FragFuse: Bypassing LLM Agent Access Controls via Memory-Based Query Fragmentation and Fusion

Core question: for LLM agents equipped with long-term memory, whose access control only checks the current query, can an ordinary user bypass it through normal interaction to execute prohibited tasks.

• Scenario and importance: LLM agents are increasingly equipped with long-term memory to support complex tasks, personalization, and domain adaptation, while platforms deploy access control (such as GuardAgent, AGrail) to prevent misuse. The authors state that memory introduces a temporal channel, making the attack effect depend on historical interactions rather than the current query.
• Shortcomings of existing mechanisms: the authors state that existing access control mechanisms only check the current user query, implicitly assuming that prohibited intent will appear explicitly in the query and can therefore be detected by LLM-based or agent-based checkers.
• Core observation: prohibited content can be written into memory with a benign appearance in earlier interactions, then retrieved from memory and fused into a later attack query, so that prohibited content does not appear explicitly in the final query.
• Proposed in the paper: the authors propose FragFuse, claimed to be the first attack to exploit the temporal channel of long-term memory to bypass agent access control, comprising a three-stage pipeline and a scheme for offline optimization of the fusion instruction on a proxy model, and they evaluate defenses such as prompt injection detection and perplexity detection.
• Threat model:
  • Goals: (a) bypass access control without triggering rejection; (b) induce the agent to execute the task according to the original prohibited intent.
  • Knowledge: knows the public access control policy; does not know its internal implementation (prompts, model parameters, execution flow); knows that memory retrieval is generally based on query similarity but not the similarity metric, embedding model, or number of retrieved items.
  • Capabilities: ordinary user, no privileged access; cannot manipulate the agent code, execution environment, or memory store; can only interact normally; can observe whether a query is rejected (no execution trace when rejected).
  • Victim system: an interactive LLM agent equipped with a general long-term memory mechanism and protected by an independently deployed access control module; the memory store need not be shared across users.

Agent access control

• GuardAgent (Xiang et al., 2025) — an agent guardrail based on knowledge reasoning, e.g., blocking requests from minors to buy alcohol according to user profiles; this paper treats it as one of the access controls bypassed on RAP.
• AGrail (Luo et al., 2025) — a lifelong agent guardrail that can block high-risk system operations; this paper treats it as an access control bypassed on SeeAct and OSAgent.
• ShieldAgent (Chen et al., 2025) — protects agents through verifiable security policy reasoning, including post-hoc action checks; this paper treats it as an access control bypassed on InspAgent.

Memory mechanisms of LLM agents

• The authors formalize memory as an indexed set of query-execution pairs, with three operations: retrieval, memory-augmented execution, and writing; RAP (Kagaya et al., 2024), EHRAgent (Shi et al., 2024), SeeAct (Zheng et al., 2024), etc. adopt this general structure.
• More complex memory designs (e.g., A-Mem, Mem0) consider dependencies between records during retrieval; the authors choose the general memory setting to ensure cross-architecture generalization, and evaluate advanced memory mechanisms in the ablation.

Memory-based attacks

• AgentPoison (Chen et al., 2024) — an explicitly triggered backdoor attack that injects optimized malicious records into the memory bank.
• MINJA (Dong et al., 2025) — an implicitly triggered backdoor attack in which an ordinary user poisons memory through normal interaction, changing the execution of the victim user's future queries.
• MEXTRA (Wang et al., 2025) — leaks memory records through agent outputs, exposing privacy risks.
• The paper points out that these attacks assume the memory bank can be directly accessed by the attacker or is globally shared, and their goal is to manipulate future queries or leak memory; this paper's goal is to bypass access control and preserve the original prohibited intent, and does not rely on these two assumptions.

Baselines and benchmarks: Because AgentPoison and MINJA have different goals, the authors build their own baseline — directly injecting bypass instructions into prohibited queries (Appendix G). The evaluation benchmarks are WebShop, Mind2Web-SC, Safe-OS, and AgentHarm; Appendix A also compares with the prompt obfuscation methods CRP and ArtPrompt on RAP (Table 8).

The authors position this paper as: the first such attack (as claimed by the authors) targeting the different goal of access control bypass under weaker assumptions (no memory bank access, no cross-user sharing).

Overall idea: instead of directly issuing the prohibited query q, exploit the temporal channel of memory through two normal interactions — first write the sensitive content that triggers access control into memory with a benign appearance, then send another query to retrieve that record and fuse it at execution time to restore the prohibited intent. The three-stage pipeline of FragFuse is shown in Figure 1.

