InjecMEM Poisons an Agent's Memory in a Single Interaction With No Read or Write Access to the Store

arXiv 2608.23471·high signalXBlueskyLinkedInCopy link

InjecMEM crafts a memory record combining a retriever-agnostic anchor carrying high-recall topical cues with a short adversarial command optimized via gradient-based coordinate search, averaged over synthetic prompt templates and insertion positions. A single normal interaction is enough to steer later responses on related queries toward a pre-specified output, with no read or edit access to the memory store required. It stays effective under memory drift and across multiple memory systems and backbone models, while leaving non-target queries unaffected, which makes it hard to notice in normal use.