Elamur Research⌕
☰
home / papers / 2026 / Visual Inception: Compromising Long-term Planning in Agentic Recommenders via Multimodal Memory Poisoning

Visual Inception: Compromising Long-term Planning in Agentic Recommenders via Multimodal Memory Poisoning

Paper · 2026 · Jiachen Qian

Summary

The paper studies a security weakness in agentic recommender systems, where AI agents keep long-term memories of users and plan tasks from them. The author describes an attack called "Visual Inception." An attacker makes small, nearly invisible changes to an image the user uploads, such as a lifestyle photo. The image sits unused in the RAG memory bank. Later, when a related query retrieves it, it pushes the agent's planning toward a goal the attacker chose, for example promoting high-margin products. No text prompt injection is needed.

The attack balances three objectives: being retrieved by likely future queries, matching a target concept, and staying visually unchanged. It is tuned against an ensemble of public encoders so it works on unseen models.

The proposed defense, COGNITIVEGUARD, has two stages. System 1 cleans images with diffusion when they are uploaded. System 2 checks plans at query time by removing each retrieved memory and seeing whether the output changes.

In a simulated e-commerce benchmark, the attack reaches about 85% Goal-Hit Rate, and the defense cuts this to about 10%. This points to memory integrity as an emerging risk for autonomous agents.

Key points

  • Evaluation uses the simulated ShopBench-Agent benchmark with three metrics: Goal-Hit Rate (GHR), the stricter attribution-aware Memory-mediated Attack Success Rate (ASR-M), and Reasoning Consistency Score.
  • The surrogate ensemble is CLIP-ViT-L/14, SigLIP-SO400M and OpenCLIP-ViT-G. Under Protocol P1, ASR-M is 81.2% on the surrogate encoders and 68.8% on unseen encoder pairs. DINOv2 shows a gap of about 30%.
  • COGNITIVEGUARD lowers GHR from about 85% to about 10% and ASR-M from about 82% to about 8%, with no reported loss in recommendation quality.
  • Query-time overhead is about 1.5 s in lite mode and about 6.5 s with full sequential System 2 verification. One-time upload-time purification is counted separately.
  • Reported limitations:
    • When only 30% of real queries overlap with the sampled ones, the attack still reaches 61.2% ASR-M.
    • Adaptive white-box attacks keep 24.7% residual ASR-M against the defense.
    • Only the visual modality is tested.
    • The two baselines, TrustRAG-Hybrid and Provenance-Track, are adapted from text-only methods.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Fields, topics and concepts

📚 Shelves 3The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksInformation Systems · 1,437 works

🧭 Topics 1Research subjects and languages the work is about.Vision & language · 657 works

Cite

Cite as Jiachen Qian. 2026. Visual Inception: Compromising Long-term Planning in Agentic Recommenders via Multimodal Memory Poisoning. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.acl-long.954

@inproceedings{qian2026visual,
  title = {{Visual Inception: Compromising Long-term Planning in Agentic Recommenders via Multimodal Memory Poisoning}},
  author = {Jiachen Qian},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.954},
  url = {https://doi.org/10.18653/v1/2026.acl-long.954}
}

