Do Agents Dream of False Memories? Black-box Visual Attacks on Long-term Memory in Multimodal AI Agents
TL;DR - Lucid is a black-box visual attack that uses imperceptible image perturbations to corrupt or inject long-term memories in multimodal AI agents. Its success across five memory architectures reveals a systemic risk in pipelines that implicitly trust visual inputs.
- Requires no access to the target model, retrieval encoder, or text channel.
- Memory poisoning exploits prior textual context to steer visual recall toward attacker-chosen narratives.
- Memory injection targets turns without textual grounding, leaving no corrective memory signal.
- Lucid achieved 61.6% attack success on poisoning and 58.4% on injection.