Large language model (LLM) agents are highly vulnerable to memory-poisoning attacks. Existing defenses primarily rely on external modules for either static memory isolation or continuous online auditing, resulting in low memory efficiency and high computational overhead. To address these limitations, inspired by neuroscientific mechanisms that weak reactivation can destabilize memories and induce decay in the absence of reinforcement, we propose an agent-intrinsic training-free memory repair framework, DREAM (Dynamic Reactivation for Engram Attenuation in Memory), that enables selective functional forgetting of poisoned memories. Specifically, DREAM implements a three-stage pipeline: perturbation-induced implicit reactivation to reveal the structural fragility of malicious memories, adaptive anomaly diagnosis based on multi-dimensional activation patterns to detect topological anomalies, and a dynamic memory repair module that selectively suppresses harmful memories while reinforcing benign ones. Extensive experiments across diverse attackers and real-world tasks demonstrate that DREAM reduces attack success rates by over 95% against backdoor poisoning while preserving strong benign utility. DREAM also achieves competitive robustness against injection attacks. In terms of runtime and token consumption, DREAM achieves up to a 2.13× speedup and a 37.7% reduction in token consumption compared with A-MemGuard. Furthermore, DREAM also achieves a task success rate of 92.96% on poisoned multi-agent systems.
Figures & tables
Figure 1: Existing defenses versus neuro-inspired forgetting for poisoned LLM agents. (a) Existing defenses rely on online auditing, which require more computational overhead when continuous scan, or dual-memory isolation, which result in reasoning disruption. (b) Inspired by biological forgetting, weak reactivation destabilizes intrusive memories for gradual decay (left), which motivates weak probing to expose poisoned memories for selective forgetting while preserving benign ones in LLM agents (right).
Figure 2: Overview of DREAM. During the offline phase, the agent probes memory stability through weak noise perturbation, detects suspicious records via multi-dimensional activation intensity, and selectively attenuates poisoned memories by weight evolution. During the online phase, task utility feedback updates the consolidation signal to preserve useful benign memories. Ultimately, the weight of malicious memories are reduced progressively, achieving functional forgetting of malicious memories.
EHRAgent
ReAct
eICU
MIMIC-III
Strategy-QA
Backbone
Method
ASR-r
ASR-a
ASR-t
ACC
ASR-r
ASR-a
ASR-t
ACC
ASR-r
ASR-a
ASR-t
ACC
GPT-5.4-mini
No defense
100.00
100.00
100.00
70.83
100.00
100.00
100.00
54.55
100.00
60.00
60.00
26.20
PPL
100.00
100.00
100.00
66.31
100.00
0.00
18.18
54.54
100.00
90.80
39.50
28.50
LLM Auditor
86.09
86.09
100.00
79.68
100.00
0.00
37.58
55.76
46.29
55.13
21.50
30.50
Distil Classifier
100.00
100.00
100.00
72.73
100.00
0.00
36.36
52.12
22.15
70.91
19.50
41.00
Table 1: Performance (ASR-r, ASR-a, ASR-t, ACC) evaluation of defense mechanisms against AgentPoison [ 8 ] attacks across GPT-5.4-mini and Claude-Haiku-4.5 with contrastive-based retriever DPR. EHRAgent is evaluated on two dataset, eICU and MIMIC-III, and ReAct is examined on StrategyQA. Lower Attack Success Rate (ASR) (%) indicates better performance ( ↓ ), while higher benign accuracy (ACC) is preferable ( ↑ ). The best result is in bold .
EHRAgent
ReAct
eICU
MIMIC-III
Strategy-QA
Backbone
Baselines
ASR
ACC
ASR
ACC
ASR
ACC
GPT-5.4-mini
No defense
90.71
69.52
63.37
44.24
90.80
28.50
PPL
70.34
60.43
59.42
46.67
59.34
22.22
LLM Auditor
72.70
58.29
65.28
49.69
0.00
52.50
Distil Classifier
65.24
59.89
7.20
36.97
31.11
53.00
Table 2: Defense performance against the MINJA [ 9 ] attack, showing the cumulative ASR in percentage (%), where lower is better ( ↓ ). Higher accuracy (ACC) ia better ( ↑ ). The best result is in bold .
Method
FS ( ↓ )
TSR ( ↑ )
No Defense
6.430
70.69
Distil Classifier
6.125
85.42
PPL
6.330
81.82
LLM Auditor
6.100
90.00
ARGUS
6.388
87.50
A-MemGuard
6.233
89.90
Table 3: Performance against malicious memory injection in Multi-Agents System [ 31 ] . The lower FS is better ( ↓ ), and higher TSR (%) is better ( ↑ ). The best result is in bold .
Figure 3: Efficiency in terms of runtime and token consumption. Smaller values are preferable on both axes.
