Elamur Research⌕
☰
home / papers / 2026 / Evo-Attacker: Memory-Augmented Reinforcement Learning for Long-Horizon Tool Attacks on LLM-MAS

Evo-Attacker: Memory-Augmented Reinforcement Learning for Long-Horizon Tool Attacks on LLM-MAS

Paper · 2026 · Bingyu Yan, Xiaoming Zhang, JinYu Hou et al.

Summary

LLM-based multi-agent systems (LLM-MAS) depend on external tools, and agents tend to accept tool returns without question. The authors study how an adversary controlling the tool channel of a single agent can make the whole system fail. Earlier tool attacks have three weaknesses. Some target lone agents, and their injections get flagged as inconsistent by downstream agents. Others work only in one domain, such as web navigation. The rest rely on fixed templates. Evo-Attacker instead casts the attack as memory-augmented reinforcement learning. In an initial zero-shot exploration phase, every episode that ends in verified system failure is stored in an Attack Memory. During an attack, a policy reasons through Retrieve, Reflect and Modify steps to decide whether and how to alter a tool return, within a limited intervention budget. The full reasoning pipeline is trained with Attack-Flow GRPO, which passes the final outcome reward back to earlier reasoning tokens to solve long-horizon credit assignment. Experiments reportedly show consistent gains over baselines and generalization across architectures, tasks and tool schemas. This highlights the need for defenses that protect tool returns.

Key points

  • Threat model: gray-box. The attacker sees and can rewrite tool calls and returns of one target agent but cannot see inter-agent messages or model internals. At most B returns may be modified, and the goal is to maximize the expected failure indicator J(o).
  • Attack Memory: each entry pairs the task context (graph, task, target agent) with a trace of original tool calls, applied modifications and perturbed returns.
  • Attacker design: the attacker is a planner-style policy with two internal tools, a memory retriever and a return modifier, and it may choose a NoOp ("do not attack") on a given turn.
  • Baselines and evaluation: compared approaches include InjecAgent, Forced Output, Web Fraud Attacks and Prompt Infection. Stealthiness was tested against LLM-based detectors, not against cryptographic signing or whitelist filtering. The excerpt omits the quantitative results.
  • Limitations: the method has higher compute and token costs, and the authors suggest distillation as a future fix. The work is positioned as a red-teaming tool, and experiments ran only in simulated environments.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓Beihang UniversityBeijing · China86 works · 9,097 citations🎓Beijing University of Posts and TelecommunicationsBeijing · China78 works · 33,365 citations🔬China Academy of Information and Communications TechnologyBeijing · China3 works · 5 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksArts and Humanities · 17,450 worksLanguage and Linguistics · 17,296 works

🧭 Topics 1Research subjects and languages the work is about.Language models & pretraining · 3,894 works

Cite

Cite as Bingyu Yan, Xiaoming Zhang, JinYu Hou, Chaozhuo Li, Ziyi Zhou, Yiming Hei and Litian Zhang. 2026. Evo-Attacker: Memory-Augmented Reinforcement Learning for Long-Horizon Tool Attacks on LLM-MAS. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.acl-long.330

@inproceedings{yan2026evo,
  title = {{Evo-Attacker: Memory-Augmented Reinforcement Learning for Long-Horizon Tool Attacks on LLM-MAS}},
  author = {Bingyu Yan, Xiaoming Zhang, JinYu Hou, Chaozhuo Li, Ziyi Zhou, Yiming Hei and Litian Zhang},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.330},
  url = {https://doi.org/10.18653/v1/2026.acl-long.330}
}

