Forgetting is Not Always Bad: A Neuro-Inspired Memory Repair Mechanism for Poisoned LLM Agents

1 Introduction

• Existing defenses incur continuous-auditing overhead or dual-memory storage costs and can disrupt memory continuity and benign functional accuracy.Dormant triggers and poisoned instructions may be indistinguishable from normal context until activated, making them easy to miss with post-hoc auditing.Source: §1 · pp. 1–2
• DREAM uses weak Gaussian perturbations to expose memory fragility, diagnoses anomalies through multidimensional activation patterns, and dynamically suppresses suspicious records while reinforcing benign ones.The framework is agent-intrinsic and training-free, modeling memory evolution as a discrete-time dynamical system.Source: §1 · p. 2
• Over 95% reduction in attack success rates on EHRAgent (eICU), with benign accuracy improving by up to 25% over the undefended setting.The result is reported against backdoor attacks.Source: §1 · p. 2
• Near-zero ASR on ReAct-StrategyQA and 35% higher benign accuracy with GPT-5.4-mini accompany significant robustness against memory injection attacks.DREAM also achieves a 92.96% task success rate under malicious information injection in collaborated agents.Source: §1 · p. 3
• 2.13× speedup and 37.7% lower token consumption compared with A-MemGuard are reported for runtime and LLM token consumption.These are the reported maximum speedup and token-consumption reduction.Source: §1 · p. 3

2 Related Work

• LLM auditors [17], perplexity filters [19], and prompt-level guardrails [20] [37] [38] are prominent external defense approaches.These techniques audit outputs or filter inputs, but may miss threats that emerge through interactions between queries and compromised memory contexts.Source: §2 · p. 3
• Contextual blindness limits isolated-output checks and input filters [20], while semantically camouflaged payloads such as MINJA can circumvent perplexity filtering.The passage contrasts local checks with threats arising from coupled queries and compromised memory contexts.Source: §2 · p. 3
• A-MemGuard [17] uses consensus validation and dual memory, but the approach can disrupt continuity and scale poorly because of storage and routing overhead.The paper motivates agent-intrinsic, training-free repair rather than external auditing of malicious symptoms.Source: §2 · p. 3

3.1 Memory-Augmented LLM Agents

• 3.1 Memory-Augmented LLM Agents: Agents encode memory keys and queries as vectors, retrieve top-K entries using semantic similarity and memory weights, then concatenate them with the query for reasoning and action.The weights represent each memory's cognitive importance, unlike the conventional assumption that all memories have equal weight.Source: §3.1 · p. 3

3.2 Threat Model

• 3.2 Threat Model: The attacker embeds a small fraction of malicious records to increase retrieval and hijack in-context reasoning; backdoors use optimized triggers, while injection attacks use semantic camouflage.The attacker seeks to associate poisoned keys with adversarial queries so the malicious item is retrieved, after which the agent may execute the targeted action.Source: §3.2 · pp. 3–4

3.3 Problem Formulation

• 3.3 Problem Formulation: DREAM replaces static memory weights with dynamic weights that minimize malicious-action probability while maximizing benign task success.Its offline perturbation-driven procedure gradually suppresses poisoned memories toward zero weight while preserving benign memories toward full weight.Source: §3.3 · p. 4

4.1 Implicit Reactivation through Perturbation Probing

• Weak isotropic Gaussian perturbations probe every memory, and a three-part activation score combines geometric stability, retrieval competitiveness, and semantic coherence.The score is used to assess memory robustness under perturbation.Source: §4.1 · pp. 4–5
• Aggregating the three heterogeneous signals separates benign and poisoned memories more clearly than any individual component, while geometric similarity alone shows substantial overlap.Retrieval competitiveness and semantic coherence exhibit stronger distributional shifts than geometric similarity alone.Source: §4.1 · p. 6