References

59 references, 9 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Orlando Ayala and Patrice Bechard. 2024. Reducing hallucination in structured outputs via retrieval-augmented generation. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 6: Industry Track), page… find
  2. Yoshua Bengio. 2019. From system 1 deep learning to system 2 deep learning. Invited talk at NeurIPS 2019. NeurIPS invited talk page and SlidesLive recording; Accessed: 2026-04-12. find
  3. Wieland Brendel, Jonas Rauber, and Matthias Bethge. 2018. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. In International Conference on Learning Representations. ICLR OpenReview record: https://openreview.net/forum?id=SyZI0GWCZ. ↗
  4. Harsh Chaudhari, Giorgio Severi, John Abascal, Anshuman Suri, Matthew Jagielski, Christopher A. Choquette-Choo, Milad Nasr, Cristina Nita-Rotaru, and Alina Oprea. 2024. Phantom: General backdoor attacks on retrieval augmented language generation. CoRR, abs/2405.20485. ArXiv preprint; Accessed: 2026-… find
  5. Yulin Chen, Haoran Li, Zihao Zheng, Dekai Wu, Yangqiu Song, and Bryan Hooi. 2025. Defense against prompt injection attack by leveraging attack techniques. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 18331–18347, Vienna, Au…
  6. Zhaorun Chen, Zhen Xiang, Chaowei Xiao, Dawn Song, and Bo Li. 2024. AgentPoison: Red-teaming LLM agents via poisoning memory or knowledge bases. In Advances in Neural Information Processing Systems, volume 37. NeurIPS proceedings page; Accessed: 2026-04-12. find
  7. Francesco Croce, Sven Gowal, Thomas Brunner, Evan Shelhamer, Matthias Hein, and Taylan Cemgil. 2022. Evaluating the adversarial robustness of adaptive test-time defenses. In International Conference on Machine Learning, pages 4421–4435. PMLR. ICML proceedings page; Accessed: 2026-04-12. find
  8. Shen Dong, Shaochen Xu, Pengfei He, Yige Li, Jiliang Tang, Tianming Liu, Hui Liu, and Zhen Xiang. 2025. Memory injection attacks on llm agents via query-only interaction. arXiv preprint arXiv:2503.03704. ArXiv preprint; Accessed: 2026-04-12. — [arXiv:2503.03704](https://arxiv.org/abs/2503.03704) find
  9. Zhihao Dou, Xin Hu, Haibo Yang, Zhuqing Liu, and Minghong Fang. 2024. Adversarial attacks to multimodal models. arXiv preprint arXiv:2409.06793. Introduces CrossFire attack. — [arXiv:2409.06793](https://arxiv.org/abs/2409.06793) find
  10. Yixing Fan, Qiang Yan, Wenshan Wang, Jiafeng Guo, Ruqing Zhang, and Xueqi Cheng. 2025. Trustrag: An information assistant with retrieval augmented generation. arXiv preprint arXiv:2502.13719. ArXiv preprint; Accessed: 2026-04-12. — [arXiv:2502.13719](https://arxiv.org/abs/2502.13719) find
  11. Samar Fares, Klea Ziu, Toluwani Aremu, Nikita Durasov, Martin Takac, Pascal Fua, Karthik Nandakumar, and Ivan Laptev. 2024. Mirrorcheck: Efficient adversarial defense for vision-language models. arXiv preprint arXiv:2406.09250. ArXiv preprint; Accessed: 2026-04-12. — [arXiv:2406.09250](https://arxiv.org/abs/2406.09250) find
  12. Robert Friel, Masha Belyi, and Atindriyo Sanyal. 2024. RAGBench: Explainable benchmark for retrieval-augmented generation systems. arXiv preprint arXiv:2407.11005. ArXiv preprint; Accessed: 2026-04-12. — [arXiv:2407.11005](https://arxiv.org/abs/2407.11005) find
  13. Tianyu Gao, Xingcheng Yao, and Danqi Chen. 2021. SimCSE: Simple contrastive learning of sentence embeddings. Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 6894–6910. ACL Anthology entry; Accessed: 2026-04-12.
  14. Yansong Gao, Change Xu, Derui Wang, Shiping Chen, Damith C Ranasinghe, and Surya Nepal. 2019. STRIP: A defence against trojan attacks on deep neural networks. In Proceedings of the 35th Annual Computer Security Applications Conference, pages 113–125. ACM Digital Library landing page; Accessed: 2026-… find
