Search papers, labs, and topics across Lattice.
This paper introduces MIND, a lightweight defense framework designed to protect memory-augmented LLM agents from memory injection attacks. By leveraging an intent-aware Information Bottleneck, MIND effectively distinguishes between benign and poisoned memory trajectories, filtering out task-irrelevant information while preserving critical intent-relevant signals. Experimental results demonstrate that MIND significantly reduces attack success rates by over 55% without compromising task accuracy or inference efficiency.
MIND cuts memory injection attack success rates by more than half while maintaining performance, redefining the defense landscape for LLM agents.
Memory-augmented LLM-based agents are vulnerable to memory injection attacks: Agents may retrieve poisoned memory from attackers, which diverts their behavior from initial user intent and finally causes task failure. However, existing defense mechanisms either incur high computational cost or suffer from information redundancy in multi-turn contexts. To address these challenges, we propose Memory Intent-Aware Neural Denoising(MIND), a lightweight defense framework for memory injection attack. Our preliminary analysis reveals that benign and poisoned trajectories exhibit distinguishable relationships between the initial user intent and subsequent behavior. Building on this observation, MIND employs an intent-aware Information Bottleneck(IB) to extract compact intent--behavior representations from the initial intent and turn-level behavior. The IB preserves intent-relevant cross-turn attack signals while filtering task-irrelevant and repetitive information, and a lightweight detector identifies malicious memories from the resulting representations. As such, MIND mitigates information redundancy in multi-turn contexts while avoiding the overhead of repeated LLM auditing. Extensive experiments show that MIND reduces attack success rates while preserving task accuracy and inference efficiency. Notably, on ReAct-StrategyQA, MIND reduces mean ASR-r and ASR-a by 55.4% and 55.3%, respectively, while matching the undefended agent in average accuracy and latency.
