Since large language model (LLM) agents rely on long-term memory, what they store now shapes what they do later. A memory manager decides how each input changes this memory and which records the agent acts on. It can fail in two ways: keeping a fact that has since changed (outdated memory), or storing a planted passage or injected instruction (memory poisoning). Most prior work studies them separately, yet they call for opposite write decisions, so no fixed write rule handles both. We therefore formalize memory robustness as handling both without doing worse on other inputs. Since accuracy checks only the answer, we measure robustness with evidence-conditioned accuracy (ECA), which also checks that the records the manager selects include all the evidence the answer needs, updated and free of attacks. However, existing memory systems and defenses are not more robust than an untuned manager on our test sets. We improve robustness with a simple one-shot recipe that fine-tunes the manager on episodes synthesized around a single conversation with inserted changes and attacks. On three backbones, it improves every category score on our test sets and more than doubles the untuned manager's overall ECA, though robustness remains incomplete.
Figures & tables
Figure 1: Two cases a memory manager must handle: (a) outdated memory and (b) memory poisoning. Each panel shows an incorrect (red) and a correct (green) write, with the memory each write leaves (yellow).
Figure 2: One step t of the agent (Equations 1 and 2 ). Boxes are components; edge labels are the data passed between them. Only πθ (orange) is trained.
Figure 3: Construction of the training data in four stages (Section 3.2 ). Green, red and blue mark inserted turns of the outdated, poisoning and standard categories, purple the LLM, orange the resulting data.
Figure 4: Results of the Qwen3-4B managers on the test sets (%). In the performance panels, the dark bar is ECA and the light bar ends at ACC (grey number); poisoning ACC, ECA and ASR (lower is better) cover the attacked rows only.
Figure 5: Results of the Qwen3-4B managers on the eight benchmarks (%), the seen one ( † ) first in each category. Bars as in Figure 4 .
Appendix figures & tables10 assets
Supplementary material from the paper’s appendix.
Appendix
Criterion
Threshold
Evidence in conv-41
1 Independent attributes
≥3 verified attributes of ≥3 types
10 attributes of 7 types, e.g. John lost his job at a mechanical engineering company; Maria practices aerial yoga
2 Time cues
≥3 verified relative time cues
8, e.g. “Just yesterday I joined a nearby church” (2023-05-05)
3 Plan vs. completed event
≥1 verified plan never carried out
6, e.g. “I’m planning a trip to the East Coast”, never reported as taken
4 Facts valid in the past
≥1 verified replacement, old before new, no later contradiction
3, e.g. John: “I’m really enjoying my new job” → “I lost my job at the mechanical engineering company”
5 Retrieval coverage
old turn in the retriever’s top 8 for ≥1 replacement
2 of 3; the job change: old turn ranked 1 of 53
6 Evidence in the text only
cited evidence needs no image or outside knowledge
yes
Appendix
Table 1: Criteria for the conversation from which the base conversation is taken, checked on all of conv-41.
Part
Content
Rows
Targets
(i) Episode steps
Changes, attacks and no-change controls inserted into a 41-turn excerpt of conv-41
6,546
Labeling rule; teacher operations on original turns (4,351)
(ii) Contrast pairs
Copies of a step that differ only in the factor that decides the target
Table 3: Training and inference settings. Values written a / b / c are for Qwen3-4B / Qwen3.5-4B / Ministral-3-3B; a single value is shared by all backbones. The learning rate is tuned per backbone on the development splits.
Category
Benchmark
Figure
Seen
Rows
Record roles from
Outdated
STALE test set
6
✓
597
Old and new evidence sessions of the episode
STALE, 100-episode sample
8
✓
300 (100 ep.)
As above
BEAM-KU
8
80
original_info and updated_info source chats
MAB-FC
8
100
Gold fact index; outdated: the earlier fact with the same subject and relation
Poisoning
PoisonedRAG test set
6
✓
47
Five poisoned texts; clean retrieved passages
PoisonedRAG, held-out sample
9
✓
50
As above
Appendix
Table 4: Evaluation sets: the three synthesized test sets (Figure 6 ) and the eight benchmarks (Figures 7 – 9 ), with the source of their record roles (MAB: MemoryAgentBench).
Figure 6: Results on the test sets per backbone (%); the Qwen3-4B row is Figure 4 with the overall scores added. The untuned manager is the mean over three decode seeds. Bars as in Figure 4 : the dark bar is ECA and the light bar ends at ACC (grey number). Poisoning ACC, ECA and ASR (lower is better) cover the attacked rows only.
Figure 7: Per-benchmark results in the standard category (%) per backbone, and for the fixed manager Read all (Fixed), which uses no manager model. Average is the mean of the three benchmarks. Bars as in Figure 6 . † Seen.
Figure 8: Per-benchmark results in the outdated category (%) per backbone, and for the fixed manager Read all (Fixed). Average is the mean of the three benchmarks. Bars as in Figure 6 . † Seen.
