Visual Inception: Compromising Long-term Planning in Agentic Recommenders via Multimodal Memory Poisoning

TL;DR

This paper reveals a new vulnerability in agentic recommender systems called Visual Inception, where poisoned images can hijack long-term planning, and proposes a defense framework called CognitiveGuard to mitigate this threat.

Contribution

It introduces Visual Inception, a novel attack method exploiting long-term memory in agentic RecSys, and proposes CognitiveGuard, a dual-process defense inspired by human cognition.

Findings

Visual Inception achieves about 85% Goal-Hit Rate in experiments.

CognitiveGuard reduces the attack success rate to around 10%.

Defense mechanism maintains system quality with configurable latency.

Abstract

The evolution from static ranking models to Agentic Recommender Systems (Agentic RecSys) empowers AI agents to maintain long-term user profiles and autonomously plan service tasks. While this paradigm shift enhances personalization, it introduces a vulnerability: reliance on Long-term Memory (LTM). In this paper, we uncover a threat termed "Visual Inception." Unlike traditional adversarial attacks that seek immediate misclassification, Visual Inception injects triggers into user-uploaded images (e.g., lifestyle photos) that act as "sleeper agents" within the system's memory. When retrieved during future planning, these poisoned memories hijack the agent's reasoning chain, steering it toward adversary-defined goals (e.g., promoting high-margin products) without prompt injection. To mitigate this, we propose CognitiveGuard, a dual-process defense framework inspired by human cognition. It consists of a System 1 Perceptual Sanitizer (diffusion-based purification) to cleanse sensory inputs and a System 2 Reasoning Verifier (counterfactual consistency checks) to detect anomalies in memory-driven planning. Extensive experiments on a mock e-commerce agent environment demonstrate that Visual Inception achieves about 85% Goal-Hit Rate (GHR), while CognitiveGuard reduces this risk to around 10% with configurable latency trade-offs (about 1.5s in lite mode to about 6.5s for full sequential verification), without quality degradation under our setup.