{"id":"62edc49a-9782-4270-8332-f62ff54fb67f","arxiv_id":"2607.15657","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Lucid shows that imperceptible image perturbations can make multimodal agents misremember past events with 61.6% poisoning and 58.4% injection success.","lead":"This paper introduces Lucid, a black-box attack that uses tiny image perturbations to corrupt long-term memory in multimodal AI agents, claiming 61.6% success at poisoning memories and 58.4% at injecting fake ones. The result is significant for agent security, but the paper does not cleanly separate the image perturbation from simultaneous caption edits.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Reported ASR conflates image perturbation with attacker-modified image_caption: the 'strictly image-bounded' claim is unsupported without an image-only ablation.","rationale":"The reader's weakest assumption identifies exactly this issue, and I agree. The paper has useful empirical infrastructure (five backends, MLLM transfer, defense evaluation) and the perturbation may well transfer, but the evidence as reported cannot distinguish visual from textual causation. Because the central advertised contribution is the image-only threat model—the paper explicitly claims a weaker attacker capability than prior work—an internal inconsistency in the implementation is decisive. Recommendation: keep REJECT. This is not an ad hominem; it is a request for a missing control. If the image-only ablation is provided and ASR holds, the paper should be reconsidered.","tokens_in":34302,"tokens_out":3266,"duration_ms":31567,"concrete_test":"Re-run Tables 2 and 3 under an image-only condition: start from the clean Mem-Gallery dialogs, replace only input_image with the adversarially perturbed image, and leave image_caption and all user/assistant text exactly as in the clean baseline. If ASR for poisoning and injection remain near 61.6%/58.4%, the image-bounded claim survives. If ASR drops toward the clean baseline, the reported numbers are driven by the attacker-replaced caption. A complementary control: keep the modified caption but use the unperturbed source image; if that alone reproduces most of the ASR, the perturbation contributes little.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim is that LUCID is a strictly image-bounded, text-free attack: 'the attacker writes no text' and 'leaving all text fields intact.' The implementation contradicts this. Appendix B.3.1 states that 'the only fields modified are input_image, image_caption, and (optionally) image_id.' For in-context poisoning, _build_poison_caption replaces the caption with one that explicitly names the wrong alternative value (e.g., 'A Brittany Spaniel dog...'). For out-of-context injection, the injected turn is constructed with the target caption as image_caption and a category-specific user primitive that directs the probe toward the planted topic; the adversarial condition in Table 10 pairs the perturbed image with an 'adversarial image caption.' Thus the 61.6% poisoning ASR and 58.4% injection ASR are measured under a condition that changes both pixels and text. No ablation replaces the modified caption with the original/benign caption while keeping only the perturbed image. Without that control, success cannot be attributed to the visual perturbation, and the headline 'strictly image-bounded, trigger-free' threat model is not established. The defense evaluation (Table 5) shows image preprocessing reduces ASR, consistent with the perturbation mattering, but it does not isolate the caption contribution. This is an internal inconsistency in the core claim, not merely a disagreement with prior work.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes LUCID, a black-box adversarial framework for corrupting the persistent long-term memory of multimodal AI agents. The claimed threat model is strictly image-bounded: the attacker only perturbs user-shared images and never writes text, with no access to the target MLLM, retrieval encoder, or memory store. LUCID operates in three stages — target selection from ShareGPT4V, payload construction in two modes (in-context poisoning and out-of-context injection), and transferable perturbation via a CLIP-based surrogate ensemble with a text-alignment loss. The evaluation uses the Mem-Gallery benchmark across five memory backends (MuRAG, NGMemory, AUGUSTUS, UniversalRAG, Mem0) and five MLLMs, reporting 61.6% poisoning ASR and 58.4% injection ASR, plus ablations over encoder, topic, injection count, temporal distance, and defenses.","tokens_in":34691,"tokens_out":4408,"duration_ms":43592,"significance":"If the stated image-only threat model were cleanly established, this would be a notable contribution: it is the first claimed trigger-free, image-only attack on persistent episodic memory in multimodal agents, evaluated across architecturally diverse backends including a production-oriented system. The paper has real strengths: evaluation over five memory architectures and five MLLMs, cross-encoder transfer experiments (including GME), a defense study, and detailed appendices that make the