Stage 1: Sensitive fragment discovery

• Use the LLM-based FragExtractor for iterative extraction: each round takes the current query and public policy rules as input, outputs one candidate sensitive fragment, replaces it in place with a predefined marker (by default a pair of angle brackets), and generates a masked query.
• Submit the masked query to the access-control-protected agent and observe the accept/reject signal; if still rejected, continue iterating until accepted or the maximum number of iterations is reached (set to 3 in the main experiments; the authors state that masking beyond three rounds distorts the query semantics).
• Output the set of sensitive fragments and the final masked query qmask; the full prompt of FragExtractor is in Appendix N.

Stage 2: Carrier construction and injection

• The main body of the carrier query qcar is a preselected benign host query qhost known to pass access control, so that the subsequent attack query can retrieve this record by similarity.
• Sensitive fragments are split at the word level and enclosed with the same markers, then appended after qhost, i.e., q_car = [q_host, v₁: f₁, …, v_ℓ: f_ℓ]; word-level splitting is used because some fragments still trigger rejection when appearing alone.
• qcar is submitted through normal interaction; after bypassing access control, the agent autonomously generates and stores it as a memory record.

Stage 3: Fragment retrieval and fusion

• The attack query consists of three parts: the same host query qhost as the carrier (to ensure a similarity-based retrieval hit), the fusion instruction Ifuse, and the masked query qmask, i.e., q_att = {q_host, I_fuse, q_mask}.
• Ifuse instructs the agent to extract the marker-enclosed fragments from the retrieved memory record and substitute them back into qmask one by one; the simplest form can be written manually, and the paper further optimizes it.

Proxy optimization of the fusion instruction

• Since the attacker cannot access the agent's internals, the authors construct a proxy query fusion task on a proxy LLM: a template containing qcar, qatt, and a description of the agent's functionality is input, and fusion success is measured by the semantic similarity between the generated fused query and the original prohibited query q.
• The optimization objective is to minimize the sum of the retrieval loss and the fusion loss, subject to the coherence loss not exceeding a threshold ηcoh (taken as the 75th percentile of the benign query loss distribution), to ensure the attack query remains fluent against perplexity defenses; the three losses respectively measure the semantic distance between qatt and qhost, the semantic alignment between the proxy model's fused output and q, and the perplexity of qatt.
• Solved with a genetic algorithm: seeds are 3 manually designed instructions per domain, expanded to 10 via GPT-4o rewriting; candidates are generated through rewriting, crossover, and mutation; population size 20, 5 elites, at most 10 generations; the proxy model is GPT-4o, similarity uses all-MiniLM-L6-v2 embedding cosine, and perplexity is computed with GPT-2; the optimization dataset Q contains 50 queries (25 benign, 25 prohibited), masking uses NER segmentation plus randomly selecting 2–3 fragments, all offline without touching the target agent.
• Section 5.4 further jointly and alternately optimizes the markers v and Ifuse.

Success criteria

• BSR: the proportion of instances where both the carrier query and the attack query pass access control; TSR: the proportion of instances where the task is successfully executed among instances that bypass successfully; E2E-SR: the proportion of instances that both bypass and complete the task among all attack instances.

Experimental Setup

• Agents and benchmarks tested: RAP/WebShop (200 tasks sampled, 100 benign and 100 prohibited), SeeAct/Mind2Web-SC (200 instructions, 100 benign and 100 harmful), OSAgent/Safe-OS (100 instructions, excluding the prompt injection subset, benign expanded to 100), InspAgent/AgentHarm (public test set 176 benign/176 harmful).
• Backbone models: GPT-4o, GPT-5.1, Gemini 2.5 Flash; access control and the agent use the same backbone.
• Access control: two per setting—LLM-AC (an LLM checker based on public policy rules) and existing mechanisms: GuardAgent (RAP), AGrail (SeeAct, OSAgent), ShieldAgent (InspAgent).
• Memory setup: initial memory of 8 benign records; top-1 retrieval; RAP/SeeAct/OSAgent use all-MiniLM-L6-v2 embedding cosine similarity, InspAgent uses string matching; memory format is query-execution pairs.
• Metrics and evaluation: BSR, TSR, E2E-SR (definitions in Question 3); TSR uses GPT-4o as LLM judge, and the authors validated with human evaluation on a randomly sampled subset (Table 9: RAP 92.5/92.5, SeeAct 22.1/22.1, OSAgent 75.5/77.3, InspAgent 32.0/34.5, LLM judge/human).
• Baseline: directly injecting bypass instructions into prohibited queries (Appendix G); one attack instance per prohibited task in the dataset for each agent × access control combination.