  15. Yair Ori Gat, Nitay Calderon, Amir Feder, Alexander Chapanin, Amit Sharma, and Roi Reichart. 2024. Faithful explanations of black-box NLP models using LLM-generated counterfactuals. In The Twelfth International Conference on Learning Representations. ICLR OpenReview record: https://openreview.net/fo… ↗
  16. Gaël Gendron, Joze M. Rozanec, Michael Witbrock, and Gillian Dobbie. 2024. Counterfactual causal inference in natural language with large language models. CoRR, abs/2410.06392. ArXiv preprint; Accessed: 2026-04-12. — [arXiv:2410.06392](https://arxiv.org/abs/2410.06392) find
  17. Soumya Suvra Ghosal, Souradip Chakraborty, Vaibhav Singh, Tianrui Guan, Mengdi Wang, Alvaro Velasquez, Ahmad Beirami, Furong Huang, Dinesh Manocha, and Amrit Singh Bedi. 2024. Immune: Improving safety against jailbreaks in multi-modal llms via inference-time alignment. arXiv preprint arXiv:2411.1868… — [arXiv:2411.18688](https://arxiv.org/abs/2411.18688) find
  18. Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572. ArXiv preprint; Accessed: 2026-04-12.
  19. Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, Amy Yang, Angela Fan, Anirudh Goyal, Anthony Hartshorn, Aobo Yang, Archi Mitra, Archie Sravankumar, Artem Korenev, Arthur Hinsvark, and 542 o… — The Llama 3 Herd of Models
  20. Hyeonjeong Ha, Qiusi Zhan, Jeonghwan Kim, Dimitrios Bralios, Saikrishna Sanniboina, Nanyun Peng, Kai-Wei Chang, Daniel Kang, and Heng Ji. 2025. Mm-poisonrag: Disrupting multimodal rag with local and global poisoning attacks. arXiv preprint arXiv:2502.17832. ArXiv preprint; Accessed: 2026-04-12. — [arXiv:2502.17832](https://arxiv.org/abs/2502.17832) find
  21. Md Zarif Hossain and Ahmed Imteaj. 2024a. Securing vision-language models with a robust encoder against jailbreak and adversarial attacks. arXiv preprint arXiv:2409.07353. ArXiv preprint; Accessed: 2026-04-12. — [arXiv:2409.07353](https://arxiv.org/abs/2409.07353) find
  22. Md Zarif Hossain and Ahmed Imteaj. 2024b. Sim-CLIP: Unsupervised siamese adversarial fine-tuning for robust and semantically-rich vision-language models. arXiv preprint arXiv:2407.14971. ArXiv preprint; Accessed: 2026-04-12. — [arXiv:2407.14971](https://arxiv.org/abs/2407.14971) find
  23. Kuo-Han Hung, Ching-Yun Ko, Ambrish Rawat, I-Hsin Chung, Winston H. Hsu, and Pin-Yu Chen. 2025. Attention tracker: Detecting prompt injection attacks in LLMs. In Findings of the Association for Computational Linguistics: NAACL 2025, pages 2309–2322, Albuquerque, New Mexico. ACL Anthology entry; Acce… find
  24. Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. 2018. Black-box adversarial attacks with limited queries and information. arXiv preprint arXiv:1804.08598. ArXiv preprint; Accessed: 2026-04-12. — [arXiv:1804.08598](https://arxiv.org/abs/1804.08598) find
  25. Jeff Johnson, Matthijs Douze, and Hervé Jégou. 2021. Billion-scale similarity search with GPUs. IEEE Transactions on Big Data, 7(3):535–547. IEEE Xplore landing page; Accessed: 2026-04-12. find
  26. Daniel Kahneman. 2011. Thinking, Fast and Slow. Farrar, Straus and Giroux. Publisher book page; Accessed: 2026-04-12. find
  27. Andre Kassis, Urs Hengartner, and Yaoliang Yu. 2024. Diffbreak: Is diffusion-based purification robust? arXiv preprint arXiv:2411.16598. ArXiv preprint; Accessed: 2026-04-12. — [arXiv:2411.16598](https://arxiv.org/abs/2411.16598) find
  28. Emre Kiciman, Robert Ness, Amit Sharma, and Chenhao Tan. 2024. Causal reasoning and large language models: Opening a new frontier for causality. Transactions on Machine Learning Research. TMLR OpenReview record: https://openreview.net/forum?id=mqoxLkX210. ↗
  29. Xi Li, Ruofan Mao, Yusen Zhang, Renze Lou, Chen Wu, and Jiaqi Wang. 2025. Chain-of-scrutiny: Detecting backdoor attacks for large language models. In Findings of the Association for Computational Linguistics: ACL 2025, pages 7705–7727, Vienna, Austria. ACL Anthology entry; Accessed: 2026-04-12. find
