Stealth Memory Injection in LLM Agents

• Stealth memory injection is an attack vector that compromises persistent memory to manipulate agent retrieval, reasoning, and decision-making.
• It exploits mechanisms like similarity-based retrieval, selective-memory poisoning, and tool-selection attacks to plant adversarial content undetected.
• Empirical studies show significant performance degradation and high cross-model transferability, highlighting a robust threat across diverse agent architectures.

Stealth memory injection denotes a family of attacks in which adversarial content is caused to enter a system’s persistent or recurrent state and is later reused as if it were trusted internal context. In contemporary work, the term is most directly instantiated in long-term memory-augmented LLM agents, where ordinary interaction, external content ingestion, or selective memory pipelines can write false facts, preferences, or procedural guidance into durable memory and later bias retrieval, reasoning, tool selection, or action execution (Piehl et al., 17 Feb 2026, Wang et al., 28 May 2026, Zhang et al., 6 Jul 2026). Closely related literature studies adjacent channels—tool observations, bootstrap guidance, skill documentation, and persistent visual context—that function as short-term or quasi-persistent memory substrates even when no explicit vector store is present (Shen et al., 25 Mar 2026, Liu et al., 20 Mar 2026, Jia et al., 15 Feb 2026, Schlarmann et al., 17 Feb 2026).

1. Conceptual definition and threat model

In the current agent-security literature, stealth memory injection is characterized less by raw prompt override than by corruption of the memory lifecycle: writing, storing, retrieving, and reusing state across time. The most explicit formalization appears in "ER-MIA: Black-Box Adversarial Memory Injection Attacks on Long-Term Memory-Augmented LLMs" (Piehl et al., 17 Feb 2026). There, the clean memory bank is

$\mathcal{M} = \{ m_1, \dots, m_N \},$

and for a query $q$, top-$k$ memories are retrieved by cosine similarity under an encoder $\phi$: $\mathcal{R}(q, \mathcal{M}) = \operatorname{Top}\text{-}k_{m \in \mathcal{M} \;\cos\!\big(\phi(q), \phi(m)\big).$ The model response is then

$$\hat{y} = S\big(q, \mathcal{R}(q, \mathcal{M})\big),$$

while after injection of adversarial memories $\mathcal{M}'$, the augmented bank yields

$$\hat{y}' = S\big(q, \mathcal{R}(q, \tilde{\mathcal{M}})\big),$$

subject to an imperceptibility condition requiring adversarial memories to remain embedding-close to clean memories: $$\forall m' \in \mathcal{M}',\; \exists m \in \mathcal{M}: \cos\!\big(\phi(m), \phi(m')\big) \ge \sigma_s.$$ That paper decomposes the attack into effectiveness, imperceptibility, and agnosticism, making “imperceptibility” the closest explicit analogue of stealth (Piehl et al., 17 Feb 2026).

A second explicit formulation appears in "When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents" (Zhang et al., 6 Jul 2026). There, the agent under configuration $\omega$ maps persistent state $q$0, task $q$1, and external input $q$2 to visible output $q$3 and state modification $q$4: $q$5 A successful attack must satisfy three conditions simultaneously: injection, stealth, and effectiveness. In the paper’s terms, the malicious content must be written into persistent state, remain hidden in the user-visible response during the injection phase, and later affect downstream behavior in a future session (Zhang et al., 6 Jul 2026).

These formulations suggest a narrow and a broad sense of the term. In the narrow sense, stealth memory injection refers to persistent-memory compromise in memory-augmented agents. In the broader sense, it includes any attack that plants durable or repeatedly reused state—textual, visual, procedural, or tool-derived—while keeping the initial compromise non-diagnostic. This broader reading is consistent with papers that study selective memory rewriting, working-memory contamination, bootstrap guidance, and multimodal persistence, even when they do not always use the exact phrase “memory injection” (Wang et al., 28 May 2026, Shen et al., 25 Mar 2026, Liu et al., 20 Mar 2026, Schlarmann et al., 17 Feb 2026).