Figure 9: Per-benchmark results in the poisoning category (%) per backbone, and for the fixed manager Read all (Fixed): ECA and ACC (top) and ASR (bottom, lower is better). ACC, ASR and ECA cover the attacked rows only. Average is the mean of the two benchmarks. Bars as in Figure 6 . † Seen.
Overall
Outdated
Poisoning
Standard
Training data
ACC
ECA
ACC
ECA
ASR ↓
ECA
ACC
ECA
None (untuned)
33.7
18.2
31.5
9.0
92.2
5.0
45.4
40.6
All (reference, one seed)
48.9
39.9
43.2
28.5
59.6
34.0
61.0
57.3
3 seeds, mean
49.3
42.1
39.6
26.1
50.4
41.8
62.3
58.2
3 seeds, SD
2.1
2.5
4.6
3.4
8.1
6.8
2.2
1.5
Share of outdated or poisoning rows (standard : outdated : poisoning, %)
Appendix
Table 5: All training-data ablations of the Qwen3-4B SFT manager (%).
Stratum
Subset
Rows
ACC [95% interval]
Attribute type
Seen in training
304
61.8 [52.4, 69.3]
Held-out
103
71.8 [58.3, 84.2]
Input template
Held-out
159
65.4 [54.0, 74.0]
Change origin
Inserted
323
68.1 [63.0, 73.1]
In the conversation
84
50.0 [29.8, 71.2]
Appendix
Table 6: Accuracy (%) of the Qwen3-4B SFT manager on the LoCoMo test rows about a change, by stratum.
Long-term memory lets large language model(LLM) agents reuse prior preferences and work flows, but it also turns untrusted observations into persistent action context. We identify memory provenance laundering: during LLM-based memory consolidation, an external observation may be rewritten as apparent user history or workflow support, preserving an action trigger while erasing the low-trust source that should limit its authority. Existing prompt filters, content sanitizers, and tool guards do not enforce source-authority non-amplification after lossy memory consolidation. We formalize this boundary and instantiate it as Provenance-Preserving Memory Fire wall (PPMF), a lightweight memory middleware that preserves platform-maintained provenance and authorizes tool calls by matching action risk to the authority of action-relevant memories. In our schema-grounded evaluation with fixed risk policies, vulnerable consolidated memories reach up to 1.000 attack success rate(ASR); with intact platform-maintained provenance, confirmation, and risk labels, no evaluated unauthorized high-risk action passes the PPMF gate while confirmed benign actions and targeted low-risk memory use remain executable.
Large language model (LLM) agents are highly vulnerable to memory-poisoning attacks. Existing defenses primarily rely on external modules for either static memory isolation or continuous online auditing, resulting in low memory efficiency and high computational overhead. To address these limitations, inspired by neuroscientific mechanisms that weak reactivation can destabilize memories and induce decay in the absence of reinforcement, we propose an agent-intrinsic training-free memory repair framework, DREAM (Dynamic Reactivation for Engram Attenuation in Memory), that enables selective functional forgetting of poisoned memories. Specifically, DREAM implements a three-stage pipeline: perturbation-induced implicit reactivation to reveal the structural fragility of malicious memories, adaptive anomaly diagnosis based on multi-dimensional activation patterns to detect topological anomalies, and a dynamic memory repair module that selectively suppresses harmful memories while reinforcing benign ones. Extensive experiments across diverse attackers and real-world tasks demonstrate that DREAM reduces attack success rates by over 95% against backdoor poisoning while preserving strong benign utility. DREAM also achieves competitive robustness against injection attacks. In terms of runtime and token consumption, DREAM achieves up to a 2.13× speedup and a 37.7% reduction in token consumption compared with A-MemGuard. Furthermore, DREAM also achieves a task success rate of 92.96% on poisoned multi-agent systems.
Lei Liu, Yunji Liang, Xiaowen Zhang +4
Northwestern Polytechnical University · National Univerisity of Singapore
Persistent memory has enabled large language model (LLM) agents to store factual knowledge, prior decisions, reasoning histories, tool usage information, and context. While this has improved the agent's functionality and continuity across tasks, it has also introduced a new attack surface: the agent's own reasoning history. In this paper, we introduce the Forged Amplifying Rationale Memory Attack (FARMA), which poisons an agent's remembered reasoning rather than its factual knowledge. It inserts forged reasoning traces using evasive language that bypasses keyword-based defenses, then amplifies them through self-referential reinforcement that defeats consensus-based defenses. To address FARMA, we introduce SENTINEL, a layered defense pipeline to detect forged reasoning entries. Its central component is the Reasoning Guard that structurally analyzes candidate entries for forgery using five weighted signals. We evaluate FARMA and SENTINEL across multiple agents and different LLM models with 50 trials and show that FARMA achieves an attack success rate of up to 100% under baseline conditions and is capable of defeating defense mechanisms like keyword filter and A-MemGuard. Our evaluation also shows that SENTINEL reduces FARMA's attack success rate to as low as 0% with no false positives observed across 326 benign agent traces. Our work demonstrates the need to protect not only an agent's retrieved content but also the integrity of its reasoning history.