  30. Xiao Li, Wenxuan Sun, Huanran Chen, Qiongxiu Li, Yining Liu, Yingzhe He, Jie Shi, and Xiaolin Hu. 2024. ADBM: Adversarial diffusion bridge model for reliable adversarial purification. arXiv preprint arXiv:2408.00315. ArXiv preprint; Accessed: 2026-04-12. — [arXiv:2408.00315](https://arxiv.org/abs/2408.00315) find
  31. Jianxun Lian, Yuxuan Lei, Xu Huang, Jing Yao, Wei Xu, and Xing Xie. 2024. RecAI: Leveraging large language models for next-generation recommender systems. In Companion Proceedings of the ACM Web Conference 2024, pages 1–4. ACM. ACM Digital Library landing page; Accessed: 2026-04-12. find
  32. Siyuan Liang, Mingli Zhu, Aishan Liu, Baoyuan Wu, Xiaochun Cao, and Ee-Chien Chang. 2023. Bad-CLIP: Dual-embedding guided backdoor attack on multimodal contrastive learning. arXiv preprint arXiv:2311.12075. ArXiv preprint; Accessed: 2026-04-12. — [arXiv:2311.12075](https://arxiv.org/abs/2311.12075) find
  33. Xun Liang, Simin Niu, Zhiyu Li, Sensen Zhang, Hanyu Wang, Feiyu Xiong, Jason Zhaoxin Fan, Bo Tang, Shichao Song, Mengwei Wang, and Jiawei Yang. 2025. Saferag: Benchmarking security in retrieval-augmented generation of large language model. arXiv preprint arXiv:2501.18636. ArXiv preprint; Accessed: 2… find
  34. Guang Lin, Zerui Tao, Jianhai Zhang, Toshihisa Tanaka, and Qibin Zhao. 2024. Adversarial guided diffusion models for adversarial purification. arXiv preprint arXiv:2403.16067. ArXiv preprint; Accessed: 2026-04-12. — [arXiv:2403.16067](https://arxiv.org/abs/2403.16067) find
  35. Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations. ICLR OpenReview record: https://openreview.net/forum?id=rJzIBfZAb. ↗
  36. Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. 2022. Diffusion models for adversarial purification. In International Conference on Machine Learning, pages 16805–16827. PMLR. ICML proceedings page; Accessed: 2026-04-12. find
  37. OpenAI. 2023. GPT-4V(ision) system card. Technical report, OpenAI. OpenAI system card (PDF); Published: September 2023; Accessed: 2026-04-12. find
  38. OWASP GenAI Security Project. 2025. OWASP top 10 for agentic applications (2026). OWASP GenAI Security Project. OWASP resource page; Published: December 9, 2025; Accessed: 2026-04-12. find
  39. Charles Packer, Sarah Wooders, Kevin Lin, Vivian Fang, Shishir G. Patil, Ion Stoica, and Joseph E. Gonzalez. 2023. Memgpt: Towards llms as operating systems. arXiv preprint arXiv:2310.08560. ArXiv preprint; Accessed: 2026-04-12. find
  40. Atharv Singh Patlan, Ashwin Hebbar, Pramod Viswanath, and Prateek Mittal. 2025. Context manipulation attacks: Web agents are susceptible to corrupted memory. arXiv preprint arXiv:2506.17318. ArXiv preprint; Accessed: 2026-04-12. — [arXiv:2506.17318](https://arxiv.org/abs/2506.17318) find
  41. Brandon Tran, Jerry Li, and Aleksander Madry. 2018. Spectral signatures in backdoor attacks. In Advances in Neural Information Processing Systems, volume 31. NeurIPS proceedings page; Accessed: 2026-04-12. find
  42. Judea Pearl. 2009. Causality: Models, Reasoning, and Inference, 2nd edition. Cambridge University Press. Book DOI landing page; Accessed: 2026-04-12. find
  43. Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. 2019. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE Symposium on Security and Privacy (SP), pages 707– 723. IEEE. IEEE Xplore landing page; Accessed: 2026-0… find
  44. Qiyao Peng, Hongtao Liu, Hua Huang, Jian Yang, Qing Yang, and Minglai Shao. 2025. A survey on LLM-powered agents for recommender systems. In Findings of the Association for Computational Linguistics: EMNLP 2025, pages 11574–11583, Suzhou, China. ACL Anthology entry; Accessed: 2026-04-12. find
  45. Nils Reimers and Iryna Gurevych. 2019. Sentence-BERT: Sentence embeddings using siamese BERT-networks. arXiv preprint arXiv:1908.10084. ArXiv preprint; Accessed: 2026-04-12.