2. Principal mechanisms in long-term memory-augmented agents

The direct LLM-agent literature identifies several distinct but related attack mechanisms. They differ mainly in where the poison enters the system and what memory representation it exploits.

Mechanism	Representative papers	Core feature
Similarity-retrieval poisoning	(Piehl et al., 17 Feb 2026)	Embedding-close memories are later co-retrieved
Selective-memory poisoning	(Wang et al., 28 May 2026)	Trigger and payload survive extraction and rewriting
Tool-selection memory poisoning	(Zhang et al., 24 May 2026)	Memory records bias tool choice without explicit commands
User-only induced memory writes	(Dong et al., 5 Mar 2025)	Ordinary queries cause the agent to create malicious records
External-content memory seeding	(Zhang et al., 6 Jul 2026)	One email induces hidden persistent-state updates

In ER-MIA, the central vulnerability is the similarity-based retrieval mechanism itself rather than model weights, training data, or explicit backdoors. The attacker has “no access to model parameters, retrieval outputs, memory contents, or memory system internals,” and only interacts through the same pathways that ordinary memories use. Two realistic attack settings are formalized. In content-based attacks, adversarial memories are minimally perturbed variants of existing clean memories. In question-targeted attacks, one or two fabricated memories are crafted to restate a target question and attach an incorrect answer. The attack arsenal includes instruction-style attacks, factual contradiction and negation, and even non-semantic probes such as Embedding-Close Noise and Lexical Shuffling, which the paper uses to argue that dense retrieval itself is the system-level vulnerability (Piehl et al., 17 Feb 2026).

MemPoison addresses a different pipeline: selective long-term memory systems that first extract, then rewrite or summarize, and only then store memories. It introduces three components. The semantic relational bridge binds trigger and payload into a coherent, memory-worthy statement. Entity masquerading optimizes the trigger to resemble a named entity so that paraphrasers preserve it. Joint embedding optimization makes trigger-injected texts form a tight cluster while remaining isolated from benign embeddings. The corresponding objectives are an entity loss $q$6, a concentration loss $q$7, and an isolation loss $q$8, optimized with a HotFlip-style coordinate search in discrete trigger space (Wang et al., 28 May 2026).

MemMorph targets long-term memory used during tool selection rather than answer generation alone. Its system model includes a tool set $q$9, a persistent memory store $k$0, retrieval $k$1, generation $k$2, and a rewriting module $k$3. The attacker can inject only a small poison set $k$4, either directly into memory or indirectly via ordinary conversation. Each poison record is structured as a concatenation of frame, anchor, and payload, and is disguised as one of three long-term memory types: factual / semantic, episodic, or policy / procedural. The anchor mechanism is specifically chosen to survive rewriting by memory modules and to increase retention of the attack-bearing segment (Zhang et al., 24 May 2026).

MINJA addresses the case in which the attacker has no direct access to the memory bank at all. The agent retrieves prior records as in-context demonstrations, and the attacker’s goal is to induce the agent itself to generate and store malicious records. The core construction is a memory record of the form

$k$5

where $k$6 is a victim-style query, $k$7 is a sequence of bridging steps linking victim term $k$8 to target term $k$9, and $\phi$0 is the target reasoning sequence. An indication prompt first bootstraps the bridging sequence, and a Progressive Shortening Strategy then gradually removes explicit attack cues until the stored query resembles an ordinary benign query (Dong et al., 5 Mar 2025).

MemGhost operates under an even stronger constraint: a remote black-box adversary has only a single malicious email and no runtime feedback from the victim. It therefore trains an attacker policy offline against a shadow persistent-agent environment. The learned policy $\phi$1 generates an email payload $\phi$2 conditioned on target memory $\phi$3, and optimization is driven by a trace reward

$\phi$4

which combines memory-adoption quality and visible-response stealth (Zhang et al., 6 Jul 2026).

