---
title: Stealth Memory Injection in LLM Agents
url: https://www.emergentmind.com/topics/stealth-memory-injection
type: topic
---

# Stealth Memory Injection in LLM Agents

Stealth memory injection denotes a family of attacks in which adversarial content is caused to enter a system’s persistent or recurrent state and is later reused as if it were trusted internal context. In contemporary work, the term is most directly instantiated in long-term memory-augmented large language model agents, where ordinary interaction, external content ingestion, or selective memory pipelines can write false facts, preferences, or procedural guidance into durable memory and later bias retrieval, reasoning, tool selection, or action execution [2602.15344], [2605.29960], [2607.05189]. Closely related literature studies adjacent channels—tool observations, bootstrap guidance, skill documentation, and persistent visual context—that function as short-term or quasi-persistent memory substrates even when no explicit vector store is present [2603.24203], [2603.19974], [2602.14211], [2602.15927].

## 1. Conceptual definition and threat model

In the current agent-security literature, stealth memory injection is characterized less by raw prompt override than by corruption of the memory lifecycle: writing, storing, retrieving, and reusing state across time. The most explicit formalization appears in "ER-MIA: Black-Box Adversarial Memory Injection Attacks on Long-Term Memory-Augmented Large Language Models" [2602.15344]. There, the clean memory bank is
\[
\mathcal{M} = \{ m_1, \dots, m_N \},
\]
and for a query \(q\), top-\(k\) memories are retrieved by cosine similarity under an encoder \(\phi\):
\[
\mathcal{R}(q, \mathcal{M}) = \operatorname{Top}\text{-}k_{m \in \mathcal{M} \;\cos\!\big(\phi(q), \phi(m)\big).
\]
The model response is then
\[
\hat{y} = S\big(q, \mathcal{R}(q, \mathcal{M})\big),
\]
while after injection of adversarial memories \(\mathcal{M}'\), the augmented bank yields
\[
\hat{y}' = S\big(q, \mathcal{R}(q, \tilde{\mathcal{M}})\big),
\]
subject to an imperceptibility condition requiring adversarial memories to remain embedding-close to clean memories:
\[
\forall m' \in \mathcal{M}',\; \exists m \in \mathcal{M}: \cos\!\big(\phi(m), \phi(m')\big) \ge \sigma_s.
\]
That paper decomposes the attack into **effectiveness**, **imperceptibility**, and **agnosticism**, making “imperceptibility” the closest explicit analogue of stealth [2602.15344].

A second explicit formulation appears in "When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents" [2607.05189]. There, the agent under configuration \(\omega\) maps persistent state \(s\), task \(t\), and external input \(x\) to visible output \(y\) and state modification \(\Delta s\):
\[
(y, \Delta s) = A(s, t, x; \omega).
\]
A successful attack must satisfy three conditions simultaneously: **injection**, **stealth**, and **effectiveness**. In the paper’s terms, the malicious content must be written into persistent state, remain hidden in the user-visible response during the injection phase, and later affect downstream behavior in a future session [2607.05189].

These formulations suggest a narrow and a broad sense of the term. In the narrow sense, stealth memory injection refers to persistent-memory compromise in memory-augmented agents. In the broader sense, it includes any attack that plants durable or repeatedly reused state—textual, visual, procedural, or tool-derived—while keeping the initial compromise non-diagnostic. This broader reading is consistent with papers that study selective memory rewriting, working-memory contamination, bootstrap guidance, and multimodal persistence, even when they do not always use the exact phrase “memory injection” [2605.29960], [2603.24203], [2603.19974], [2602.15927].

## 2. Principal mechanisms in long-term memory-augmented agents

The direct LLM-agent literature identifies several distinct but related attack mechanisms. They differ mainly in where the poison enters the system and what memory representation it exploits.

| Mechanism | Representative papers | Core feature |
|---|---|---|
| Similarity-retrieval poisoning | [2602.15344] | Embedding-close memories are later co-retrieved |
| Selective-memory poisoning | [2605.29960] | Trigger and payload survive extraction and rewriting |
| Tool-selection memory poisoning | [2605.26154] | Memory records bias tool choice without explicit commands |
| User-only induced memory writes | [2503.03704] | Ordinary queries cause the agent to create malicious records |
| External-content memory seeding | [2607.05189] | One email induces hidden persistent-state updates |

