<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="tan-zhang-2026-query">
    <titleInfo>
        <title>Query-Efficient Memory Injection Attacks on LLM Agents</title>
    </titleInfo>
    <name type="personal">
        <namePart type="given">Yicong</namePart>
        <namePart type="family">Tan</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Yang</namePart>
        <namePart type="family">Zhang</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <originInfo>
        <dateIssued>2026-10</dateIssued>
    </originInfo>
    <typeOfResource>text</typeOfResource>
    <relatedItem type="host">
        <titleInfo>
            <title>Findings of the Association for Computational Linguistics: EMNLP 2026</title>
        </titleInfo>
        <name type="personal">
            <namePart type="given">Hung-Yi</namePart>
            <namePart type="family">Lee</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Sunipa</namePart>
            <namePart type="family">Dev</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Jessy</namePart>
            <namePart type="family">Li</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Desmond</namePart>
            <namePart type="family">Elliott</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <originInfo>
            <publisher>Association for Computational Linguistics</publisher>
            <place>
                <placeTerm type="text">Budapest, Hungary</placeTerm>
            </place>
        </originInfo>
        <genre authority="marcgt">conference publication</genre>
        <identifier type="isbn">979-8-89176-462-0</identifier>
    </relatedItem>
    <abstract>LLM agents increasingly rely on persistent, shared memory, turning the memory module into a new attack surface through which attackers can inject malicious text via query-only interaction. Existing query-only attacks, however, remain expensive, requiring multiple bridging injected queries per target and leaving visible directive traces in stored records. We present AMIA (Agent Memory Injection Attack), which improves both query efficiency and stealth through three injection families along a stealth-to-effectiveness axis: prompt injection, semi-instruction that hides the misleading answer in a benign restate or discredit request, and no-instruction that delivers the false claim as the presupposition of a natural follow-up question. We progressively scale AMIA from QA agents on flat key-value memory, to multi-agent shared memory, and to three production-oriented memory architectures (Mem0, A-MEM, MemoryOS), and finally to three non-QA agent classes (clinical support, code summarization, web shopping), where AMIA exceeds prior query-only attacks on most settings while using a fraction of their inject query budget. We further evaluate defenses that mitigate all three attack families across settings. Our code is available at: https://github.com/TrustAIRLab/AMIA.</abstract>
    <identifier type="citekey">tan-zhang-2026-query</identifier>
    <identifier type="doi">10.18653/2026.findings-emnlp.1312</identifier>
    <location>
        <url>https://aclanthology.org/2026.findings-emnlp.1312/</url>
    </location>
    <part>
        <date>2026-10</date>
        <extent unit="page">
            <start>27766</start>
            <end>27797</end>
        </extent>
    </part>
</mods>
</modsCollection>

%0 Conference Proceedings
%T Query-Efficient Memory Injection Attacks on LLM Agents
%A Tan, Yicong
%A Zhang, Yang
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Findings of the Association for Computational Linguistics: EMNLP 2026
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-462-0
%F tan-zhang-2026-query
%X LLM agents increasingly rely on persistent, shared memory, turning the memory module into a new attack surface through which attackers can inject malicious text via query-only interaction. Existing query-only attacks, however, remain expensive, requiring multiple bridging injected queries per target and leaving visible directive traces in stored records. We present AMIA (Agent Memory Injection Attack), which improves both query efficiency and stealth through three injection families along a stealth-to-effectiveness axis: prompt injection, semi-instruction that hides the misleading answer in a benign restate or discredit request, and no-instruction that delivers the false claim as the presupposition of a natural follow-up question. We progressively scale AMIA from QA agents on flat key-value memory, to multi-agent shared memory, and to three production-oriented memory architectures (Mem0, A-MEM, MemoryOS), and finally to three non-QA agent classes (clinical support, code summarization, web shopping), where AMIA exceeds prior query-only attacks on most settings while using a fraction of their inject query budget. We further evaluate defenses that mitigate all three attack families across settings. Our code is available at: https://github.com/TrustAIRLab/AMIA.
%R 10.18653/2026.findings-emnlp.1312
%U https://aclanthology.org/2026.findings-emnlp.1312/
%U https://doi.org/10.18653/2026.findings-emnlp.1312
%P 27766-27797

Markdown (Informal)

[Query-Efficient Memory Injection Attacks on LLM Agents](https://aclanthology.org/2026.findings-emnlp.1312/) (Tan & Zhang, Findings 2026)

• Query-Efficient Memory Injection Attacks on LLM Agents (Tan & Zhang, Findings 2026)

ACL

• Yicong Tan and Yang Zhang. 2026. Query-Efficient Memory Injection Attacks on LLM Agents. In Findings of the Association for Computational Linguistics: EMNLP 2026, pages 27766–27797, Budapest, Hungary. Association for Computational Linguistics.