3. Beyond vector stores: adjacent persistent-context channels

Several papers broaden the attack surface beyond explicit long-term memory databases. They show that stealth memory injection is often better understood as a persistent-context problem rather than only a vector-store poisoning problem.

"Invisible Threats from Model Context Protocol: Generating Stealthy Injection Payload via Tree-based Adaptive Search" (Shen et al., 25 Mar 2026) studies malicious MCP tool responses. The paper is explicit that it is not literally about long-term memory poisoning, but it states that malicious content injected into $\phi$5 is ingested directly into the working memory of the agent. The observation history update

$\phi$6

and the updated context

$\phi$7

make the tool response part of effective working memory. TIP, the attack framework in that paper, optimizes natural JSON payloads under a stealth constraint based on perplexity, emphasizing semantic naturalness, schema-conforming placement, and defense-aware adaptation (Shen et al., 25 Mar 2026).

"Trojan's Whisper: Stealthy Manipulation of OpenClaw through Injected Bootstrapped Guidance" (Liu et al., 20 Mar 2026) analyzes another persistent-context substrate: bootstrap guidance files loaded through agent:bootstrap hooks. These files—such as SOUL.md, GUIDE.md, or BEST_PRACTICES.md—become part of the agent’s foundational reasoning context before user interaction. The malicious skill does not insert obvious commands; it injects adversarial operational narratives framed as routine best practices. The paper repeatedly describes this as manipulation of the agent’s interpretive priors and foundational framing, which is closely aligned with stealth memory injection in the broader sense (Liu et al., 20 Mar 2026).

"SkillJect: Automating Stealthy Skill-Based Prompt Injection for Coding Agents with Trace-Driven Closed-Loop Refinement" (Jia et al., 15 Feb 2026) focuses on skills represented as

$\phi$8

where $\phi$9 is SKILL.md and $\mathcal{R}(q, \mathcal{M}) = \operatorname{Top}\text{-}k_{m \in \mathcal{M} \;\cos\!\big(\phi(q), \phi(m)\big).$0 is a set of auxiliary artifacts. The poisoned skill decomposes into

$\mathcal{R}(q, \mathcal{M}) = \operatorname{Top}\text{-}k_{m \in \mathcal{M} \;\cos\!\big(\phi(q), \phi(m)\big).$1

so that a lightweight inducement prompt in documentation triggers execution of a hidden operational payload in scripts or resources. The paper is framed as skill-based prompt injection rather than memory injection, but the mechanism is strongly analogous to persistent memory/context poisoning because the skill is stored, later selected by routing, loaded into context, and treated as a high-privilege capability extension (Jia et al., 15 Feb 2026).

"Visual Memory Injection Attacks for Multi-Turn Conversations" (Schlarmann et al., 17 Feb 2026) extends the notion into the multimodal domain. There, the persistent substrate is not an external memory bank but the image itself, which remains in effective context across a long multi-turn conversation. The attack optimizes a perturbed image $\mathcal{R}(q, \mathcal{M}) = \operatorname{Top}\text{-}k_{m \in \mathcal{M} \;\cos\!\big(\phi(q), \phi(m)\big).$2 so that it preserves benign behavior for an anchor prompt while later producing an attacker-prescribed response under a trigger topic: $\mathcal{R}(q, \mathcal{M}) = \operatorname{Top}\text{-}k_{m \in \mathcal{M} \;\cos\!\big(\phi(q), \phi(m)\big).$3 This attack shows that persistent multimodal conditioning alone can function as a covert memory channel, even without any external memory store (Schlarmann et al., 17 Feb 2026).

4. Empirical characteristics of stealth, persistence, and transfer

The empirical literature shows that stealth memory injection is characterized by small attack footprints, high cross-model transfer, and persistence under large memory stores or long conversations.

