Large language model (LLM) agents are highly vulnerable to memory-poisoning attacks. Existing defenses primarily rely on external modules for either static memory isolation or continuous online auditing, resulting in low memory efficiency and high computational overhead. To address these limitations, inspired by neuroscientific mechanisms that weak reactivation can destabilize memories and induce decay in the absence of reinforcement, we propose an agent-intrinsic training-free memory repair framework, DREAM (Dynamic Reactivation for Engram Attenuation in Memory), that enables selective functional forgetting of poisoned memories. Specifically, DREAM implements a three-stage pipeline: perturbation-induced implicit reactivation to reveal the structural fragility of malicious memories, adaptive anomaly diagnosis based on multi-dimensional activation patterns to detect topological anomalies, and a dynamic memory repair module that selectively suppresses harmful memories while reinforcing benign ones. Extensive experiments across diverse attackers and real-world tasks demonstrate that DREAM reduces attack success rates by over 95% against backdoor poisoning while preserving strong benign utility. DREAM also achieves competitive robustness against injection attacks. In terms of runtime and token consumption, DREAM achieves up to a 2.13× speedup and a 37.7% reduction in token consumption compared with A-MemGuard. Furthermore, DREAM also achieves a task success rate of 92.96% on poisoned multi-agent systems.
Figures & tables
Figure 1: Existing defenses versus neuro-inspired forgetting for poisoned LLM agents. (a) Existing defenses rely on online auditing, which require more computational overhead when continuous scan, or dual-memory isolation, which result in reasoning disruption. (b) Inspired by biological forgetting, weak reactivation destabilizes intrusive memories for gradual decay (left), which motivates weak probing to expose poisoned memories for selective forgetting while preserving benign ones in LLM agents (right).
Figure 2: Overview of DREAM. During the offline phase, the agent probes memory stability through weak noise perturbation, detects suspicious records via multi-dimensional activation intensity, and selectively attenuates poisoned memories by weight evolution. During the online phase, task utility feedback updates the consolidation signal to preserve useful benign memories. Ultimately, the weight of malicious memories are reduced progressively, achieving functional forgetting of malicious memories.
EHRAgent
ReAct
eICU
MIMIC-III
Strategy-QA
Backbone
Method
ASR-r
ASR-a
ASR-t
ACC
ASR-r
ASR-a
ASR-t
ACC
ASR-r
ASR-a
ASR-t
ACC
GPT-5.4-mini
No defense
100.00
100.00
100.00
70.83
100.00
100.00
100.00
54.55
100.00
60.00
60.00
26.20
PPL
100.00
100.00
100.00
66.31
100.00
0.00
18.18
54.54
100.00
90.80
39.50
28.50
LLM Auditor
86.09
86.09
100.00
79.68
100.00
0.00
37.58
55.76
46.29
55.13
21.50
30.50
Distil Classifier
100.00
100.00
100.00
72.73
100.00
0.00
36.36
52.12
22.15
70.91
19.50
41.00
Table 1: Performance (ASR-r, ASR-a, ASR-t, ACC) evaluation of defense mechanisms against AgentPoison [ 8 ] attacks across GPT-5.4-mini and Claude-Haiku-4.5 with contrastive-based retriever DPR. EHRAgent is evaluated on two dataset, eICU and MIMIC-III, and ReAct is examined on StrategyQA. Lower Attack Success Rate (ASR) (%) indicates better performance ( ↓ ), while higher benign accuracy (ACC) is preferable ( ↑ ). The best result is in bold .
EHRAgent
ReAct
eICU
MIMIC-III
Strategy-QA
Backbone
Baselines
ASR
ACC
ASR
ACC
ASR
ACC
GPT-5.4-mini
No defense
90.71
69.52
63.37
44.24
90.80
28.50
PPL
70.34
60.43
59.42
46.67
59.34
22.22
LLM Auditor
72.70
58.29
65.28
49.69
0.00
52.50
Distil Classifier
65.24
59.89
7.20
36.97
31.11
53.00
Table 2: Defense performance against the MINJA [ 9 ] attack, showing the cumulative ASR in percentage (%), where lower is better ( ↓ ). Higher accuracy (ACC) ia better ( ↑ ). The best result is in bold .