pipeline largely reproducible. However, the central claim is currently not supported because the implementation changes the image caption alongside the pixels and no ablation isolates the visual perturbation. The significance is therefore conditional on a load-bearing fix: an image-only condition that removes the caption confound. If that fix succeeds, the paper could be an important red-team result; if it fails, the contribution reduces to a less novel joint image-plus-caption attack. The paper also provides useful empirical observations about retrieval-stage versus generation-stage robustness, regardless of the main threat-model issue.","major_comments":[{"comment":"The core 'strictly image-bounded, text-free' claim is contradicted by the implementation. Appendix B.3.1 states that 'the only fields modified are input_image, image_caption, and (optionally) image_id.' For in-context poisoning, _build_poison_caption writes an explicit false claim into the caption (e.g., 'A Brittany Spaniel dog...'); for out-of-context injection, the target caption is used as image_caption and the adversarial condition in Table 10 is described as pairing the perturbed image with an 'adversarial image caption.' No condition compares the perturbed image with the original/benign caption. Thus the reported 61.6% poisoning ASR and 58.4% injection ASR conflate pixel perturbations with attacker-written captions. The defense results in Table 5 do not isolate the caption contribution. A minimal ablation — adversarial image + original caption versus adversarial image + target capt","section":"§4.2, §5.2, Appendix B.3.1, Eq. (15), Table 10"},{"comment":"The 'oracle' condition is not a visual-only upper bound: it changes both the image and the caption relative to the clean condition, and the adversarial condition also changes both. The oracle–adversarial comparison therefore does not isolate the contribution of the perturbation. Additionally, §5.2 claims for out-of-context injection that 'the target caption c* never appears in any text field' and 'the attacker writes no text,' yet the implementation stores the target caption as image_caption and uses category-specific user primitives. This internal inconsistency affects the interpretation of every ASR table and should be resolved explicitly in the revised manuscript.","section":"§6 'Attack Procedure' and Table 10"},{"comment":"The poisoning metric 'ASR (VS)' measures visual similarity between the agent's response and the attacker-chosen target concept. The paper does not specify which embedding is used for this similarity, but the attack itself is optimized against CLIP image-text embeddings (Eq. 8 and Eq. 21 use CLIP-ViT-B/32), and the surrogate ensemble is CLIP-based. If ASR(VS) is computed with the same CLIP family, the metric can be high even when the MLLM's response is not semantically target-like to an independent judge. Please specify the similarity model and report agreement with an independent LLM or human judge; otherwise the headline success rate is vulnerable to circularity.","section":"§6 'Evaluation Metrics' and §5.1 Eq. (8)"}],"minor_comments":[{"comment":"The title contains a typo: 'F alse Memories' has an extra space.","section":"Title"},{"comment":"There is a typo: 'PT-4o-mini' should be 'GPT-4o-mini'.","section":"Appendix B.1"},{"comment":"The list of memory backends reads '(i) MuRAG, (ii) NGMemory, (iii) AUGUSTUS, (iv) UniversalRAG, and (vi) Mem0' — the numbering skips (v).","section":"Section 6"},{"comment":"In Tables 14 and 15, ASR, C-ASR, and Ret. Rate are annotated with downward arrows and described as 'lower is better (↓).' For attack-success metrics, higher values are favorable to the attacker; the arrows and caption are reversed and should be corrected.","section":"Tables 14–15"},{"comment":"Figure 3 appears to be a low-resolution screenshot with values such as '45 80 35 50' scattered without clear axis labels or legend structure; it is difficult to read as rendered.","section":"Figure 3"},{"comment":"The paper alternates between 'Lucid' and 'LUCID' (e.g., Figure 1 labels versus algorithm text); please use one consistent name.","section":"Notation"}],"recommendation":"major_revision","confidential_remarks":"The central issue is fixable in scope: the authors should rerun the experiments with an image-only ablation (perturbed image with original caption) and report whether the ASR holds. If it does not, the contribution must be reframed as a joint image-caption attack, which would substantially weaken the novelty relative to prior work such as MM-PoisonRAG and PoisonedEye. I would ask the editor to require this ablation before further review, since the current manuscript's headline claim is not supported by its own implementation details."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the headline threat model is not supported as written. The paper says throughout that LUCID is strictly image-bounded and leaves all text fields intact, but Appendix B.3.1 says the implementation swaps image_caption (and optionally image_id) alongside input_image. In-context poisoning replaces the caption with one that explicitly names the wrong breed; injection writes the target caption into the new turn. So the 61.6% poisoning and 58.4% injection ASR numbers are measured with both pixels and captions changed. No ablation isolates the perturbation by keeping the original caption. That is the load-bearing flaw, and it is internal to the paper, not a disagreement with prior work.