ER-MIA reports strong degradation from injected memories alone, without deleting clean memories. On Llama3.2:3b, one injected memory per question causes $\mathcal{R}(q, \mathcal{M}) = \operatorname{Top}\text{-}k_{m \in \mathcal{M} \;\cos\!\big(\phi(q), \phi(m)\big).$4 on A-mem and $\mathcal{R}(q, \mathcal{M}) = \operatorname{Top}\text{-}k_{m \in \mathcal{M} \;\cos\!\big(\phi(q), \phi(m)\big).$5 on Mem0, while two memories per question worsen these to $\mathcal{R}(q, \mathcal{M}) = \operatorname{Top}\text{-}k_{m \in \mathcal{M} \;\cos\!\big(\phi(q), \phi(m)\big).$6 and $\mathcal{R}(q, \mathcal{M}) = \operatorname{Top}\text{-}k_{m \in \mathcal{M} \;\cos\!\big(\phi(q), \phi(m)\big).$7. In Mem0, adversarial retrieval frequency is extremely high: for contradiction attacks it is 99.80% at $\mathcal{R}(q, \mathcal{M}) = \operatorname{Top}\text{-}k_{m \in \mathcal{M} \;\cos\!\big(\phi(q), \phi(m)\big).$8, 99.95% at $\mathcal{R}(q, \mathcal{M}) = \operatorname{Top}\text{-}k_{m \in \mathcal{M} \;\cos\!\big(\phi(q), \phi(m)\big).$9, and 100% at $$\hat{y} = S\big(q, \mathcal{R}(q, \mathcal{M})\big),$$0; for targeted-question attack it is 98.59%, 99.80%, and 99.95%. The paper’s ensemble attacks are stronger still: on Mem0 with Llama3.2, clean overall F1 of 23.60 drops to 2.87 under “Ignore + General Negation,” a $$\hat{y} = S\big(q, \mathcal{R}(q, \mathcal{M})\big),$$1 degradation (Piehl et al., 17 Feb 2026).

MemPoison reports that under Mem0 on the Personal Agent, it achieves ISR 0.98, RSR@1 0.98, ASR 0.95, ACC 0.96. On the Medical Agent with Mem0, ASR reaches 0.94; on the Financial Agent with Mem0, 0.91. The paper also reports that as the number of benign memory records grows from 1,000 to 7,000, MemPoison keeps RSR@1 above 0.95, which is a direct indication that the adversarial cluster remains retrievable in crowded memory spaces (Wang et al., 28 May 2026).

MemMorph shows that only three poisoned records—one factual, one episodic, and one policy—can be enough for effective long-term compromise. Its headline result is up to 85.9% ASR with only three injected records, with an approximately 1.0% poison ratio against an initial store of 300 benign records. The same paper reports average AHR 92.3%, and after one-time injection and growth of benign memory from 300 to 2,000 records, MemMorph still achieves 43.1% ASR, exceeding the strongest baseline by 28.8% (Zhang et al., 24 May 2026).

MINJA reports average ISR = 98.2% and average ASR = 76.8% across healthcare, shopping, and QA agents. Its utility impact on benign tasks is small: the paper states that overall benign drop is less than 2% on average, with nearly all cases below 10%. That combination—high injection success, high downstream success, and limited benign degradation—is central to its claim of stealth (Dong et al., 5 Mar 2025).

MemGhost reports especially strong end-to-end results under the strict single-email, no-feedback threat model. On 56 held-out test cases, it achieves 87.5% E2E on OpenClaw with GPT-5.4 in background mode and 71.4% E2E on Claude Code SDK with Sonnet 4.6 in background mode. The same paper shows strong transfer: OpenClaw with Mem0 reaches 85.7% background E2E, NanoClaw 80.4%, Hermes native 82.1%, and Hermes with Mem0 85.7% (Zhang et al., 6 Jul 2026).