In ER-MIA, the central vulnerability is the similarity-based retrieval mechanism itself rather than model weights, training data, or explicit backdoors. The attacker has “no access to model parameters, retrieval outputs, memory contents, or memory system internals,” and only interacts through the same pathways that ordinary memories use. Two realistic attack settings are formalized. In **content-based attacks**, adversarial memories are minimally perturbed variants of existing clean memories. In **question-targeted attacks**, one or two fabricated memories are crafted to restate a target question and attach an incorrect answer. The attack arsenal includes instruction-style attacks, factual contradiction and negation, and even non-semantic probes such as Embedding-Close Noise and Lexical Shuffling, which the paper uses to argue that dense retrieval itself is the system-level vulnerability [2602.15344].

MemPoison addresses a different pipeline: selective long-term memory systems that first extract, then rewrite or summarize, and only then store memories. It introduces three components. The **semantic relational bridge** binds trigger and payload into a coherent, memory-worthy statement. **Entity masquerading** optimizes the trigger to resemble a named entity so that paraphrasers preserve it. **Joint embedding optimization** makes trigger-injected texts form a tight cluster while remaining isolated from benign embeddings. The corresponding objectives are an entity loss \(\mathcal{L}_{\text{ent}}\), a concentration loss \(\mathcal{L}_{\text{conc}}\), and an isolation loss \(\mathcal{L}_{\text{iso}}\), optimized with a HotFlip-style coordinate search in discrete trigger space [2605.29960].

MemMorph targets long-term memory used during tool selection rather than answer generation alone. Its system model includes a tool set \(\mathcal{T}\), a persistent memory store \(\mathcal{D}\), retrieval \(\mathcal{R}\), generation \(\mathcal{G}\), and a rewriting module \(\mathcal{W}\). The attacker can inject only a small poison set \(\mathcal{M}_p\), either directly into memory or indirectly via ordinary conversation. Each poison record is structured as a concatenation of **frame**, **anchor**, and **payload**, and is disguised as one of three long-term memory types: factual / semantic, episodic, or policy / procedural. The anchor mechanism is specifically chosen to survive rewriting by memory modules and to increase retention of the attack-bearing segment [2605.26154].

MINJA addresses the case in which the attacker has no direct access to the memory bank at all. The agent retrieves prior records as in-context demonstrations, and the attacker’s goal is to induce the agent itself to generate and store malicious records. The core construction is a memory record of the form
\[
(q_v, [b_{v,t}, R_{q_t}]),
\]
where \(q_v\) is a victim-style query, \(b_{v,t}\) is a sequence of bridging steps linking victim term \(v\) to target term \(t\), and \(R_{q_t}\) is the target reasoning sequence. An **indication prompt** first bootstraps the bridging sequence, and a **Progressive Shortening Strategy** then gradually removes explicit attack cues until the stored query resembles an ordinary benign query [2503.03704].

MemGhost operates under an even stronger constraint: a remote black-box adversary has only a single malicious email and no runtime feedback from the victim. It therefore trains an attacker policy offline against a shadow persistent-agent environment. The learned policy \(\pi_\theta(x \mid m)\) generates an email payload \(x\) conditioned on target memory \(m\), and optimization is driven by a trace reward
\[
R_{\mathrm{trace}(m,x)} = R_{\mathrm{inj}(m,x)} \cdot (R_{\mathrm{stl}(m,x)} + \lambda),
\]
which combines memory-adoption quality and visible-response stealth [2607.05189].

## 3. Beyond vector stores: adjacent persistent-context channels

Several papers broaden the attack surface beyond explicit long-term memory databases. They show that stealth memory injection is often better understood as a persistent-context problem rather than only a vector-store poisoning problem.

