ShadowMerge: A Novel Poisoning Attack on Graph-Based Agent Memory via Relation-Channel Conflicts

2026-05-09

AI Summary

This work addresses a critical vulnerability in graph memory systems under a novel poisoning attack paradigm, where existing methods struggle to effectively inject and activate malicious relations. The study unveils, for the first time, a relation-channel conflict mechanism and proposes a stealthy poisoning attack that crafts malicious relations sharing anchor entities and relation channels with benign evidence yet exhibiting semantic conflicts. By leveraging the AIR pipeline, the approach translates such semantic conflicts into system-processable interaction forms, ensuring compatibility with mainstream graph memory architectures. Evaluated on Mem0 and three real-world datasets, the method achieves an average attack success rate of 93.8%, surpassing the best baseline by 50.3 percentage points while exerting negligible impact on unrelated tasks.

Abstract

Graph-based agent memory is increasingly used in LLM agents to support structured long-term recall and multi-hop reasoning, but it also creates a new poisoning surface: an attacker can inject a crafted relation into graph memory so that it is later retrieved and influences agent behavior. Existing agent-memory poisoning attacks mainly target flat textual records and are ineffective in graph-based memory because malicious relations often fail to be extracted, merged into the target anchor neighborhood, or retrieved for the victim query. We present SHADOWMERGE, a poisoning attack against graph-based agent memory that exploits relation-channel conflicts. Its key insight is that a poisoned relation can share the same query-activated anchor and canonicalized relation channel as benign evidence while carrying a conflicting value. To realize this, we design AIR, a pipeline that converts the conflict into an ordinary interaction that can be extracted, merged, and retrieved by the graph-memory system. We evaluate SHADOWMERGE on Mem0 and three public real-world datasets: PubMedQA, WebShop, and ToolEmu. SHADOWMERGE achieves 93.8% average attack success rate, improving the best baseline by 50.3 absolute points, while having negligible impact on unrelated benign tasks. Mechanism studies show that SHADOWMERGE overcomes the three key limitations of existing agent-memory poisoning attacks, and defense analysis shows that representative input-side defenses are insufficient to mitigate it. We have responsibly disclosed our findings to affected graph-memory vendors and open sourced SHADOWMERGE.

Problem

• graph-based agent memory
• poisoning attack
• relation-channel conflicts
• memory injection
• LLM agents

Innovation

• relation-channel conflict
• graph-based agent memory
• poisoning attack
• memory extraction and retrieval
• adversarial AI