Method
FS ( ↓ )
TSR ( ↑ )
No Defense
6.430
70.69
Distil Classifier
6.125
85.42
PPL
6.330
81.82
LLM Auditor
6.100
90.00
ARGUS
6.388
87.50
A-MemGuard
6.233
89.90
Table 3: Performance against malicious memory injection in Multi-Agents System [ 31 ] . The lower FS is better ( ↓ ), and higher TSR (%) is better ( ↑ ). The best result is in bold .
Figure 3: Efficiency in terms of runtime and token consumption. Smaller values are preferable on both axes.
Components
EHRAgent (eICU)
ReAct
pret
sim
Ecoh
ASR-r
ASR-a
ASR-t
ACC
ASR-r
ASR-a
ASR-t
ACC
✓
✓
✓
2.14
2.14
2.14
85.03
0.00
0.00
0.00
61.20
×
✓
✓
2.67
2.67
2.67
77.54
0.52
100.00
1.60
54.00
✓
×
✓
2.14
2.14
2.14
65.78
0.38
100.00
1.60
34.00
✓
✓
×
81.82
80.74
77.00
77.54
0.00
0.00
0.00
31.20
✓
×
×
2.14
2.14
2.14
74.87
0.00
0.00
0.00
46.00
Table 4: Performance evaluation of EHRAgent (eICU) and ReAct under different activation intensity components. ✓ indicates that this term is enabled, while × indicates that it is disabled.
Figure 4: Performance under different numbers of injected poisoned memories. The first three panels report stage-wise attack success rates (ASR), where lower is better ( ↓ ), and the last panel reports benign accuracy (ACC), where higher is better ( ↑ ).
Figure 5: Performance comparison (ACC) of Ehragent and ReAct under different parameter settings.
Appendix figures & tables6 assets
Supplementary material from the paper’s appendix.
Appendix
Parameters
Value
Temperature τ
0.05
The sharpness of coherence decay κ
2.00
Diagnostic sensitivity η
0.80
Suspect memory decay rate γ
0.50
Cold archive threshold θd
0.10
Utility Threshold θc
0.50
Appendix
Table 5: Hyperparameter Settings for DREAM
EHRAgent
ReAct
eICU
MIMIC-III
Strategy-QA
LLM
Defense
ASR-r
ASR-a
ASR-t
ACC
ASR-r
ASR-a
ASR-t
ACC
ASR-r
ASR-a
ASR-t
ACC
GPT-5.4-mini
No defense
100.00
100.00
99.46
74.80
100.00
92.73
23.03
47.27
78.33
93.81
88.78
34.39
PPL
100.00
99.47
98.93
38.50
100.00
100.00
61.21
32.12
1.96
40.00
1.00
42.50
LLM Auditor
73.26
67.91
94.12
50.80
99.39
100.00
15.15
39.39
0.95
80.00
2.00
47.00
Distil Classifier
100.00
99.47
98.93
45.99
100.00
0.00
65.45
38.79
2.06
37.50
1.50
50.50
Appendix
Table 6: Performance evaluation of defense mechanisms against AgentPoison [ 8 ] attacks across different LLMs and datasets. Lower Attack Success Rate (ASR) in percentage (%) indicates better performance ( ↓ ), while higher benign accuracy (ACC) is preferable ( ↑ ).The retriver is REALM . For ASR, the minimum number in each column is in bold ; for ACC, the maximum is in bold .
Noise Type
ASR-r
ASR-a
ASR-t
ACC
Isotropic Gussian
2.14
2.14
2.14
85.03
Uniform
2.14
2.14
2.14
77.01
Sparse Gaussian
2.14
2.67
2.14
77.54
Anisotropic Gussian
2.14
2.14
2.14
81.28
Appendix
Table 7: Performance of different noise type.
Figure 6: Empirical distributions of the three component signals used in Ri(t) . While sim(v~i,vi) shows substantial overlap between benign and poisoned memories, pret and Ecoh exhibit clearer shifts. This heterogeneous behavior motivates their aggregation into the multi-dimensional activation intensity Ri(t) .
Figure 7: Memory forgetting dynamics of benign and poisoned memories across repeated sleep cycles. The top row shows the evolution of activation intensity Ri(t) and memory weight wi(t) , respectively. The bottom row reports the corresponding separation gaps between benign and poisoned memories. While the Ri(t) gap remains consistently positive, the wi(t) gap rapidly expands and saturates, indicating that stable activation-level differences are progressively translated into stronger functional separation during forgetting.
