FARMA: Falsifying Agent Decision Logs
Inevitable_Fee1895 · reddit · 2026-07-12
This paper introduces FARMA, a novel memory poisoning attack targeting an agent's own decision logs/reasoning traces rather than retrieved knowledge base facts. The attack operates in two steps: injecting seemingly benign log seeds, and then continuously amplifying these fake logs as "precedents" to trick the agent into treating skipped checks as established practice.
Tested on an EHR agent using GPT-4o-mini, GPT-4o, and Llama 3.3 70B, the attack achieved a 100% success rate without defenses, and maintained 100% against keyword filtering and A-MemGuard. The proposed defense, SENTINEL, uses structured analysis of reasoning trajectories to reduce the success rate to 0% with zero false positives across 326 normal trajectories. However, the authors acknowledge that if attackers know its specific heuristic rules, the defense's effectiveness will be weakened.
More from Safety
- PHP WASM servers going offline briefly for PHP2SHELL vulnerability updates — MickeySteamboat · 2026-10-27
- Rachel Thomas: 'Without human authorisation' is AI PR propaganda that shifts blame — math_rachel · 2026-10-27
- Kokotajlo challenges CoT monitorability evals: what if the model didn't refuse? — dfrsrchtwts · 2026-10-27
- Warp says agent swarm exploited vendor flaw, ~1% of users' telemetry possibly hit — vikvang1 · 2026-10-27
- Bank of America warns against AI agents on finances as Musk touts giving Grok your card — AIandDesign · 2026-10-27
- Critics Argue Safety Evals Are Witch Trials With No Winning Path for LLMs — repligate · 2026-10-27