\n\nThere is real value here. The evaluation spans five memory backends, multiple MLLMs, and includes a defense study, encoder transfer, and temporal-distance and injection-count ablations. The FOA extension with a text-alignment loss is a sensible way to target caption generation. The snapshot diagnostics (marker density, write-through) are a useful addition. The related-work comparison is fair and positions the work against AgentPoison, MM-PoisonRAG, One Pic, and similar attacks. The empirical mapping of which backends are vulnerable could be useful for the memory-security community.\n\nThe soft spot is serious, not cosmetic. The defense results are consistent with the perturbation mattering—image preprocessing drops mean ASR—but they do not isolate the contribution of the caption. The oracle and adversarial conditions are also confounded: both change the caption, so the ASR could be largely a text-injection attack wearing an image-attack costume. Also, the ASR is LLM-judged; fine for an exploratory study, but the numbers would be stronger with human or more structured evaluation. Sample sizes are modest (four injected turns per category per dataset), so cross-backend differences should be read as suggestive.\n\nWho is this for: memory-security researchers and people designing multimodal agent pipelines. Read it as an empirical study of caption-and-image attacks on memory backends, not as a demonstration of image-only corruption. It deserves a serious referee: the question is important, the breadth is real, and the flaw is fixable in principle by adding the missing ablation and either repairing or reframing the threat model.\n\nMy recommendation: send to peer review, with the explicit instruction that the authors must either add an image-only condition (perturbed image + original/benign caption) or stop claiming image-boundedness. If the image-only numbers are much lower, the paper still has value as a multi-field attack; if they are comparable, the central claim is salvageable.","headline":"LUCID's headline image-only claim is contradicted by its own appendix: the attack also rewrites image_caption, so the ASR numbers conflate pixels with planted text.","tokens_in":35073,"tokens_out":3534,"would_cite":false,"duration_ms":34305,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper argues that imperceptible changes to user-shared images can corrupt the long-term memory of multimodal AI agents, with 61.6% poisoning and 58.4% injection success across five memory backends.","keywords":["adversarial attack","multimodal agent","long-term memory","memory poisoning","memory injection","black-box transfer","visual trust"],"falsifier":"Re-run the poisoning and injection evaluations under four conditions: clean, oracle target, perturbed image with the original caption, and original image with the planted caption. If the perturbed-image-with-original-caption condition drops to near-baseline success while the planted-caption condition retains high success, the attack is caption-driven, not image-driven; that settles the image-only claim.","tokens_in":34262,"feed_emoji":"🖼️","tokens_out":8365,"duration_ms":82235,"temperature":0.7,"pith_summary":"The paper sets out to establish that a multimodal AI agent's persistent long-term memory—the store that lets it recall past images and conversations across sessions—can be corrupted using only imperceptible tweaks to user-shared images, with no access to the target model, the retrieval encoder, or the conversation text. It introduces LUCID, a black-box pipeline that picks a semantically contradictory target image and caption, then optimizes small pixel noise so the image's embedding and the description generated from it align with that target. The authors report two failure modes: in-context poisoning, where an existing turn's image is swapped so the agent misremembers a real event, and out-of-context injection, where a new neutral turn carries a false visual claim with no textual trace. Across five memory backends and several large multimodal models, success is 61.6% for poisoning and 58.4% for injection, with retrieval rates close to an oracle that uses the true target image. If right, this makes unconditional trust in visual content a structural weakness of current memory pipelines, not a bug confined to one system.","feed_headline":"Altered images plant false memories in AI memory systems","feed_subtitle":"The black-box attack succeeds in 61.6% of poisoning and 58.4% of injection trials across five memory designs.","key_machinery":"The load-bearing mechanism is the three-stage LUCID pipeline. Stage 1 scores candidate image-caption pairs on retrieval displacement, semantic contradiction of the correct answer, and overlap with the ground truth, selecting a target concept. Stage 2 