The adjacent persistent-context literature reinforces the same picture. Guidance injection in OpenClaw attains attack success rates from 16.0% to 64.2%, with the majority of malicious actions executed autonomously without user confirmation, and 94% of malicious skills evade existing static and LLM-based scanners (Liu et al., 20 Mar 2026). Visual Memory Injection remains effective after over 25 unrelated turns and with conversations exceeding 10,000 tokens, which demonstrates persistence even without an external memory module (Schlarmann et al., 17 Feb 2026).

5. Defenses, failure modes, and unresolved tensions

The published defense literature is converging on the view that filtering surface anomalies alone is insufficient, because the most successful attacks are structurally plausible, semantically coherent, and often delivered through normal system pathways.

ER-MIA outlines several defense directions without implementing a final defense stack: memory sanitization at write time, contradiction detection and conflict-aware updates, instruction filtering, more metadata and credibility signals, retrieval diversification or clustering, re-ranking using structure, and hardening update policies before ADD/UPDATE/DELETE operations. The same paper argues that systems which automatically write memory from conversation content are vulnerable even when they expose no explicit save-memory API (Piehl et al., 17 Feb 2026).

MemPoison directly evaluates two common defenses. Under perplexity filtering, at $$\hat{y} = S\big(q, \mathcal{R}(q, \mathcal{M})\big),$$2, Naive Concat and AgentPoison are fully neutralized with ASR 0.00, while MemPoison still achieves ASR 0.40; at $$\hat{y} = S\big(q, \mathcal{R}(q, \mathcal{M})\big),$$3, MemPoison reaches ASR 0.87. Under paraphrasing, its ASR remains 0.77–0.89, while Naive Concat and AgentPoison are almost entirely broken. The paper’s interpretation is that semantic binding plus entity masquerading resist both anomaly filtering and rewriting (Wang et al., 28 May 2026).

MemMorph evaluates three memory-storage defenses calibrated to false-positive rate on benign records $$\hat{y} = S\big(q, \mathcal{R}(q, \mathcal{M})\big),$$4: Perplexity Filter, Distil Classifier, and LLM-based Memory Auditor. Under these defenses, MemMorph still reports ASR 65.8 / 69.8 / 54.9 and AHR 82.1 / 84.5 / 72.3, respectively. The Memory Auditor gives the strongest reduction, but the paper’s conclusion is that current memory-level defenses remain inadequate against semantically plausible, retrieval-optimized poisons (Zhang et al., 24 May 2026).

MemGhost tests one defense at each of three levels. DataSentinel has FNR 91.59%. Meta-SecAlign reduces injection but still leaves ISR 49.07% with SSR 98.15%. AgentDoG yields FNR 93.46% on OpenClaw and 40.38% on Claude Code SDK. An explicit user-visibility prompt—“tell me what you checked and what actions you took”—is one of the strongest countermeasures in foreground mode, dropping OpenClaw/GPT-5.4 E2E to 1.8%, but it does not eliminate all success on all platforms (Zhang et al., 6 Jul 2026).

The persistent-context literature reaches similar conclusions from a different direction. TIP argues that context-based prompt-structuring defenses do not separate data from control and that classification-based defenses such as perplexity filtering fail when payloads are semantically plausible (Shen et al., 25 Mar 2026). Trojan’s Whisper argues for capability isolation, runtime policy enforcement, and transparent guidance provenance, because startup-time guidance is otherwise treated as authority-bearing context (Liu et al., 20 Mar 2026). SkillJect likewise suggests dynamic sandboxing and cross-modal consistency verification between documentation and code, since semantic filtering of the visible documentation does not catch payloads hidden in auxiliary artifacts (Jia et al., 15 Feb 2026).

A recurring controversy concerns what exactly counts as stealth. The direct memory-attack papers often operationalize stealth through embedding-space closeness, natural fluency, non-diagnostic visible responses, or limited benign-utility degradation, rather than through formal detector-evasion objectives. This suggests that current literature treats stealth primarily as an operational property of memory adoption and later retrievability, not yet as a standardized metric.