"Invisible Threats from Model Context Protocol: Generating Stealthy Injection Payload via Tree-based Adaptive Search" [2603.24203] studies malicious MCP tool responses. The paper is explicit that it is not literally about long-term memory poisoning, but it states that malicious content injected into \(r_{\text{tool}}\) is ingested directly into the working memory of the agent. The observation history update
\[
\mathcal{O}_{t} = \mathcal{O}_{<t} \cup \{ r_{\text{tool}} \}
\]
and the updated context
\[
\mathcal{C}_t = q \oplus \mathcal{T} \oplus \mathcal{O}_{<t} \oplus \mathcal{E}_K(q, \mathcal{T}, \mathcal{D})
\]
make the tool response part of effective working memory. TIP, the attack framework in that paper, optimizes natural JSON payloads under a stealth constraint based on perplexity, emphasizing semantic naturalness, schema-conforming placement, and defense-aware adaptation [2603.24203].

"Trojan's Whisper: Stealthy Manipulation of OpenClaw through Injected Bootstrapped Guidance" [2603.19974] analyzes another persistent-context substrate: bootstrap guidance files loaded through `agent:bootstrap` hooks. These files—such as `SOUL.md`, `GUIDE.md`, or `BEST_PRACTICES.md`—become part of the agent’s foundational reasoning context before user interaction. The malicious skill does not insert obvious commands; it injects adversarial operational narratives framed as routine best practices. The paper repeatedly describes this as manipulation of the agent’s interpretive priors and foundational framing, which is closely aligned with stealth memory injection in the broader sense [2603.19974].

"SkillJect: Automating Stealthy Skill-Based Prompt Injection for Coding Agents with Trace-Driven Closed-Loop Refinement" [2602.14211] focuses on skills represented as
\[
S=(d,\mathcal{A}),
\]
where \(d\) is `SKILL.md` and \(\mathcal{A}\) is a set of auxiliary artifacts. The poisoned skill decomposes into
\[
d'=Inject(d,\pi),\qquad \mathcal{A}'=HidePayload(\mathcal{A}),
\]
so that a lightweight inducement prompt in documentation triggers execution of a hidden operational payload in scripts or resources. The paper is framed as skill-based prompt injection rather than memory injection, but the mechanism is strongly analogous to persistent memory/context poisoning because the skill is stored, later selected by routing, loaded into context, and treated as a high-privilege capability extension [2602.14211].

"Visual Memory Injection Attacks for Multi-Turn Conversations" [2602.15927] extends the notion into the multimodal domain. There, the persistent substrate is not an external memory bank but the image itself, which remains in effective context across a long multi-turn conversation. The attack optimizes a perturbed image \(\tilde{x}\) so that it preserves benign behavior for an anchor prompt while later producing an attacker-prescribed response under a trigger topic:
\[
\max_{\tilde x} \; \log p(y_a \mid t_a, \tilde x) + \log p(y_t \mid c^{(k)} \oplus t_t, \tilde x)
\quad \text{s.t.} \quad \|\tilde x - x\|_\infty \le \varepsilon, \;\tilde x \in I.
\]
This attack shows that persistent multimodal conditioning alone can function as a covert memory channel, even without any external memory store [2602.15927].

## 4. Empirical characteristics of stealth, persistence, and transfer

The empirical literature shows that stealth memory injection is characterized by small attack footprints, high cross-model transfer, and persistence under large memory stores or long conversations.

ER-MIA reports strong degradation from injected memories alone, without deleting clean memories. On Llama3.2:3b, one injected memory per question causes \(-40.2\%\) on A-mem and \(-44.1\%\) on Mem0, while two memories per question worsen these to \(-46.8\%\) and \(-53.0\%\). In Mem0, adversarial retrieval frequency is extremely high: for contradiction attacks it is 99.80% at \(k=10\), 99.95% at \(k=20\), and 100% at \(k=30\); for targeted-question attack it is 98.59%, 99.80%, and 99.95%. The paper’s ensemble attacks are stronger still: on Mem0 with Llama3.2, clean overall F1 of 23.60 drops to 2.87 under “Ignore + General Negation,” a \(-87.6\%\) degradation [2602.15344].

MemPoison reports that under Mem0 on the Personal Agent, it achieves **ISR 0.98, RSR@1 0.98, ASR 0.95, ACC 0.96**. On the Medical Agent with Mem0, ASR reaches **0.94**; on the Financial Agent with Mem0, **0.91**. The paper also reports that as the number of benign memory records grows from 1,000 to 7,000, MemPoison keeps **RSR@1 above 0.95**, which is a direct indication that the adversarial cluster remains retrievable in crowded memory spaces [2605.29960].

