MIND: Lightweight and Effective Memory Injection Defense for LLM Agents via Intent-Aware Information Bottleneck

2026-07-30

AI Summary

This work addresses the vulnerability of large language model agents to memory injection attacks in memory-augmented settings, which can cause deviation from the user’s original intent and lead to task failure. The authors propose MIND, a novel framework that, for the first time, reveals the distinguishability between benign and poisoned trajectories based on their intent–behavior relationships. MIND introduces an intent-aware information bottleneck to extract compact representations from multi-turn interactions, preserving attack signals while filtering out redundancy. Coupled with a lightweight malicious memory detector, it enables efficient denoising and low-overhead defense. Experiments on ReAct-StrategyQA show that MIND reduces attack success rates (ASR-r and ASR-a) by 55.4% and 55.3%, respectively, while maintaining task accuracy and inference latency comparable to undefended agents.

Abstract

Memory-augmented LLM-based agents are vulnerable to memory injection attacks: Agents may retrieve poisoned memory from attackers, which diverts their behavior from initial user intent and finally causes task failure. However, existing defense mechanisms either incur high computational cost or suffer from information redundancy in multi-turn contexts. To address these challenges, we propose Memory Intent-Aware Neural Denoising(MIND), a lightweight defense framework for memory injection attack. Our preliminary analysis reveals that benign and poisoned trajectories exhibit distinguishable relationships between the initial user intent and subsequent behavior. Building on this observation, MIND employs an intent-aware Information Bottleneck(IB) to extract compact intent--behavior representations from the initial intent and turn-level behavior. The IB preserves intent-relevant cross-turn attack signals while filtering task-irrelevant and repetitive information, and a lightweight detector identifies malicious memories from the resulting representations. As such, MIND mitigates information redundancy in multi-turn contexts while avoiding the overhead of repeated LLM auditing. Extensive experiments show that MIND reduces attack success rates while preserving task accuracy and inference efficiency. Notably, on ReAct-StrategyQA, MIND reduces mean ASR-r and ASR-a by 55.4% and 55.3%, respectively, while matching the undefended agent in average accuracy and latency.

Problem

• memory injection attack
• LLM agents
• information redundancy
• computational overhead
• user intent deviation

Innovation

• Memory Injection Defense
• Intent-Aware Information Bottleneck
• LLM Agents
• Lightweight Detection
• Multi-turn Context Denoising