:potential95query]–[fig:seed].

9.4 Dataset and Scenario Details↩︎

For each dataset, we select three scenarios where \(t_{\mathrm{risk}}\) has concrete safety consequences. Full Scenarios describes in Figure[app:meta],[app:tau],[app:toolbench].

9.5 Defense Details↩︎

We evaluate three representative defense strategies that operate at the agent memory storage stage, spanning complementary detection paradigms: statistical filtering, supervised classification, and LLM-based semantic auditing. All defenses are applied identically to every record (benign and adversarial) at storage time; records flagged as adversarial are rejected before entering \(\mathcal{D}\). To ensure fair comparison, we calibrate each defense so that its false-positive rate (FPR) on the 300 benign records in \(\mathcal{D}\) does not exceed 5%; achieved FPRs are 4.7%, 3.9%, and 4.3% for Defenses 1–3 respectively.

9.5.0.1 Defense 1: Perplexity Filter [26].

We compute the per-token perplexity of each incoming record using a frozen GPT-2 model and reject records whose perplexity exceeds the 95th percentile of the benign records in \(\mathcal{D}\).

9.5.0.2 Defense 2: Distillation-based Classifier [27].

We fine-tune a DistilBERT-base-uncased classifier [27] on the safe/harmful prompt taxonomy derived from Llama Guard [28] to distinguish adversarial content. rucially, no records from any of the evaluated attack methods (GCG, PoisonedRAG, MemMorph) records appear in the training data, placing all methods under an equal out-of-distribution evaluation. Training uses AdamW (lr \(=\) \(10^{-5}\), batch size 32, 10 epochs); we select the checkpoint with the lowest validation loss.

9.5.0.3 Defense 3: LLM-based Memory Auditor.

This defense uses a separate LLM GPT-4o-mini instance to perform semantic-level inspection of each incoming record, representing the strongest detection paradigm we evaluate. We prompt GPT-4o-mini to classify records as BENIGN or ADVERSARIAL using the following template:

Records classified as ADVERSARIAL are rejected.

References↩︎

---

1. Corresponding author.↩︎

2. https://github.com/mem0ai/mem0↩︎