MemMorph shows that only three poisoned records—one factual, one episodic, and one policy—can be enough for effective long-term compromise. Its headline result is **up to 85.9% ASR with only three injected records**, with an approximately **1.0% poison ratio** against an initial store of **300 benign records**. The same paper reports average AHR **92.3%**, and after one-time injection and growth of benign memory from 300 to 2,000 records, MemMorph still achieves **43.1% ASR**, exceeding the strongest baseline by **28.8%** [2605.26154].

MINJA reports average **ISR = 98.2%** and average **ASR = 76.8%** across healthcare, shopping, and QA agents. Its utility impact on benign tasks is small: the paper states that overall benign drop is less than 2% on average, with nearly all cases below 10%. That combination—high injection success, high downstream success, and limited benign degradation—is central to its claim of stealth [2503.03704].

MemGhost reports especially strong end-to-end results under the strict single-email, no-feedback threat model. On **56 held-out test cases**, it achieves **87.5% E2E** on OpenClaw with GPT-5.4 in background mode and **71.4% E2E** on Claude Code SDK with Sonnet 4.6 in background mode. The same paper shows strong transfer: OpenClaw with Mem0 reaches **85.7%** background E2E, NanoClaw **80.4%**, Hermes native **82.1%**, and Hermes with Mem0 **85.7%** [2607.05189].

The adjacent persistent-context literature reinforces the same picture. Guidance injection in OpenClaw attains attack success rates from **16.0% to 64.2%**, with the majority of malicious actions executed autonomously without user confirmation, and **94%** of malicious skills evade existing static and LLM-based scanners [2603.19974]. Visual Memory Injection remains effective after **over 25 unrelated turns** and with **conversations exceeding 10,000 tokens**, which demonstrates persistence even without an external memory module [2602.15927].

## 5. Defenses, failure modes, and unresolved tensions

The published defense literature is converging on the view that filtering surface anomalies alone is insufficient, because the most successful attacks are structurally plausible, semantically coherent, and often delivered through normal system pathways.

ER-MIA outlines several defense directions without implementing a final defense stack: **memory sanitization at write time**, **contradiction detection and conflict-aware updates**, **instruction filtering**, **more metadata and credibility signals**, **retrieval diversification or clustering**, **re-ranking using structure**, and **hardening update policies** before ADD/UPDATE/DELETE operations. The same paper argues that systems which automatically write memory from conversation content are vulnerable even when they expose no explicit save-memory API [2602.15344].

MemPoison directly evaluates two common defenses. Under perplexity filtering, at \( \mathrm{PPL} \le 75\), Naive Concat and AgentPoison are fully neutralized with **ASR 0.00**, while MemPoison still achieves **ASR 0.40**; at \( \mathrm{PPL} \le 150\), MemPoison reaches **ASR 0.87**. Under paraphrasing, its ASR remains **0.77–0.89**, while Naive Concat and AgentPoison are almost entirely broken. The paper’s interpretation is that semantic binding plus entity masquerading resist both anomaly filtering and rewriting [2605.29960].

MemMorph evaluates three memory-storage defenses calibrated to false-positive rate on benign records \(\le 5\%\): **Perplexity Filter**, **Distil Classifier**, and **LLM-based Memory Auditor**. Under these defenses, MemMorph still reports **ASR 65.8 / 69.8 / 54.9** and **AHR 82.1 / 84.5 / 72.3**, respectively. The Memory Auditor gives the strongest reduction, but the paper’s conclusion is that current memory-level defenses remain inadequate against semantically plausible, retrieval-optimized poisons [2605.26154].

MemGhost tests one defense at each of three levels. **DataSentinel** has **FNR 91.59%**. **Meta-SecAlign** reduces injection but still leaves **ISR 49.07%** with **SSR 98.15%**. **AgentDoG** yields **FNR 93.46%** on OpenClaw and **40.38%** on Claude Code SDK. An explicit user-visibility prompt—“tell me what you checked and what actions you took”—is one of the strongest countermeasures in foreground mode, dropping OpenClaw/GPT-5.4 E2E to **1.8%**, but it does not eliminate all success on all platforms [2607.05189].

