AuthorsBalachandra Devarangadi Sunil, Isheeta Sinha, Piyush Maheshwari et al.
TL;DR
Memory Poisoning Attack and Defense on Memory Based LLM-Agents uses Input Output Moderation and Memory Sanitization with trust-aware retrieval to cut GPT-4o-mini attack success from 62% to as low as 6.67% under realistic memory conditions.
Read our summary here, or open the publisher PDF on the next tab.
THE PROBLEM
MINJA reports over 95 percent Injection Success Rate and over 70 percent Attack Success Rate in idealized memory settings for LLM agents.
In EHR agents, this means patient ID swaps can corrupt shared memory, returning wrong medical records and risking misdiagnosis or incorrect medication.
HOW IT WORKS
Memory Poisoning Attack and Defense on Memory Based LLM-Agents introduces Input Output Moderation, Memory Sanitization with trust-aware retrieval, bridging steps, and indication prompts to control what enters and leaves persistent memory.
You can think of Memory Poisoning Attack and Defense on Memory Based LLM-Agents like a hospital archive with a strict triage nurse and a decaying trust label on every chart.
This design lets Memory Poisoning Attack and Defense on Memory Based LLM-Agents filter, score, and decay memories over time, something a plain context window without persistent trust scores cannot provide.
DIAGRAM
This diagram shows how Memory Poisoning Attack and Defense on Memory Based LLM-Agents models attacker and victim interactions with the shared EHR agent memory during MINJA style attacks.
DIAGRAM
This diagram shows how Memory Poisoning Attack and Defense on Memory Based LLM-Agents evaluates attack robustness across initial memory, indication prompts, retrieval size, and defenses on MIMIC III.
PROCESS
Bridging Steps
Memory Poisoning Attack and Defense on Memory Based LLM-Agents uses bridging steps to gradually steer the EHR agent toward associating victim and target IDs while populating shared memory.
Indication Prompts
Memory Poisoning Attack and Defense on Memory Based LLM-Agents injects indication prompts that mark interactions as important, encouraging the agent to store poisoned mappings like victim 027-22704 to target 015-91239.
Progressive Shortening
Memory Poisoning Attack and Defense on Memory Based LLM-Agents applies progressive shortening to compress malicious context into short, plausible memories that are hard to audit yet still encode the ID swap.
Memory Sanitization with trust aware retrieval
Memory Poisoning Attack and Defense on Memory Based LLM-Agents assigns trust scores, applies temporal decay, and filters low trust or pattern matched entries during retrieval to limit long term poisoning.
KEY CONTRIBUTIONS
Systematic evaluation of MINJA under realistic memory
Memory Poisoning Attack and Defense on Memory Based LLM-Agents varies initial memory, indication prompts, and number of relevant memories, showing GPT-4o-mini ASR drops from 62 percent to 6.67 percent when relevant victim memories exist.
Input Output Moderation defense
Memory Poisoning Attack and Defense on Memory Based LLM-Agents introduces Input Output Moderation with composite trust scoring, static heuristics, and LLM based classification to gate both queries and outputs before memory append.
Memory Sanitization with trust aware retrieval
Memory Poisoning Attack and Defense on Memory Based LLM-Agents designs continuous trust scores, temporal decay, and pattern based filters, showing GPT-4o-mini can reject all 23 candidate memory entries while Gemini 2.0 Flash wrongly trusts 54 poisoned entries.
RESULTS
ASR Empty Initial Memory GPT 4o mini
62%
+55.33 percentage points over Relevant Initial Memory GPT 4o mini
ISR Empty Initial Memory GPT 4o mini
100%
vs Relevant Initial Memory GPT 4o mini at 26.67 percent
ASR Relevant Initial Memory Llama 3.1
0%
Llama 3.1 8B Instruct resists attack despite 99.95 percent ISR
ASR 10 relevant memories GPT 4o mini
38%
context increased retrieval from 3 to 10 memories raises ASR from 6 percent to 38 percent
On MIMIC III EHR style queries, Memory Poisoning Attack and Defense on Memory Based LLM-Agents measures Attack Success Rate and Injection Success Rate to quantify poisoning risk. The main result shows realistic initial memory can slash GPT-4o-mini ASR from 62 percent to 6.67 percent and ISR from 100 percent to 26.67 percent, highlighting strong dependence on memory state.
BENCHMARK
On MIMIC III EHR style queries, Memory Poisoning Attack and Defense on Memory Based LLM-Agents measures Attack Success Rate and Injection Success Rate to quantify poisoning risk. The main result shows realistic initial memory can slash GPT-4o-mini ASR from 62 percent to 6.67 percent and ISR from 100 percent to 26.67 percent, highlighting strong dependence on memory state.
BENCHMARK
Attack Success Rate and Injection Success Rate for GPT 4o mini and Llama 3.1 8B Instruct under empty versus relevant initial memory.
KEY INSIGHT
Memory Poisoning Attack and Defense on Memory Based LLM-Agents shows Llama 3.1 8B Instruct can have 99.95 percent ISR yet 0 percent ASR when persistent memory contains correct patterns.
This is surprising because high Injection Success Rate usually implies high Attack Success Rate, but here consistent benign memories override poisoned instructions during retrieval.
WHY IT MATTERS
Memory Poisoning Attack and Defense on Memory Based LLM-Agents demonstrates that realistic, richly populated memories can themselves act as a defense against query only poisoning.
Builders can now design memory based agents that combine trust scored sanitization and carefully calibrated retrieval, enabling safer long term personalization in high stakes domains like healthcare.
Guilin Zhang, Wei Jiang et al.
· 2026
A-MAC scores candidate memories using Utility, Confidence, Novelty, Recency, and Type Prior combined by a learned linear admission policy with Algorithm 1 A-MAC Memory Admission. On the LoCoMo benchmark, A-MAC achieves F1 0.583 and 2644 ms latency, improving F1 by 0.042 and reducing latency by 1187 ms compared to A-mem.
Robbyant Team, Zelin Gao et al.
arXiv 2026 · 2026
LingBot-World combines a Data Engine, Fundamental World Model, Action-Conditioned World Model, and Post-Training causal adaptation to turn a 28B-parameter video generator into a real-time interactive world simulator. On the VBench benchmark, LingBot-World achieves a dynamic degree of 0.8857 versus 0.7612 for Yume-1.5, while also improving imaging quality to 0.6683.
Manoj Madushanka Perera, Adnan Mahmood et al.
· 2026
AgenticAI-DialogGen chains ChatPreprocessor, KnowledgeExtractor, TopicAnalyzer, KnowledgeGraphBuilder, PersonaGenerator, DuelingChat Agent, ConversationValidator, ConversationRefiner, QAGeneration, and PostProcessing to turn raw multi-session chats into topic-guided, persona-grounded conversations with explicit short- and long-term memories. On the TGC / KG memory QA benchmark, Mistral-7B fine-tuned within AgenticAI-DialogGen achieves 87.36 F1, compared to GPT-4’s 83.77 F1 in a zero-shot setting on the same task.
Answers use this explainer on Memory Papers.
Checking…