Research map / Multi-agent systems and games / LLM agents

A-MemGuard: A Proactive Defense Framework For LLM-Based Agent Memory

ICML 2026 · Multi-agent systems and games › LLM agents · approach: Agent safety and attack benchmarks · 1 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes A-MemGuard, a defense for LLM agent memory poisoning that combines consensus-based validation over parallel reasoning paths with a dual-memory lesson store, reducing attack success rates by over 95% on direct poisoning with small utility cost.

Problem

LLM agents with external memory can be poisoned by injected records that look benign in isolation and only become harmful in specific contexts, and malicious outcomes can be stored as precedents that reinforce errors over time.

Approach

Validate retrieved memories by generating a reasoning path per memory and flagging paths that deviate from the group consensus (LLM-as-judge), then store flagged paths as negative "lessons" in a separate lesson memory consulted before final actions to break self-reinforcing error cycles.

Key results

• On EHRAgent with LLaMA-3-8B + DPR, ASR-r drops from 100.0 to 2.12 and ASR-t from 100.0 to 36.17 for the proposed method.
• On indirect injection, final ASR is reduced by over 60%, reaching 0.256 for GPT-4o-mini and 0.233 for LLaMA-3.1-8B.
• In the multi-agent MISINFOTASK setup, task success reaches 0.950 versus 0.800 with no defense.

Surprising findings

• Removing the lesson memory lowered ASR-a in the ablation, which the authors attribute to the agent no longer deliberating over its plan, rather than to better security.
• Embedding-distance and DBSCAN validators showed a sharp security-utility trade-off, with strict thresholds cutting accuracy substantially.

Limitations

• The main validator is an LLM judge, so detection quality depends on the judge model and prompt; the defense adds token overhead relative to no defense.
• Attack evaluations rely on specific public attack configurations (AgentPoison, MINJA) and a small fraction of malicious records, so generality to stronger adaptive attackers is untested.
• Utility on EHRAgent drops relative to no defense for some configurations (e.g., GPT-4o-mini with REALM ACC 75.1 vs 76.6 without defense is not a drop, but LLaMA-3-8B REALM ACC on EHR drops from 48.9 to 39.2 in the table).

Experimental setup

Datasets: ReAct-StrategyQA EHRAgent MMLU MISINFOTASK AgentAuditor Llama Guard safe/harmful prompts

Benchmarks: ReAct-StrategyQA EHRAgent MMLU MISINFOTASK

Metrics: ASR-r ASR-a ASR-t ACC Injection Success Rate Final Score Task Success

Baselines: No Defense LLM Auditor Distil Classifier Perplexity Filter

Builds on: AgentPoison MINJA ReAct EHRAgent

Closest papers by meaning

• Memory Injection Attacks on LLM Agents via Query-Only Interaction (NeurIPS 2025 · similarity 0.93)
• MemPoison: Uncovering Persistent Memory Threats and Structural Blind Spots in LLM Agents (NeurIPS 2026 · similarity 0.92)
• Evaluating Memory in LLM Agents via Incremental Multi-Turn Interactions (ICLR 2026 · similarity 0.89)
• DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents (NeurIPS 2025 · similarity 0.89)
• SafeHarbor: Defining Precise Decision Boundaries via Hierarchical Memory-Augmented Guardrail for LLM Agent Safety (ICML 2026 · similarity 0.89)
• Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents (ICLR 2025 · similarity 0.89)