References

29 references, 10 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Donghyun Lee and Mo Tiwari. 2024. Prompt infection: Llm-to-llm prompt injection within multi-agent systems. arXiv preprint arXiv:2410.07283. — [arXiv:2410.07283](https://arxiv.org/abs/2410.07283) find
  2. Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Ponde De Oliveira Pinto, Jared Kaplan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, and 1 others. 2021. Evaluating large language models trained on code. arXiv preprint arXiv:2107.03374.
  3. Chaozhuo Li, Pengbo Wang, Chenxu Wang, Litian Zhang, Zheng Liu, Qiwei Ye, Yuanbo Xu, Feiran Huang, Xi Zhang, and Philip S Yu. 2025a. Loki’s dance of illusions: A comprehensive survey of hallucination in large language models. arXiv preprint arXiv:2507.02870. — [arXiv:2507.02870](https://arxiv.org/abs/2507.02870) find
  4. Zhuofeng Li, Haoxiang Zhang, Seungju Han, Sheng Liu, Jianwen Xie, Yu Zhang, Yejin Choi, James Zou, and Pan Lu. 2025b. In-the-flow agentic system optimization for effective planning and tool use. arXiv preprint arXiv:2510.05592. — [arXiv:2510.05592](https://arxiv.org/abs/2510.05592) find
  5. Haowei Liu, Xi Zhang, Haiyang Xu, Yuyang Wanyan, Junyang Wang, Ming Yan, Ji Zhang, Chunfeng Yuan, Changsheng Xu, Weiming Hu, and 1 others. 2025a. Pc-agent: A hierarchical multi-agent collaboration framework for complex task automation on pc. arXiv preprint arXiv:2502.14282. — [arXiv:2502.14282](https://arxiv.org/abs/2502.14282) find
  6. Songyang Liu, Chaozhuo Li, Jiameng Qiu, Xi Zhang, Feiran Huang, Litian Zhang, Yiming Hei, and Philip S Yu. 2025b. The scales of justitia: A comprehensive survey on safety evaluation of llms. arXiv preprint arXiv:2506.11094. — [arXiv:2506.11094](https://arxiv.org/abs/2506.11094) find
  7. Songyang Liu, Chaozhuo Li, Chenxu Wang, Jinyu Hou, Zejian Chen, Litian Zhang, Zheng Liu, Qiwei Ye, Yiming Hei, Xi Zhang, and 1 others. 2026. Clawkeeper: Comprehensive safety protection for openclaw agents through skills, plugins, and watchers. arXiv preprint arXiv:2603.24414. — [arXiv:2603.24414](https://arxiv.org/abs/2603.24414) find
  8. Xingyao Wang, Yangyi Chen, Lifan Yuan, Yizhe Zhang, Yunzhu Li, Hao Peng, and Heng Ji. 2024. Executable code actions elicit better llm agents. In Forty-first International Conference on Machine Learning.
  9. Weimin Xiong, Ke Wang, Yifan Song, Hanchao Liu, Sai Zhou, Wei Peng, and Sujian Li. 2025. More vulnerable than you think: On the stability of tool-integrated llm agents. arXiv preprint arXiv:2506.21967. — [arXiv:2506.21967](https://arxiv.org/abs/2506.21967) find
  10. Bingyu Yan, Xiaoming Zhang, Ziyi Zhou, Chaozhuo Li, Ruilin Zeng, Yirui Qi, Tianbo Wang, and Litian Zhang. 2026. Attack the messages, not the agents: A multi-round adaptive stealthy tampering framework for llm-mas. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 40, pages 297… find
  11. Bingyu Yan, Zhibo Zhou, Litian Zhang, Lian Zhang, Ziyi Zhou, Dezhuang Miao, Zhoujun Li, Chaozhuo Li, and Xiaoming Zhang. 2025. Beyond self-talk: A communication-centric survey of llm-based multi-agent systems. arXiv preprint arXiv:2502.14321. — [arXiv:2502.14321](https://arxiv.org/abs/2502.14321) find
  12. Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2023. Autodan: Generating stealthy jailbreak prompts on aligned large language models. arXiv preprint arXiv:2310.04451.
  13. An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, and 1 others. 2025. Qwen3 technical report. arXiv preprint arXiv:2505.09388.