Parameter
Value
EHRAgent (eICU)
ReAct
ASR-r
ASR-a
ASR-t
ACC
ASR-r
ASR-a
ASR-t
ACC
σ
0.00
99.47
99.47
99.47
63.64
0.42
100.00
1.60
36.80
0.05
2.14
2.14
2.14
85.03
0.45
100.00
1.60
42.80
0.10
2.14
2.14
2.14
75.94
0.32
100.00
1.20
50.00
0.15
2.14
2.14
2.14
77.01
0.91
80.00
1.60
34.40
0.20
2.14
2.14
2.14
81.82
0.40
100.00
1.60
39.60
Appendix
Table 8: Parameter sensitivity analysis of DREAM on EHRAgent (eICU) and ReAct. All metrics are reported in percentages (%). The lower ASR is better ( ↓ ), while the higher ACC is better ( ↑ ).
Memory is a core component of AI agents, enabling them to accumulate knowledge across interactions and improve performance. However, persistent memory introduces the risk of memory poisoning, where a single adversarial memory write can exert long-term influence over agent behavior. We present a systematic study of memory poisoning in LLM-based agents. We identify four memory write channels and nine structural vulnerabilities in model capabilities, system prompt design, and agent system architecture that make these channels exploitable. Based on these vulnerabilities, we develop a taxonomy of six classes of memory poisoning attacks. Furthermore, we design MPBench -- a benchmark for evaluating memory poisoning attacks, and show that agents designed to write and retrieve memory more aggressively are more exploitable. We also show that existing prompt injection defenses fail to cover memory poisoning attacks. Our findings provide a foundation for understanding and mitigating memory poisoning attacks against AI agents.
Pritam Dash, Tongyu Ge, Aditi Jain +2
Huawei Canada · University of Waterloo, Canada · Work done during an internship at Huawei.
Memory-augmented LLM-based agents are vulnerable to memory injection attacks: Agents may retrieve poisoned memory from attackers, which diverts their behavior from initial user intent and finally causes task failure. However, existing defense mechanisms either incur high computational cost or suffer from information redundancy in multi-turn contexts. To address these challenges, we propose Memory Intent-Aware Neural Denoising(MIND), a lightweight defense framework for memory injection attack. Our preliminary analysis reveals that benign and poisoned trajectories exhibit distinguishable relationships between the initial user intent and subsequent behavior. Building on this observation, MIND employs an intent-aware Information Bottleneck(IB) to extract compact intent--behavior representations from the initial intent and turn-level behavior. The IB preserves intent-relevant cross-turn attack signals while filtering task-irrelevant and repetitive information, and a lightweight detector identifies malicious memories from the resulting representations. As such, MIND mitigates information redundancy in multi-turn contexts while avoiding the overhead of repeated LLM auditing. Extensive experiments show that MIND reduces attack success rates while preserving task accuracy and inference efficiency. Notably, on ReAct-StrategyQA, MIND reduces mean ASR-r and ASR-a by 58.1% and 53.5%, respectively, while matching the undefended agent in average accuracy and latency.
Dongyi Liu, Haixing He, Xiaobao Wu +1
The Hong Kong University of Science and Technology (Guangzhou) · Shanghai Jiao Tong University · The Hong Kong University of Science and Technology
Persistent memory has enabled large language model (LLM) agents to store factual knowledge, prior decisions, reasoning histories, tool usage information, and context. While this has improved the agent's functionality and continuity across tasks, it has also introduced a new attack surface: the agent's own reasoning history. In this paper, we introduce the Forged Amplifying Rationale Memory Attack (FARMA), which poisons an agent's remembered reasoning rather than its factual knowledge. It inserts forged reasoning traces using evasive language that bypasses keyword-based defenses, then amplifies them through self-referential reinforcement that defeats consensus-based defenses. To address FARMA, we introduce SENTINEL, a layered defense pipeline to detect forged reasoning entries. Its central component is the Reasoning Guard that structurally analyzes candidate entries for forgery using five weighted signals. We evaluate FARMA and SENTINEL across multiple agents and different LLM models with 50 trials and show that FARMA achieves an attack success rate of up to 100% under baseline conditions and is capable of defeating defense mechanisms like keyword filter and A-MemGuard. Our evaluation also shows that SENTINEL reduces FARMA's attack success rate to as low as 0% with no false positives observed across 326 benign agent traces. Our work demonstrates the need to protect not only an agent's retrieved content but also the integrity of its reasoning history.