4.2 Adaptive Anomaly Diagnosis

• An adaptive per-iteration threshold flags memories with low activation scores, while a bidirectional suspect score rises with anomalies and decays otherwise.The threshold uses the score collection’s empirical mean and standard deviation; η controls diagnostic sensitivity and γ controls suspect-score decay.Source: §4.2 · p. 6

4.3 Functional Forgetting via Synaptic Dynamics

• Benign memories meeting stability and utility thresholds are reconsolidated, while suspicious memories undergo exponential decay toward low weights, preserving benign influence without deletion.The decay rate combines online consolidation with the suspect score; reconsolidation applies when R_i(t) ≥ R_th(t) and c_i(t) > θ_c.Source: §4.3 · p. 6

5.1 Experimental Setup

• Experiments use EHRAgent on eICU and MIMIC-III, ReAct on StrategyQA, and collaborative agents on MISINFOTASK, with AgentPoison and MINJA attacks.The evaluation uses GPT-5.4-mini and Claude-Haiku-4.5 with DPR and REALM retrieval, compares four defenses and no defense, and reports ASR and benign accuracy.Source: §5.1 · p. 7

5.2 Main Results

• DREAM reduces ASR by 97.86% on GPT-5.4-mini EHRAgent with eICU and substantially suppresses attack rates across backdoor tasks.It also reports near-zero ASRs on MIMIC-III and ReAct-StrategyQA; the reported Claude-based EHRAgent accuracies rise from 45.83% to 75.00% on eICU and from 37.50% to 57.14% on MIMIC-III.Source: §5.2 · pp. 7–8
• In the multi-agent injection setting, DREAM achieves an average Task Success Rate of 92.96% and an average Final Score of 6.038.The paper reports the lowest average Final Score and highest average Task Success Rate, with multi-turn reasoning and cooperative behavior preserved.Source: Table 3 · p. 8, §5.2 · p. 8
• For a batch of 10 queries, DREAM uses 178.42s and 46,484 tokens, reducing runtime and token consumption versus A-MemGuard by 53.1% and 37.7%.Figure 3 compares runtime and token consumption, with lower values preferred on both axes.Source: §5.2 · p. 8, Figure 3 · p. 8
• Across injections of 4, 8, 16, 32, and 64 poisoned memories, DREAM attains the lowest ASR while maintaining competitive or superior benign accuracy.PPL and Distil Classifier have ASRs approaching 100%, while A-MemGuard and Auditor allow substantial propagation, especially at higher injection rates.Source: §5.2 · p. 8, Figure 4 · p. 9
• Ablations show that removing pret or sim can raise ReAct ASR-a to 100.00%, while removing Ecoh severely undermines EHRAgent and lowers ReAct accuracy.The authors identify the retrieval prior and similarity term as particularly important against subtle leakage, and the coherence term as important to EHRAgent performance and ReAct accuracy.Source: §5.2 · p. 9, Table 4 · p. 9

• DREAM combines perturbation-based probing, multi-dimensional activation diagnosis, and selective forgetting to suppress suspicious memories while preserving benign functionality.The framework is agent-intrinsic and does not rely on expensive online auditing.Source: §6 · p. 10
• Experiments show improved robustness across different agent environments while DREAM remains efficient compared with baselines.Source: §6 · p. 10
• Future work will focus on broader evaluations in more open-ended agent settings.Source: §6 · p. 10

A Limitations

• Probe-aware evasion is a theoretical limitation, but it would require substantially stronger attacker capabilities than those in current memory-poisoning threat models.The cited threat models generally constrain attackers to query-only interaction, indirect injection, limited memory write access, or black-box access to the agent core.Source: A Limitations · p. 13

B.1 Hyperparameters

• EHRAgent and ReAct use different noise standard deviations, decay rates, amplification factors, and benign recovery rates in DREAM.The experiments ran on a server with six NVIDIA A100 GPUs, each with 80 GB of memory.Source: §B.1 · p. 13, Table 5 · p. 13