  14. Xingjun Ma, Yifeng Gao, Yixu Wang, Ruofan Wang, Xin Wang, Ye Sun, Yifan Ding, Hengyuan Xu, Yunhao Chen, Yunhan Zhao, and 1 others. 2025. Safety at scale: A comprehensive survey of large model safety. arXiv preprint arXiv:2502.05206. — [arXiv:2502.05206](https://arxiv.org/abs/2502.05206) find
  15. Shunyu Yao, Howard Chen, John Yang, and Karthik Narasimhan. 2022. Webshop: Towards scalable real-world web interaction with grounded language agents. Advances in Neural Information Processing Systems, 35:20744–20757.
  16. Avijit Mallik. 2019. Man-in-the-middle-attack: Understanding in simple words. International journal of data and network science. find
  17. Weichen Yu, Kai Hu, Tianyu Pang, Chao Du, Min Lin, and Matt Fredrikson. Llm-based multi-agents system attack via continuous optimization with discrete efficient search. In Second Conference on Language Modeling. find
  18. Mistral AI. 2025. Ministral-3-8b-instruct-2512. https://huggingface.co/mistralai/ Ministral-3-8B-Instruct-2512. Model card on Hugging Face. Accessed: 2026-01-05. ↗
  19. Rana Shahroz, Zhen Tan, Sukwon Yun, Charles Fleming, and Tianlong Chen. 2025. Agents under siege: Breaking pragmatic multi-agent llm systems with optimized prompt attacks. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 9661–9… find
  20. Guangming Sheng, Chi Zhang, Zilingfeng Ye, Xibin Wu, Wang Zhang, Ru Zhang, Yanghua Peng, Haibin Lin, and Chuan Wu. 2025. Hybridflow: A flexible and efficient rlhf framework. In Proceedings of the Twentieth European Conference on Computer Systems, pages 1279–1297.
  21. Chenxu Wang, Chaozhuo Li, Songyang Liu, Zejian Chen, Jinyu Hou, Ji Qi, Rui Li, Litian Zhang, Qiwei Ye, Zheng Liu, and 1 others. 2026. The devil behind moltbook: Anthropic safety is always vanishing in self-evolving ai societies. arXiv preprint arXiv:2602.09877. — [arXiv:2602.09877](https://arxiv.org/abs/2602.09877) find
  22. Siyu Yuan, Kaitao Song, Jiangjie Chen, Xu Tan, Yongliang Shen, Kan Ren, Dongsheng Li, and Deqing Yang. 2025. Easytool: Enhancing llm-based agents with concise tool instruction. In Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguisti… find
  23. Qiusi Zhan, Zhixiang Liang, Zifan Ying, and Daniel Kang. 2024. Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents. arXiv preprint arXiv:2403.02691.
  24. Litian Zhang, Xiaoming Zhang, Bingyu Yan, Ziyi Zhou, Bo Zhang, Zhenyu Guan, Xi Zhang, and Chaozhuo Li. 2025. Llms are introvert. arXiv preprint arXiv:2507.05638. — [arXiv:2507.05638](https://arxiv.org/abs/2507.05638) find
  25. Jianan Zhao, Meng Qu, Chaozhuo Li, Hao Yan, Qian Liu, Rui Li, Xing Xie, and Jian Tang. 2022. Learning on large-scale text-attributed graphs via variational inference. arXiv preprint arXiv:2210.14709. — [arXiv:2210.14709](https://arxiv.org/abs/2210.14709) find
  26. Yuxiang Zheng, Dayuan Fu, Xiangkun Hu, Xiaojie Cai, Lyumanshan Ye, Pengrui Lu, and Pengfei Liu. 2025. Deepresearcher: Scaling deep research via reinforcement learning in real-world environments. arXiv preprint arXiv:2504.03160.
  27. Shuyan Zhou, Frank F Xu, Hao Zhu, Xuhui Zhou, Robert Lo, Abishek Sridhar, Xianyi Cheng, Tianyue Ou, Yonatan Bisk, Daniel Fried, and 1 others. 2023. Webarena: A realistic web environment for building autonomous agents. arXiv preprint arXiv:2307.13854.
  28. Kunlun Zhu, Hongyi Du, Zhaochen Hong, Xiaocheng Yang, Shuyi Guo, Daisy Zhe Wang, Zhenhailong Wang, Cheng Qian, Robert Tang, Heng Ji, and 1 others. 2025. Multiagentbench: Evaluating the collaboration and competition of llm agents. In Proceedings of the 63rd Annual Meeting of the Association for Compu… find
  29. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043.

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/yan-2026-evo-attacker-memory-augmented-reinforcement/