Main Results

According to Table 1 (BSR/TSR, %), average BSR of FragFuse and the baseline across three backbone models:

Swipe horizontally to read the table

Agent	Access control	Baseline BSR	FragFuse BSR	FragFuse TSR	Direct query without AC TSR
RAP	LLM-AC	30.3	93.7	77.6	83.7
RAP	GuardAgent	35.3	79.3	82.2	83.7
SeeAct	LLM-AC	3.0	93.0	19.4	18.0
SeeAct	AGrail	9.0	82.3	20.1	18.0
OSAgent	LLM-AC	3.3	80.7	81.4	82.0
OSAgent	AGrail	19.3	92.7	77.6	82.0
InspAgent	LLM-AC	8.1	80.5	10.9	25.0
InspAgent	ShieldAgent	18.7	88.3	13.1	25.0

• The authors state that FragFuse achieves an average BSR of 86.3% across all configurations, consistently outperforming the baseline; average E2E-SR is 41.1%, baseline 5.7% (Appendix Q, Table 18).
• The authors state that average TSR is only 4.4% lower than direct queries without access control; the absolute TSR on SeeAct is low, which the authors consider reflects the influence of task execution capability in that domain rather than bypass failure.
• Exception: under InspAgent+LLM-AC+GPT-5.1, baseline TSR (32.4) is higher than FragFuse (7.6), which the authors explain as high variance due to the very small number of instances where the baseline bypass succeeded.

Query Efficiency and Retrieval Robustness

• What was measured: average number of queries needed to discover sensitive fragments (Table 2); retrieval success rate of carrier queries under different initial memory sizes (8/16/32) and different retrieval metrics (Table 3, Figure 2, Table 14).
• Results: the highest average number of queries in the discovery stage is 2.37 (InspAgent, LLM-AC) and 2.12 (SeeAct, existing access control); with initial memory of 8/16/32 records, retrieval success rate is 100.0% for all four agents (Table 3). In Figure 2, SeeAct, RAP, and InspAgent are all 100% under BM25, Jaccard, and e5-base-v2 cosine, while OSAgent is 94% under BM25 and 92% under e5-base-v2.
• Authors' interpretation: the attack does not depend on high-frequency interaction and is robust to changes in similarity-based retrieval mechanisms; with larger memory, more carrier queries can be injected to compensate.

Memory Mechanism, Marking, and Design Ablations

• Number of retrieved items and advanced memory (Table 4, RAP, GPT-4o): with top-3 retrieval, BSR is unchanged (93.0), and TSR drops from 92.5 to 72.0 (LLM-AC); quality-weighted retrieval lowers TSR from 92.5 to 73.1, and the authors state that quality-aware retrieval reduces the priority of injected records during retrieval.
• Marking choice (Table 5, GPT-4o): the default angle brackets give BSR/TSR of 93.0/92.5 on RAP, while "$" drops to 65.0/78.5; on SeeAct and OSAgent, alternative markers still maintain non-trivial BSR.
• Design ablations (Table 6, GPT-4o): replacing FragExtractor with a length heuristic drops BSR from 93.0 to 59.0 (RAP), 88.0 to 24.0 (SeeAct), and 82.0 to 3.0 (OSAgent); a manual Ifuse without proxy optimization has little effect on BSR, but TSR drops from 92.5 to 78.3 (RAP) and 80.5 to 74.4 (OSAgent).

Defense Evaluation

• Prompt injection detection (Table 7): the benign classification rate of PromptArmor and PromptGuard on carrier queries is mostly 96.0–100.0; it is lowest on InspAgent, where PromptArmor's benign classification rate on attack queries is 44.1% and PromptGuard's is 22.7%; the authors state that PromptArmor itself misclassifies a considerable proportion of genuinely benign AgentHarm queries, so it is insufficient as a standalone defense.
• Perplexity detection (Figure 3, computed with GPT-2): on RAP, SeeAct, and OSAgent, the perplexity distributions of benign, carrier, and attack queries overlap extensively; on InspAgent the overlap is smaller, which the authors attribute to the higher heterogeneity and complexity of that dataset, and they consider that such anomalies may be mitigated in practical task domains.
• Rate limiting and post-hoc checks: the authors state that the number of attack queries is small and optimization is done offline, so it is insensitive to rate limiting; post-hoc action checks may intercept executions that have already been bypassed, but the authors consider them costly and task-specific, and question their reasonableness as a primary security mechanism.