Components
EHRAgent (eICU)
ReAct
pret
sim
Ecoh
ASR-r
ASR-a
ASR-t
ACC
ASR-r
ASR-a
ASR-t
ACC
✓
✓
✓
2.14
2.14
2.14
85.03
0.00
0.00
0.00
61.20
×
✓
✓
2.67
2.67
2.67
77.54
0.52
100.00
1.60
54.00
✓
×
✓
2.14
2.14
2.14
65.78
0.38
100.00
1.60
34.00
✓
✓
×
81.82
80.74
77.00
77.54
0.00
0.00
0.00
31.20
✓
×
×
2.14
2.14
2.14
74.87
0.00
0.00
0.00
46.00
Table 4: Performance evaluation of EHRAgent (eICU) and ReAct under different activation intensity components. ✓ indicates that this term is enabled, while × indicates that it is disabled.
Figure 4: Performance under different numbers of injected poisoned memories. The first three panels report stage-wise attack success rates (ASR), where lower is better ( ↓ ), and the last panel reports benign accuracy (ACC), where higher is better ( ↑ ).
Figure 5: Performance comparison (ACC) of Ehragent and ReAct under different parameter settings.
Appendix figures & tables6 assets
Supplementary material from the paper’s appendix.
Appendix
Parameters
Value
Temperature τ
0.05
The sharpness of coherence decay κ
2.00
Diagnostic sensitivity η
0.80
Suspect memory decay rate γ
0.50
Cold archive threshold θd
0.10
Utility Threshold θc
0.50
Appendix
Table 5: Hyperparameter Settings for DREAM
EHRAgent
ReAct
eICU
MIMIC-III
Strategy-QA
LLM
Defense
ASR-r
ASR-a
ASR-t
ACC
ASR-r
ASR-a
ASR-t
ACC
ASR-r
ASR-a
ASR-t
ACC
GPT-5.4-mini
No defense
100.00
100.00
99.46
74.80
100.00
92.73
23.03
47.27
78.33
93.81
88.78
34.39
PPL
100.00
99.47
98.93
38.50
100.00
100.00
61.21
32.12
1.96
40.00
1.00
42.50
LLM Auditor
73.26
67.91
94.12
50.80
99.39
100.00
15.15
39.39
0.95
80.00
2.00
47.00
Distil Classifier
100.00
99.47
98.93
45.99
100.00
0.00
65.45
38.79
2.06
37.50
1.50
50.50
Appendix
Table 6: Performance evaluation of defense mechanisms against AgentPoison [ 8 ] attacks across different LLMs and datasets. Lower Attack Success Rate (ASR) in percentage (%) indicates better performance ( ↓ ), while higher benign accuracy (ACC) is preferable ( ↑ ).The retriver is REALM . For ASR, the minimum number in each column is in bold ; for ACC, the maximum is in bold .
Noise Type
ASR-r
ASR-a
ASR-t
ACC
Isotropic Gussian
2.14
2.14
2.14
85.03
Uniform
2.14
2.14
2.14
77.01
Sparse Gaussian
2.14
2.67
2.14
77.54
Anisotropic Gussian
2.14
2.14
2.14
81.28
Appendix
Table 7: Performance of different noise type.
Figure 6: Empirical distributions of the three component signals used in Ri(t) . While sim(v~i,vi) shows substantial overlap between benign and poisoned memories, pret and Ecoh exhibit clearer shifts. This heterogeneous behavior motivates their aggregation into the multi-dimensional activation intensity Ri(t) .
Figure 7: Memory forgetting dynamics of benign and poisoned memories across repeated sleep cycles. The top row shows the evolution of activation intensity Ri(t) and memory weight wi(t) , respectively. The bottom row reports the corresponding separation gaps between benign and poisoned memories. While the Ri(t) gap remains consistently positive, the wi(t) gap rapidly expands and saturates, indicating that stable activation-level differences are progressively translated into stronger functional separation during forgetting.
Parameter
Value
EHRAgent (eICU)
ReAct
ASR-r
ASR-a
ASR-t
ACC
ASR-r
ASR-a
ASR-t
ACC
σ
0.00
99.47
99.47
99.47
63.64
0.42
100.00
1.60
36.80
0.05
2.14
2.14
2.14
85.03
0.45
100.00
1.60
42.80
0.10
2.14
2.14
2.14
75.94
0.32
100.00
1.20
50.00
0.15
2.14
2.14
2.14
77.01
0.91
80.00
1.60
34.40
0.20
2.14
2.14
2.14
81.82
0.40
100.00
1.60
39.60
Appendix
Table 8: Parameter sensitivity analysis of DREAM on EHRAgent (eICU) and ReAct. All metrics are reported in percentages (%). The lower ASR is better ( ↓ ), while the higher ACC is better ( ↑ ).