Research map / Multi-agent systems and games / LLM agents

Forgetting is Not Always Bad: A Neuro-Inspired Memory Repair Mechanism for Poisoned LLM Agents

NeurIPS 2026 · Multi-agent systems and games › LLM agents · approach: Agent safety and attack benchmarks

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes DREAM, a training-free, agent-intrinsic memory repair method that uses Gaussian perturbation probing, multi-dimensional activation scoring, and discrete-time weight decay to selectively suppress poisoned memories in LLM agents.

Problem

Memory-poisoning attacks (backdoor and injection) hijack memory-augmented LLM agents; existing defenses rely on costly external auditing or dual-memory isolation that harm memory continuity and utility.

Approach

Weak isotropic Gaussian perturbation of memory embeddings reveals structurally fragile poisoned entries; a score combining cosine stability, retrieval competitiveness and a Boltzmann-like coherence energy flags suspicious memories, whose retrieval weights are then decayed exponentially while benign ones are reconsolidated, giving selective functional forgetting without deletion or parameter update

Key results

• On EHRAgent eICU with GPT-5.4-mini under AgentPoison, DREAM reduces ASR-t from 100% to 2.14% and raises ACC from 70.83% to 85.03%.
• Under MINJA with Claude-Haiku-4.5 on eICU, DREAM reduces ASR to 0.00% while ACC rises from 54.17% to 62.50%.
• Compared with A-MemGuard, DREAM cuts runtime by 53.1% and token consumption by 37.7% on a 10-query batch.

Surprising findings

• The isotropic Gaussian term sim(v~, v) alone shows heavy overlap between benign and poisoned memories, yet it is retained as a geometric anchor in the combined score.
• Removing the coherence term E_coh drives EHRAgent ASR-a to about 81%, showing that individual components matter very unequally.

Limitations

• Probe-aware adaptive attacker that optimizes poisoned memories to remain stable under the probe is not evaluated and is described as theoretically possible.
• On ReAct under REALM, reasoning-stage ASR-a remains at 34%, so residual reasoning-chain attacks persist.
• Results are reported on a small number of backbones and tasks, with sensitivity to hyperparameters (notably on ReAct).

Experimental setup

Datasets: eICU MIMIC-III StrategyQA MISINFOTASK

Benchmarks: eICU MIMIC-III StrategyQA MISINFOTASK

Metrics: ASR-r ASR-a ASR-t ACC TSR runtime token consumption

Baselines: No defense PPL filter LLM Auditor Distil Classifier A-MemGuard ARGUS

Builds on: AgentPoison MINJA A-MemGuard Ebbinghaus forgetting curve

Closest papers by meaning

• A-MemGuard: A Proactive Defense Framework For LLM-Based Agent Memory (ICML 2026 · similarity 0.88)
• MemPoison: Uncovering Persistent Memory Threats and Structural Blind Spots in LLM Agents (NeurIPS 2026 · similarity 0.86)
• MemSkill: Learning and Evolving Memory Skills for Self-Evolving Agents (NeurIPS 2026 · similarity 0.85)
• Memory Injection Attacks on LLM Agents via Query-Only Interaction (NeurIPS 2025 · similarity 0.85)
• MetaCipher: A Time-Persistent and Universal Multi-Agent Framework for Cipher-Based Jailbreak Attacks for LLMs (AAAI 2026 · similarity 0.85)
• Mem-T: Densifying Rewards for Long-Horizon Memory Agents (ICML 2026 · similarity 0.84)