6. Broader security lineage and cross-domain analogues

Outside LLM-agent research, older systems and security literature studies related phenomena under different substrates: dynamic kernel memory, executable JIT pages, encrypted virtual memory, and detector-visible control signals. These works are not about personal-agent memory stores, but they clarify the more general logic of hidden state compromise.

"Hypervisor-Based Active Data Protection for Integrity and Confidentiality of Dynamically Allocated Memory in Windows Kernel" (Korkin, 2018) addresses unauthorized reads and writes to dynamically allocated kernel memory. AllMemPro enforces per-driver ownership over dynamic allocations using EPT, MTF, and fake-page redirection. The paper’s central claim is that unauthorized access to even “1 byte” of memory should be preventable, and it shows how hidden writes can be redirected to a fake PFN while unauthorized reads return fake contents. This is a defensive answer to stealthy memory tampering rather than an injection method, but it underscores that covert state compromise is often data-centric rather than code-centric (Korkin, 2018).

"JIT Spraying and Mitigations" (Bania, 2010) studies a different kind of stealth memory injection: attacker-controlled bytes are emitted as native code by a legitimate JIT compiler into executable memory, bypassing DEP and weakening ASLR. Its payloads are concealed inside mov reg, IMM32 and repeated xor eax, IMM32 patterns, and the proposed defense scans newly executable JIT regions at the VirtualProtect transition. This work shows that legitimate code-generation pipelines can themselves become covert injection surfaces (Bania, 2010).

"SEVerity: Code Injection Attacks against Encrypted Virtual Machines" (Morbitzer et al., 2021) demonstrates that confidentiality without integrity is insufficient in confidential computing. By staging chosen bytes through I/O channels and abusing SLAT remapping, the attack injects and executes arbitrary code inside SEV-ES-protected VMs with 100% success rate. The paper’s broader lesson is that protected memory can still be subverted if the attacker controls the write pathway and the later mapping or execution pathway (Morbitzer et al., 2021).

"On the Stealth of Unbounded Attacks Under Non-Negative-Kernel Feedback" (Hassan et al., 27 Dec 2025) is a control-theoretic analogue. It defines an FDIA as $$\hat{y} = S\big(q, \mathcal{R}(q, \mathcal{M})\big),$$5-stealthy if

$$\hat{y} = S\big(q, \mathcal{R}(q, \mathcal{M})\big),$$6

and untraceably stealthy if this bounded detector-visible deviation additionally satisfies

$$\hat{y} = S\big(q, \mathcal{R}(q, \mathcal{M})\big),$$7

For LTV systems with a chain of $$\hat{y} = S\big(q, \mathcal{R}(q, \mathcal{M})\big),$$8 integrators, polynomial attacks of degree $$\hat{y} = S\big(q, \mathcal{R}(q, \mathcal{M})\big),$$9 are shown to remain $\mathcal{M}'$0-stealthy when $\mathcal{M}'$1 and untraceable when $\mathcal{M}'$2. Although this paper is not about software memory corruption, it formalizes a general stealth principle: harmful injected state can remain bounded or even asymptotically invisible in the monitored channel (Hassan et al., 27 Dec 2025).

Taken together, these cross-domain results suggest a broad systems interpretation of stealth memory injection. The common structure is not a specific data structure such as a vector store, but a sequence in which untrusted input is written into a stateful substrate, later reused as trusted internal evidence or executable basis, and rendered difficult to attribute because the initial write is hidden, plausible, or detector-bounded. In current LLM-agent research, that abstraction now includes persistent textual memory, selective summary memory, tool observation history, startup guidance, skill documentation, and persistent visual context (Piehl et al., 17 Feb 2026, Wang et al., 28 May 2026, Shen et al., 25 Mar 2026, Liu et al., 20 Mar 2026, Jia et al., 15 Feb 2026, Schlarmann et al., 17 Feb 2026, Zhang et al., 6 Jul 2026).