  46. Christian Schlarmann, Naman Deep Singh, Francesco Croce, and Matthias Hein. 2024. Robust CLIP: Unsupervised adversarial fine-tuning of vision embeddings for robust large vision-language models. arXiv preprint arXiv:2402.12336. ArXiv preprint; Accessed: 2026-04-12. — [arXiv:2402.12336](https://arxiv.org/abs/2402.12336) find
  47. Sander Schulhoff, Jeremy Pinto, Anaum Khan, Louis-Francois Bouchard, Chenglei Si, Svetlina Anati, Valen Tagliabue, Anson Liu Kost, Christopher Carnahan, and Jordan Boyd-Graber. 2023. Ignore this title and HackAPrompt: Exposing systemic vulnerabilities of LLMs through a global scale prompt hacking co… — [arXiv:2311.16119](https://arxiv.org/abs/2311.16119) find
  48. Erfan Shayegani, Yue Dong, and Nael Abu-Ghazaleh. 2023. Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models. arXiv preprint arXiv:2307.14539. ArXiv preprint; Accessed: 2026-04-12. find
  49. Ezzeldin Shereen, Dan Ristea, Shae McFadden, Burak Hasircioglu, Vasilios Mavroudis, and Chris Hicks. 2025. One pic is all it takes: Poisoning visual document retrieval augmented generation with a single image. arXiv preprint arXiv:2504.02132. ArXiv preprint; Accessed: 2026-04-12. — [arXiv:2504.02132](https://arxiv.org/abs/2504.02132) find
  50. Saksham Sahai Srivastava and Haoyu He. 2025. Mem-orygraft: Persistent compromise of llm agents via poisoned experience retrieval. arXiv preprint arXiv:2512.16962. ArXiv preprint; Accessed: 2026-04-12. — [arXiv:2512.16962](https://arxiv.org/abs/2512.16962) find
  51. Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. 2020. On adaptive attacks to adversarial example defenses. In Advances in Neural Information Processing Systems, volume 33, pages 1633–1645. NeurIPS proceedings page; Accessed: 2026-04-12. find
  52. Lei Wang, Chen Ma, Xueyang Feng, Zeyu Zhang, Hao Yang, Jingsen Zhang, Zhiyuan Chen, Jiakai Tang, Xu Chen, Yankai Lin, Wayne Xin Zhao, Zhewei Wei, and Jirong Wen. 2024a. A survey on large language model based autonomous agents. Frontiers of Computer Science, 18(6):186345. Also available as arXiv:2308…
  53. Liang Wang, Nan Yang, Xiaolong Huang, Binxing Jiao, Linjun Yang, Daxin Jiang, Rangan Majumder, and Furu Wei. 2022. Text embeddings by weakly-supervised contrastive pre-training. arXiv preprint arXiv:2212.03533. ArXiv preprint; Accessed: 2026-04-12.
  54. Song Wang, Xun Wang, Jie Mei, Yujia Xie, Si-Qing Chen, and Wayne Xiong. 2025a. Developing a reliable, fast, general-purpose hallucination detection and mitigation service. In Proceedings of the 2025 Conference of the North American Chapter of the Association for Computational Linguistics: Human Lang… find
  55. Xiaohua Wang, Zhenghua Wang, Xuan Gao, Feiran Zhang, Yixin Wu, Zhibo Xu, Tianyuan Shi, Zhengyuan Wang, Shizheng Li, Qi Qian, Ruicheng Yin, Changze Lv, Xiaoqing Zheng, and Xuanjing Huang. 2024b. Searching for best practices in retrieval-augmented generation. In Proceedings of the 2024 Conference on E…
  56. Xin Wang, Kai Chen, Jiaming Zhang, Jingjing Chen, and Xingjun Ma. 2025b. TAPT: Test-time adversarial prompt tuning for robust inference in vision-language models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. find
  57. CVPR 2025 open-access paper page; Accessed: 2026-04-12. find
  58. Qianshan Wei, Tengchao Yang, Yaochen Wang, Xinfeng Li, Lijun Li, Zhenfei Yin, Yi Zhan, Thorsten Holz, Zhiqiang Lin, and XiaoFeng Wang. 2025. A-memguard: A proactive defense framework for llm-based agent memory. arXiv preprint arXiv:2510.02373. ArXiv preprint; Accessed: 2026-04-12. — [arXiv:2510.02373](https://arxiv.org/abs/2510.02373) find
  59. Chen Henry Wu, Rishi Shah, Jing Yu Koh, Ruslan Salakhutdinov, Daniel Fried, and Aditi Raghunathan. 2024. Dissecting adversarial robustness of multimodal lm agents. arXiv preprint arXiv:2406.12814. ArXiv preprint; Accessed: 2026-04-12. find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/qian-2026-visual-inception-compromising-long-term/