Lucid: an imperceptible image can rewrite a multimodal agent's memory

What is this?

On 20 July 2026, Halima Bouzidi, Mboutidem Ekemini Mkpong, and Mohammad Abdullah Al Faruque published an arXiv paper titled “Do Agents Dream of False Memories? Black-box Visual Attacks on Long-term Memory in Multimodal AI Agents”. It introduces an attack framework the authors call Lucid. This is a lab study run in controlled test settings, not an incident in the wild.

The finding is narrow but sharp. Multimodal agents that keep a long-term memory — a store of past images and text they can recall later — trust the pictures in that memory as if they were faithful records. Lucid shows that an attacker who controls only a single image, with no access to the model, the retrieval system, or the text around it, can slip an imperceptible perturbation into that picture and change what the agent later recalls and says. The user sees an ordinary image and an ordinary answer, and never learns the memory was tampered with.

How it works

Lucid operates under what the authors call a strictly image-bounded, black-box threat model. The attacker does not need to see inside the vision-language model, does not need the retrieval encoder that indexes memories, and does not touch the text channel. All they influence is the pixels of one image that the agent will store or reason over. The perturbation is crafted to be visually imperceptible, so it survives casual human review.

From there the paper describes two distinct failure modes. In memory poisoning, an in-context attack, the adversarial image replaces a benign one whose meaning was reinforced by surrounding text; this corrupts the agent’s visual recall and steers it toward an attacker-chosen narrative in later turns. In memory injection, an out-of-context attack, the adversarial image lands in a conversation turn with no prior textual grounding, so there is no corrective signal from memory and the agent generates attacker-influenced responses outright.

The reach is what makes it notable. The authors evaluate Lucid across several conversation domains and five black-box memory architectures, including graph-structured memory, LLM-summarized memory, and a commercially deployed system. It reached a 61.6% attack success rate on poisoning and 58.4% on injection. No perturbation recipe or payload is reproduced here; the mechanism is the point.

Why it matters

Most published memory attacks arrive through text — a poisoned email, a crafted document, an instruction hidden in a web page. Lucid closes off an assumption that a picture is safer than prose. If an agent will photograph a receipt, screenshot a dashboard, accept a shared image, or scrape one from a page and file it into long-term memory, that image is now an untrusted write to durable state. The corruption persists across sessions and shapes decisions long after the original turn scrolled away, and because the change lives in pixels rather than words, text-only input filters and instruction-hardening never see it.

This sits alongside a fast-growing line of work on multimodal memory as an attack surface, including triggered poisoning of multimodal web-agent memories and memory poisoning against agentic recommenders. It is the visual counterpart to text-channel stealth writes such as MemGhost: in every case, external content becomes trusted internal state with no visible moment where anyone approved it — the same write-time blind spot that runs through agent memory generally.

Defenses

Treat every stored image as untrusted input, not as ground truth. Tag provenance on memories so an agent can weigh whether a recalled picture came from a trusted capture or an external, attacker-reachable source, and refuse to let untrusted images silently promote themselves into durable, decision-shaping memory. Because Lucid is black-box and imperceptible, human eyeballing will not catch it; defenders should lean on ensembles and cross-checks — corroborate a recalled image against the text that accompanied it, flag turns where a single image with no textual grounding drives a decision, and require confirmation before an image-only recall triggers a consequential action. Purification and adversarial-robustness preprocessing on images entering memory raise the cost of a usable perturbation, though the paper’s black-box results are a caution against treating any single filter as sufficient. Above all, keep memory writes and reads inside a security boundary with logging, so a poisoned recall can be traced and rolled back — see OWASP’s agent memory guidance for controls to build against.

Status

Item	Detail
Disclosure	arXiv paper announced 20 July 2026
Nature	Black-box, image-only adversarial attack on multimodal agent long-term memory (poisoning and injection)
Threat model	No access to the target MLLM, retrieval encoder, or text channel; imperceptible image perturbation only
Tested on	Five black-box memory architectures, including graph-structured, LLM-summarized, and a commercially deployed system
Success	61.6% attack success (poisoning); 58.4% (injection)
Precondition	The adversarial image must reach the agent’s memory pipeline; lab-only, no in-the-wild abuse reported
Class	Multimodal memory poisoning via adversarial perturbation; missing provenance and write-time approval

Figures reflect the authors’ benchmark as run in sealed lab environments on specific model and memory versions. Agent behavior and defenses change across releases — verify against the current version of any deployment before drawing conclusions.