MAPLE-Guard: Memory-Aware Link Enforcement Against Memory-Link Poisoning in Multi-Agent Systems

2026-07-31

AI Summary

This work addresses the vulnerability of persistent memory in large language model–based multi-agent systems to memory poisoning attacks, wherein malicious content appears benign at write time but becomes harmful upon retrieval—a challenge that existing defenses struggle to detect. To counter this, the paper introduces MAPLE-Guard, the first defense framework extending protection from communication and prompting layers to the memory linkage layer. It deploys monitoring gates across critical stages of the memory lifecycle—including writing, retrieval, elevation, and cross-agent reuse—establishing a multi-layered defense that features risk memory isolation, unsafe retrieval filtering, and pre-sharing blocking of private memory. Experimental results demonstrate that MAPLE-Guard reduces attack success rates to 0.9% and 0.2% on the LongMemEval and AppWorld benchmarks, respectively, while achieving multi-agent defense success rates of 74.3% and 99.8%.

Abstract

LLM-based multi-agent systems (MAS) increasingly rely on persistent private and shared memories for long-horizon coordination. This memory layer improves continuity, but it also gives attackers a durable channel: a poisoned memory can be written once, continuously retrieved in later tasks, promoted into shared memory, and reused by other agents. A single poisoned write can therefore steer many later decisions and contaminate agents that never saw the original attack, all while no malicious message crosses a visible communication edge at the moment of harm. Further, because existing safeguards mainly inspect prompts, actions, or communication edges, they can miss attacks whose content appears benign at write time but becomes harmful after retrieval. We introduce Memory-Aware Propagation and Link Enforcement Guard, MAPLE-Guard, a memory-link guard for memory-enabled MAS. MAPLE-Guard monitors the memory lifecycle and places gates at write, retrieval, promotion, and cross-agent reuse, so risky memories can be quarantined, unsafe retrievals filtered, and poisoned private memories blocked before they enter shared memory. In the main evaluation, MAPLE-Guard lowers attack success rate (ASR) from 38.2% to 0.9% on LongMemEval and from 34.7% to 0.2% on AppWorld; it also raises multi-agent defense success rate (MDSR) from 54.0% to 74.3% and from 42.5% to 99.8% on the same benchmarks. These results suggest that memory-aware link enforcement covers a gap left by prompt-level and topology-level defenses. Code is available at the link: https://github.com/xiong-wenjun/MAPLE-Guard.

Problem

• memory-link poisoning
• multi-agent systems
• persistent memory
• LLM-based agents
• memory security

Innovation

• memory-aware security
• memory-link poisoning
• multi-agent systems
• LLM-based agents
• memory lifecycle enforcement