LLM Agent Security | Memory-Augmented Agents

FragFuse

Bypassing Access Control of Large Language Model Agents via Memory-Based Query Fragmentation and Fusion

Authors: to be added

FragFuse exposes a temporal attack surface in memory-augmented LLM agents: policy-violating intent can be split across ordinary interactions, stored in long-term memory in benign-looking form, and later fused back during memory-augmented execution.

Code Extended Version Paper

Warning

FragFuse is a security research project intended to help developers identify and mitigate risks in memory-augmented LLM agents.

The techniques discussed on this page and in the paper should only be used for authorized research, evaluation, and defensive testing. Do not use FragFuse to bypass access controls, violate platform policies, access restricted resources, or cause real-world harm. Released artifacts are intended to support responsible security analysis and the design of stronger memory-aware defenses.

Abstract

Long-term memory helps LLM agents personalize, plan, and adapt across sessions, but it also creates a temporal channel that current query-level access control can miss.

FragFuse is a memory-based query fragmentation attack against access-controlled LLM agents. Instead of submitting a prohibited request directly, an ordinary user first decomposes access-control-triggering content into fragments, injects those fragments into long-term memory through benign-appearing carrier queries, and later issues an attack query that retrieves and fuses the stored fragments back into the original prohibited intent. The attack operates through normal user interactions under a black-box threat model: the attacker does not need privileged access to the agent workflow, memory bank, or internal access-control implementation.

The paper evaluates FragFuse across web shopping, web navigation, OS assistance, and tool-use agent settings, covering LLM-based access control and state-of-the-art agent guardrails. The results show that memory can undermine access control when enforcement only inspects the current query rather than the history-dependent execution context.

Why Memory Changes the Threat Model

Access-control modules often assume that prohibited intent appears explicitly in the current user query. Persistent memory breaks that assumption.

Access control is query-centric

Many guardrails inspect each incoming query independently and reject requests that violate task policies, user eligibility rules, or resource permissions.

Memory is persistent

Agents store previous query-execution pairs and retrieve similar records later, allowing earlier interactions to influence future execution.

Intent can be temporal

FragFuse separates sensitive content from its original context, stores it across time, and reconstructs it only after access control has allowed the later query.

Attack Pipeline

FragFuse turns one prohibited query into two ordinary interactions: one to write useful fragments into memory, and one to retrieve and fuse them.

Figure 1: Overview of FragFuse showing sensitive fragment discovery, carrier injection, memory retrieval, and fragment fusion.
Figure 1: Overview of FragFuse.

Memory as a temporal channel

FragFuse avoids placing the prohibited intent in a single query. It first isolates sensitive fragments, stores them through a benign-looking carrier interaction, and later relies on memory retrieval to bring those fragments back.

  • Stage 1 masks rejection-triggering fragments until the query passes access control.
  • Stage 2 writes marked fragments into long-term memory using a host query.
  • Stage 3 retrieves the carrier memory and fuses the fragments into the masked query.

Stage 1: Sensitive Fragment Discovery

An LLM-based fragment extractor proposes spans responsible for denial. The attacker masks candidate spans with markers and repeats until the masked query bypasses access control.

Stage 2: Carrier Construction & Injection

The extracted fragments are split, marked, and embedded into a benign host query. Once submitted, the resulting query-execution pair is stored as a memory record.

Stage 3: Retrieval & Fusion

The attack query reuses the host query to retrieve the carrier memory, then uses a fusion instruction to place the marked fragments back into the masked query.

FragFuse further improves reliability with offline surrogate optimization. A genetic search tunes fusion instructions using surrogate retrieval, fusion, and coherence objectives, while keeping attack generation within the black-box threat model.

Evaluation

The study evaluates FragFuse across four representative agent settings and multiple access-control mechanisms.

86.3% Average bypass success rate reported across all evaluated configurations.
4.4% Average task-success degradation compared with direct querying without access control.
4 Agent settings: RAP, SeeAct, OSAgent, and InspAgent.

Agent and Dataset Coverage

  • RAP on WebShop: purchase-oriented web shopping tasks with profile-based access control.
  • SeeAct on Mind2Web-SC: web navigation tasks with user eligibility constraints.
  • OSAgent on Safe-OS: system-assistance tasks involving high-risk OS operations.
  • InspAgent on AgentHarm: tool-use tasks with harmful and benign counterparts.

Access-Control Coverage

FragFuse is tested against LLM-based access control and existing agent guardrails, including GuardAgent, AGrail, and ShieldAgent. The evaluation measures bypass success rate, task success rate, and supplementary end-to-end success.

Effectiveness of FragFuse compared with the baseline attack across agent, access-control, and backbone LLM settings.

Main effectiveness results

Effectiveness of FragFuse compared with the baseline attack across agent, access control (AC), and backbone LLM settings. TSRs for direct querying in the absence of access control are reported for reference.

FragFuse achieves substantially higher BSR than the baseline attack, with only minor TSR degradation shown as subscripts relative to direct querying. For direct querying without access control, BSR is not applicable.

Figure 2: Retrieval success rate of FragFuse under different similarity metrics across RAP, SeeAct, OSAgent, and InspAgent.
Figure 2: Retrieval success across similarity metrics.

Retrieval is robust across memory metrics

The attack assumes similarity-based memory retrieval, but does not depend on knowing the exact retrieval metric used by the target agent.

  • RAP, SeeAct, and InspAgent retain perfect retrieval across the evaluated metrics.
  • OSAgent remains highly retrievable, with only small drops under BM25 and e5-base-v2.
  • The shared host-query design keeps the carrier memory close to the later attack query.

Defense Analysis

Existing defenses reduce some risks, but they do not fully address memory-mediated temporal composition.

Rate limiting

The attack is query efficient: sensitive-fragment discovery typically converges with a small number of queries, while fusion-instruction optimization is performed offline.

Prompt filtering

Prompt-injection detectors often classify carrier queries, and many attack queries, as benign because the sensitive intent is fragmented and context-dependent.

Perplexity detection

For several evaluated domains, benign, carrier, and attack-query perplexity distributions overlap substantially, limiting detection power.

Percentage of benign, carrier, and attack queries deemed benign under PromptArmor and PromptGuard.

Prompt-injection detector results

Percentage of benign, carrier, and attack queries deemed benign under two prompt-injection detectors.

Discussion

FragFuse points to a design gap: access control should reason over memory admission, retrieval, and execution-time composition, not only the latest query.

Limitations

The evaluation focuses on controlled research settings and representative domains. Generalization to other domains depends on available access-control policies, memory designs, and the instruction-following capability of the underlying agent model.

Ethical Use

The work is intended to reveal and measure a security risk so that memory-augmented agents can be hardened. Defensive directions include memory admission control, retrieval-aware access control, and post-retrieval inspection of fused execution context.

Resources

Project materials and release links.

Citation

Citation will be added after the final bibliographic entry is ready.

@misc{rao2026fragfusebypassingaccesscontrol, title={FragFuse: Bypassing Access Control of Large Language Model Agents via Memory-Based Query Fragmentation and Fusion}, author={Zixin Rao and Wentian Zhu and Chan Aristella Lu and Zhaorun Chen and Wei Niu and Le Guan and Bo Li and Zhen Xiang}, year={2026}, eprint={2606.15609}, archivePrefix={arXiv}, primaryClass={cs.CR}, url={https://arxiv.org/abs/2606.15609}, }