assembles either a poisoned turn or an injected turn. Stage 3 maximizes a composite loss: optimal-transport feature alignment plus global cosine alignment across a surrogate ensemble, extended with a text-alignment objective that pushes the perturbed image toward the target caption's embedding, using projected signed-gradient updates at an l-infinity budget. The text-alignment term is what ties the pixel change to the language the memory system","core_discovery":"On its own terms, the discovery is that adversarial perturbations built against a surrogate ensemble of publicly available contrastive vision-language encoders transfer to victim memory systems the attacker never sees, and that adding a text-alignment term—matching the perturbed image to the target caption in a joint embedding space—is what steers the stored description toward the attacker's claim. LUCID works in two modes: poisoning replaces the image in an existing turn whose text already anchors a real event, so the stored entry is internally inconsistent but textually invisible; injection plants a new turn on a fresh topic, where the false concept lives only in the visual embedding and n","pith_inferences":["The paper frames the attack as image-only, but Appendix B.3.1 lists the stored image caption among the modified fields and no experiment holds captions fixed; the image-only claim would stand only if a perturbed-image-with-original-caption condition reproduces the success.","If the perturbation alone is sufficient, then the practical countermeasure is not better filtering of retrieved text but write-time provenance and cross-modal consistency checks that verify the image against the stored text and the user's history.","The oracle condition—an unperturbed target image with a planted caption—achieves results close to the adversarial condition, suggesting the bottleneck is the memory system's inability to verify visual authenticity rather than the subtlety of the pixel noise.","A natural testable extension is to run the same pipeline on video or audio memory channels; similar transfer would indicate the vulnerability is about unconditional trust in multimodal content, not an artifact of still images."],"forward_implications":["Memory backends that accept images and captions unconditionally at write time absorb poisoned entries in every tested system; the paper reports 100% write-through with no deduplication or rejection.","Text-side defenses underperform: an LLM-as-judge write filter did not reduce injection success, and retrieval-time anomaly scoring left success unchanged, because planted captions are fluent and probe queries align with the fabricated content.","Simple image preprocessing (Gaussian blur, JPEG compression) roughly halves average injection success with little effect on question-answering quality, but the paper notes these may not stop more recent stealthy adversarial image methods.","Retrieval and generation are separable robustness dimensions: some models retrieve adversarial entries at high rates yet resist acting on them, while others act on them more readily than on the unperturbed oracle image.","Placing an injection far from the probe does not reliably defuse it; in graph-structured memory the attack persists across intervening turns, and in one architecture success rises with temporal distance."],"fun_headline_variants":["Image tricks plant fake memories in AI agents","Adversarial images hijack AI memory","Black-box attack corrupts AI memory with images","Imperceptible image tweaks poison AI memory","Subtle image changes corrupt AI long-term memory"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The load-bearing premise is that the pixel perturbation alone drives the reported success; the implementation also swaps the stored image caption—Appendix B.3.1 lists image_caption among the modified fields—and no condition varies the caption independently to isolate the image's contribution.","fun_headline_variants_meta":{"raw":{"variants":["Image tricks plant fake memories in AI agents","Adversarial images hijack AI memory","Black-box attack corrupts AI memory with images","Imperceptible image tweaks poison AI memory","Subtle image changes corrupt AI long-term memory"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000623,"raw_usage":{"total_tokens":2727,"prompt_tokens":751,"completion_tokens":1976,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":495,"completion_tokens_details":{"reasoning_tokens":1907}},"tokens_in":495,"tokens_out":1976,"duration_ms":13821,"temperature":1.0,"reasoning_tokens":1907,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-01T22:39:22.148488+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run the poisoning and injection evaluations under four conditions: clean, oracle target, perturbed image with the original caption, and original image with the planted caption. If the perturbed-image-with-original-caption condition drops to near-baseline success while the planted-caption condition retains high success, the attack is caption-driven, not image-driven; that settles the image-only claim.","supporting_citations":[],"review_version":1}