Memory poisoning attacks and defenses for memory-based LLM agents

The paper systematically evaluates memory poisoning attacks and defenses for memory-based LLM agents in electronic health record (EHR) scenarios. An attacker injects malicious instructions only through query interactions, contaminating the agent's long-term memory and affecting subsequent responses; previously, MINJA achieved an injection success rate exceeding 95% and an attack success rate of 70% under ideal conditions. Using MIMIC-III clinical data on GPT-4o-mini, Gemini-2.0-Flash, and Llama-3.1-8B-Instruct, the authors varied three dimensions—initial memory state, number of instruction prompts, and retrieval parameters—and found that attack effectiveness drops substantially under realistic conditions with legitimate memories present. The paper proposes two defense mechanisms: one is input-output auditing that combines multiple orthogonal signals into a composite trust score, and the other is trust-aware retrieval memory purification combining temporal decay with pattern filtering; evaluation shows that effective purification requires careful calibration of the trust threshold to avoid either over-conservatively rejecting all entries or under-filtering and missing covert attacks.