MAFIA：针对经审计的大语言模型智能体的、基于探测与事实注入的仅查询内存攻击
MAFIA: Query-Only Memory Attacks via Probing and Factual Injection against Audited LLM Agents
AI总结：
本研究针对经审计的LLM智能体，提出MAFIA攻击框架，通过放置策略与伪装有效载荷实现高攻击成功率，大幅降低审计检测率，揭示智能体内存系统的关键漏洞。
AI中文摘要：
内存增强型大语言模型（LLM）智能体依赖丰富上下文进行长程推理与行动，但其内存模块为恶意记录暴露了持续的攻击面，因此研究内存投毒威胁至关重要。然而，现有的仅查询攻击在两种现实且普遍的场景中往往失效：大规模良性内存池与主动输入审计。因此，现有方法在面临高检索竞争力与严格语义检查的双重挑战时表现不足。为克服这些局限，我们提出MAFIA——一种针对审计的、基于探测与事实注入的仅查询内存攻击框架，适配该扩展威胁模型。具体而言，MAFIA引入：（1）一种通过内存探测、预算分配与调度实现检索竞争力注入的放置策略；（2）一种利用紧凑事实伪装绕过审计的有效载荷设计，在保留恶意效果的同时维持高语义相似度。大量评估显示，MAFIA的攻击成功率最高达90.7%，同时将审计检测率从峰值83.3%抑制至最多7.4%，暴露了智能体内存系统的关键漏洞。代码将在该httpsURL公开。
英文摘要：
Memory-augmented LLM agents rely on rich context for long-horizon reasoning and acting, yet their memory modules expose a persistent attack surface for malicious records, making the study of memory poisoning threats imperative. However, existing query-only attacks often fail to remain effective in two realistic and prevalent settings: large-scale benign memory pools and active input auditing. Consequently, current approaches fall short when facing the dual challenges of high retrieval competitiveness and rigorous semantic checks. To overcome these limitations, we propose MAFIA, a query-only Memory Attack framework via probing and Factual Injection against Audit, tailored to this extended threat model. Specifically, MAFIA introduces: (1) a placement strategy that ensures retrieval-competitive injection via memory probing, budget allocation, and scheduling; and (2) a payload design that bypasses audits using compact factual cloaks, preserving malicious effects while maintaining high semantic similarity. Extensive evaluations reveal that MAFIA achieves up to a 90.7% attack success rate while suppressing audit detection from a peak of 83.3% to at most 7.4%, exposing critical vulnerabilities across agentic memory systems. Code will be made publicly available at https://github.com/JiamingChen1234/MAFIA.