Other Ablations and Analyses

• Advanced memory write threshold 0.0→1.0: TSR drops from 92.5 to 39.8 (LLM-AC), BSR unchanged (Table 10, RAP).
• Reward-weighted retrieval weight 0.0→1.0: TSR drops from 92.5 to 53.8 (LLM-AC), BSR unchanged (Table 11, RAP).
• Joint marker-instruction optimization: proxy score rises from about 0.84 to 0.90 (angle bracket initialization) and from about 0.80 to 0.92 ("$" initialization) (Section 5.4, Figure 4).
• Appendix A: on RAP, FragFuse's average bypass rate is 93.7 (LLM-AC)/79.3 (GuardAgent), higher than CRP (25.0/17.7) and ArtPrompt (49.0/67.2) (Table 8).
• Failure cases (Appendix L): on OSAgent, LLM-AC falsely rejects benign carrier components (such as the /user_ok directory), causing failure; after more than three iterations, queries with incomplete semantics are also rejected (Appendix M).

Limitations and future directions noted by the authors

• Task-domain limitations (Section 7): the authors state that FragFuse is not guaranteed to generalize to domains outside the evaluation (e.g., healthcare, scientific discovery), and the main challenge is that these domains lack well-defined access control mechanisms or deployable policies.
• Dependence on model capability (Section 7): the authors state that successful fusion may require the agent's core LLM to be capable enough to correctly understand and execute fusion instructions; this limitation did not appear in the evaluation but may arise when the backbone model's reasoning or instruction-following capability is insufficient.
• Post-hoc defenses (Section 7): the authors state that FragFuse may fail against post-hoc defenses, although these are costly and have limited generalization.
• Failure cases (Section 7): the authors state that FragFuse does not achieve a perfect BSR, and TSR still declines compared with the no-access-control setting; Appendix L provides failure case analysis.
• Joint optimization of markers (Section 5.3): the authors state they will explore joint optimization of markers and fusion instructions as future work to further improve attack effectiveness (Section 5.4 already gives a preliminary implementation).

Scope of experimental coverage

• Agent settings tested are four: RAP/WebShop, SeeAct/Mind2Web-SC, OSAgent/Safe-OS, InspAgent/AgentHarm; backbone models are three: GPT-4o, GPT-5.1, Gemini 2.5 Flash.
• Access controls bypassed are LLM-AC, GuardAgent, AGrail, ShieldAgent; defense evaluation includes PromptArmor, PromptGuard, and perplexity detection, with rate limiting and post-hoc checks discussed qualitatively.
• Main experiments use a memory setting of 8 initial records and top-1 retrieval; ablations cover 8/16/32 initial memory records, top-2/top-3 retrieval, four retrieval metrics, and advanced memory formatting/writing/retrieval (the latter three only on RAP).
• Sensitive-segment discovery uses a maximum of 3 iterations; proxy optimization uses GPT-4o as the proxy model, 50 queries, and at most 10 generations; the paper does not report the number of repeated attack runs.
• TSR uses GPT-4o as the LLM judge, and the authors compare it with human evaluation on a randomly sampled subset (Table 9); the paper does not state the sample size of this subset.

An attack paper targeting LLM agent access control; the authors claim it is the first work to exploit the temporal channel of long-term memory to bypass access control.

• Problem: existing agent access control only checks the current query; the authors argue that long-term memory lets an attacker write prohibited content into memory with a benign appearance and retrieve and fuse it later, so that the effective attack depends on historical interactions.
• Method: FragFuse has three stages—black-box iterative queries discover sensitive fragments that trigger rejection and mask them; the fragments are split at the word level, wrapped with markers, and embedded into benign host queries to inject into memory; the attack query carries the same host query, the masked query, and a fusion instruction, and after retrieval from memory restores the prohibited intent. The fusion instruction is optimized offline with a genetic algorithm on a proxy model (GPT-4o), constraining the perplexity of the attack query.
• Threat model: ordinary user, no privileges, no access to the memory store or agent internals, knows only the public policy, purely normal interaction.
• Results: on the four settings RAP, SeeAct, OSAgent, and InspAgent, four access controls LLM-AC, GuardAgent, AGrail, and ShieldAgent, and three backbone models, average BSR is 86.3% and E2E-SR is 41.1% (baseline 5.7%), with average TSR only 4.4% lower than direct queries without access control (Table 1).
• Efficiency and robustness: sensitive fragment discovery takes at most 2.37 queries on average (Table 2); with initial memory of 8–32 records and four retrieval metrics, carrier retrieval success rate is mostly 100% (Table 3, Figure 2).
• Defenses: the benign classification rate of PromptArmor and PromptGuard on carrier queries is mostly above 96%; perplexity distributions overlap extensively with benign queries in three settings (Figure 3); the authors state that rate limiting and post-hoc checks are difficult to use as primary defenses.
• Authors' conclusion: access control that only looks at the current query and does not consider temporal combinations in memory has fundamental limitations; the authors state that dedicated defenses for this attack surface and more robust memory mechanisms are needed, and have disclosed to the maintainers of the four affected agent settings and three access control mechanisms.