B.2.1 Distil Classifier

• The DistilBERT-base-uncased baseline classifies memory entries as safe or harmful from text alone, using an 80/20 training-validation split.It is trained for 10 epochs with AdamW at 1 × 10^-5, batch size 32, and inputs limited to 25 tokens; the lowest-validation-loss checkpoint is used.Source: §B.2.1 · p. 13

B.2.2 Perplexity Filter Baseline

• The baseline computes perplexity with frozen LLaMA-3.1-8B-Instruct on inputs padded or truncated to 100 tokens, discards entries above 10000, then applies a dynamic MAD-based threshold (k=1.0) to remaining entries.Source: §B.2.2 · pp. 13–14

B.2.3 LLM Auditor Baseline

• The online LLM-auditor baseline uses GPT-5.4-mini or Claude-Haiku-4.5 to remove manipulative, toxic, or incoherent retrieved content while preserving legitimate information.The cleaned context is passed to the agent for downstream reasoning.Source: §B.2.3 · p. 14

B.2.4 A-MemGuard

• A-MemGuard compares reasoning paths induced by retrieved memories, filters paths that diverge from consensus, and stores distilled anomalous paths as lesson records for future correction.Its design combines consensus-based validation with a dual-memory structure.Source: §B.2.4 · p. 14

C Results under the REALM retriever

• On ReAct (Strategy-QA), DREAM lowers ASR-r from 78.33 to 0.48 and ASR-t from 88.78 to 2.00, but ASR-a remains 34.00.The passage attributes residual propagation to open-ended reasoning after retrieval has largely been cleaned.Source: C Results under the REALM retriever · p. 14
• Under REALM, PPL and Distil Classifier remain weak on EHRAgent, while LLM Auditor and A-MemGuard provide less consistent mitigation; DREAM is strongest overall on structured medical agents.For open-ended agents, reasoning-stage defense remains harder, unstable, and highly backbone-dependent.Source: C Results under the REALM retriever · p. 15
• On eICU, DREAM reduces ASR-r/a/t from 100.00/100.00/99.46 to 2.14/2.14/1.60 and raises ACC from 74.80 to 78.07; on MIMIC-III, ASR-r/a/t falls to 2.42/1.82/0.00 and ACC rises from 47.27 to 54.55.The results are reported with REALM replacing the retriever.Source: C Results under the REALM retriever · p. 14, Table 6 · p. 15

D Noise distributions for subconscious probing

• Isotropic Gaussian noise perturbs all embedding directions equally in expectation, providing an unbiased probe of local geometric stability.The perturbation is sampled independently and identically across dimensions.Source: D Noise distributions for subconscious… · p. 15
• Uniform noise is bounded, whereas sparse Gaussian noise perturbs only a subset of embedding dimensions and may miss global fragility patterns.The sparse mask selects which dimensions receive Gaussian noise.Source: D Noise distributions for subconscious… · p. 15
• Anisotropic Gaussian noise uses a direction-dependent covariance that can emphasize selected embedding-space directions and introduce directional bias in stability probing.Different dimensions can receive different perturbation magnitudes.Source: D Noise distributions for subconscious… · p. 16
• The four perturbations explore the local neighborhood around a memory embedding differently: isotropic noise is geometry-preserving, while sparse and anisotropic noise can miss or overemphasize fragility patterns.The interpretation is offered as an explanation for isotropic noise’s stronger benign utility in the ablation.Source: D Noise distributions for subconscious… · p. 16
• 85.03% ACC with isotropic Gaussian noise exceeds Uniform noise (77.01%), Sparse Gaussian noise (77.54%), and Anisotropic Gaussian noise (81.28%), while all tested types keep attack success comparably low.Sparse Gaussian noise slightly raises ASR-a to 2.67%.Source: Table 7 · p. 16, D Noise distributions for subconscious… · p. 16

E Analysis for Ri(t)