The persistent-context literature reaches similar conclusions from a different direction. TIP argues that context-based prompt-structuring defenses do not separate data from control and that classification-based defenses such as perplexity filtering fail when payloads are semantically plausible [2603.24203]. Trojan’s Whisper argues for **capability isolation**, **runtime policy enforcement**, and **transparent guidance provenance**, because startup-time guidance is otherwise treated as authority-bearing context [2603.19974]. SkillJect likewise suggests **dynamic sandboxing** and **cross-modal consistency verification** between documentation and code, since semantic filtering of the visible documentation does not catch payloads hidden in auxiliary artifacts [2602.14211].

A recurring controversy concerns what exactly counts as stealth. The direct memory-attack papers often operationalize stealth through embedding-space closeness, natural fluency, non-diagnostic visible responses, or limited benign-utility degradation, rather than through formal detector-evasion objectives. This suggests that current literature treats stealth primarily as an operational property of memory adoption and later retrievability, not yet as a standardized metric.

## 6. Broader security lineage and cross-domain analogues

Outside LLM-agent research, older systems and security literature studies related phenomena under different substrates: dynamic kernel memory, executable JIT pages, encrypted virtual memory, and detector-visible control signals. These works are not about personal-agent memory stores, but they clarify the more general logic of hidden state compromise.

"Hypervisor-Based Active Data Protection for Integrity and Confidentiality of Dynamically Allocated Memory in Windows Kernel" [1805.11847] addresses unauthorized reads and writes to dynamically allocated kernel memory. AllMemPro enforces per-driver ownership over dynamic allocations using EPT, MTF, and fake-page redirection. The paper’s central claim is that unauthorized access to even “1 byte” of memory should be preventable, and it shows how hidden writes can be redirected to a fake PFN while unauthorized reads return fake contents. This is a defensive answer to stealthy memory tampering rather than an injection method, but it underscores that covert state compromise is often data-centric rather than code-centric [1805.11847].

"JIT Spraying and Mitigations" [1009.1038] studies a different kind of stealth memory injection: attacker-controlled bytes are emitted as native code by a legitimate JIT compiler into executable memory, bypassing DEP and weakening ASLR. Its payloads are concealed inside `mov reg, IMM32` and repeated `xor eax, IMM32` patterns, and the proposed defense scans newly executable JIT regions at the `VirtualProtect` transition. This work shows that legitimate code-generation pipelines can themselves become covert injection surfaces [1009.1038].

"SEVerity: Code Injection Attacks against Encrypted Virtual Machines" [2105.13824] demonstrates that confidentiality without integrity is insufficient in confidential computing. By staging chosen bytes through I/O channels and abusing SLAT remapping, the attack injects and executes arbitrary code inside SEV-ES-protected VMs with **100%** success rate. The paper’s broader lesson is that protected memory can still be subverted if the attacker controls the write pathway and the later mapping or execution pathway [2105.13824].

"On the Stealth of Unbounded Attacks Under Non-Negative-Kernel Feedback" [2512.22646] is a control-theoretic analogue. It defines an FDIA as \(\epsilon\)-stealthy if
\[
\sup_{t \ge 0} |u_q(t)| \le \epsilon,
\]
and untraceably stealthy if this bounded detector-visible deviation additionally satisfies
\[
\lim_{t\to\infty}|u_q(t)|=0.
\]
For LTV systems with a chain of \(q \ge 1\) integrators, polynomial attacks of degree \(a\) are shown to remain \(\epsilon\)-stealthy when \(a \le q\) and untraceable when \(a < q\). Although this paper is not about software memory corruption, it formalizes a general stealth principle: harmful injected state can remain bounded or even asymptotically invisible in the monitored channel [2512.22646].

Taken together, these cross-domain results suggest a broad systems interpretation of stealth memory injection. The common structure is not a specific data structure such as a vector store, but a sequence in which untrusted input is written into a stateful substrate, later reused as trusted internal evidence or executable basis, and rendered difficult to attribute because the initial write is hidden, plausible, or detector-bounded. In current LLM-agent research, that abstraction now includes persistent textual memory, selective summary memory, tool observation history, startup guidance, skill documentation, and persistent visual context [2602.15344], [2605.29960], [2603.24203], [2603.19974], [2602.14211], [2602.15927], [2607.05189].

Source: https://www.emergentmind.com/topics/stealth-memory-injection