Search papers, labs, and topics across Lattice.
This paper introduces the Forged Amplifying Rationale Memory Attack (FARMA), which targets the reasoning history of LLM agents by inserting deceptive reasoning traces that evade traditional defenses. The authors demonstrate that FARMA can achieve a 100% attack success rate against various LLM models, highlighting the vulnerability of agents' memory systems to manipulation. To counteract this threat, they propose SENTINEL, a defense mechanism that effectively reduces FARMA's success rate to 0% without generating false positives across a large dataset of benign traces.
Forged reasoning attacks can completely compromise LLM agents' memory integrity, achieving up to 100% success against existing defenses.
Persistent memory has enabled large language model (LLM) agents to store factual knowledge, prior decisions, reasoning histories, tool usage information, and context. While this has improved the agent's functionality and continuity across tasks, it has also introduced a new attack surface: the agent's own reasoning history. In this paper, we introduce the Forged Amplifying Rationale Memory Attack (FARMA), which poisons an agent's remembered reasoning rather than its factual knowledge. It inserts forged reasoning traces using evasive language that bypasses keyword-based defenses, then amplifies them through self-referential reinforcement that defeats consensus-based defenses. To address FARMA, we introduce SENTINEL, a layered defense pipeline to detect forged reasoning entries. Its central component is the Reasoning Guard that structurally analyzes candidate entries for forgery using five weighted signals. We evaluate FARMA and SENTINEL across multiple agents and different LLM models with 50 trials and show that FARMA achieves an attack success rate of up to 100% under baseline conditions and is capable of defeating defense mechanisms like keyword filter and A-MemGuard. Our evaluation also shows that SENTINEL reduces FARMA's attack success rate to as low as 0% with no false positives observed across 326 benign agent traces. Our work demonstrates the need to protect not only an agent's retrieved content but also the integrity of its reasoning history.