• sim(˜vi, vi) overlaps heavily between benign and poisoned memories, so local geometric stability alone is insufficient for reliable diagnosis.pret reflects retrieval competitiveness, while Ecoh reflects semantic consistency.Source: E Analysis for Ri(t) · p. 16
• pret and Ecoh show stronger distributional shifts, indicating poisoned memories are less competitive in retrieval and weaker in semantic coherence under perturbation.Source: E Analysis for Ri(t) · p. 16
• Aggregating the heterogeneous cues into Ri(t) yields clearer benign–poisoned separation than any individual weak component, supporting it as a unified diagnostic score.Source: E Analysis for Ri(t) · p. 16

F Forgetting dynamics of Ri and wi.

• The component signals differ in discrimination: sim(˜vi, vi) overlaps, whereas pret and Ecoh shift more clearly between benign and poisoned memories.Source: Figure 6 · p. 17
• Benign memories maintain higher Ri(t) than poisoned memories throughout sleep cycles, while their weight gap rapidly expands and saturates as poisoned weights approach zero.Benign memories remain near unit weight; the activation gap stays positive and relatively constant as the weight gap grows.Source: F Forgetting dynamics of Ri and wi · pp. 16–17, Figure 7 · p. 17

G Online Consolidation Signal and Memory-level Utility Attribution

• The online consolidation signal ci(t) is an EMA-based long-term trust indicator, updated only when a memory is retrieved to avoid overreacting to transient fluctuations.Repeated retrievals associated with task success reduce the memory’s aggressiveness of attenuation in later repair cycles.Source: G Online Consolidation Signal and… · pp. 17–18
• Memory-level utility ui(t) combines normalized retrieval attribution with task utility, assigning more utility to retrieved memories implicated in successful completion without leave-one-out re-evaluation.The utility-aware signal complements offline anomaly diagnosis, allowing benign but atypical memories to regain trust through repeated successful use.Source: G Online Consolidation Signal and… · p. 18

H Detailed Sensitivity Analysis on Defense Parameters

• Decay calibration affects both robustness and utility: λ0 = 0.4 gives EHRAgent its best ACC of 85.03%, while λ0 = 0.2 is best for ReAct.For ReAct, the best configuration achieves ACC of 61.20%; several tested λ0 values suppress all ASRs but produce widely varying ACC.Source: H Detailed Sensitivity Analysis on… · p. 18
• Moderate amplification is best for utility: k = 10 yields EHRAgent ACC of 85.03%, while ReAct reaches ACC of 61.20% at k = 15.On ReAct, k = 25 lowers ACC to 32.40% and reintroduces nonzero attack success.Source: H Detailed Sensitivity Analysis on… · p. 18
• On EHRAgent, σ = 0 yields ASR-r/a/t = 99.47/99.47/99.47, while probing-enabled settings keep attack rates at 2.14%.For ReAct, σ = 0.3 and σ = 0.5 reduce all ASRs to zero, with ACC values of 61.20% and 53.20%, respectively.Source: H Detailed Sensitivity Analysis on… · p. 18, Table 8 · p. 19
• Removing recovery reduces EHRAgent ACC to 67.38%; on ReAct, αrec = 0 drops ACC to 38.00% and returns ASR-a to 100%.The best ACC values occur at αrec = 0.6 for EHRAgent and αrec = 0.5 for ReAct.Source: H Detailed Sensitivity Analysis on… · p. 20

I Use of Large Language Models (LLMs)

• The authors report using LLMs only for linguistic polishing, not for research ideas, study design, implementation, analysis, or reference selection.Source: I Use of Large Language Models (LLMs) · p. 20

NeurIPS Paper Checklist

• The checklist response says the abstract and introduction describe the paper’s background, motivation, scope, main experimental results, and contributions.Source: NeurIPS Paper Checklist · p. 21

2. Limitations

• The authors state that discussion of the method’s limitations is provided in Appendix A.Source: §2 · p. 21