arXiv：cs.AI· Dongyi Liu, Haixing He, Xiaobao Wu, Jia Li·· 16 小时前
MIND：面向 LLM 智能体的轻量意图感知记忆注入防御
MIND: Lightweight and Effective Memory Injection Defense for LLM Agents via Intent-Aware Information Bottleneck
AI 导读
针对记忆增强型 LLM 智能体易受记忆注入攻击的问题，研究者提出轻量防御框架 MIND，通过意图感知信息瓶颈（IB）从初始意图与轮级行为中提取紧凑的意图-行为表示，再用轻量检测器识别恶意记忆，避免重复 LLM 审计的开销。在 ReAct-StrategyQA 上，MIND 将平均 ASR-r 和 ASR-a 分别降低 58.1% 和 53.5%，同时平均准确率与延迟与未防御智能体持平。
正文
Abstract:Memory-augmented LLM-based agents are vulnerable to memory injection attacks: Agents may retrieve poisoned memory from attackers, which diverts their behavior from initial user intent and finally causes task failure. However, existing defense mechanisms either incur high computational cost or suffer from information redundancy in multi-turn contexts. To address these challenges, we propose Memory Intent-Aware Neural Denoising(MIND), a lightweight defense framework for memory injection attack. Our preliminary analysis reveals that benign and poisoned trajectories exhibit distinguishable relationships between the initial user intent and subsequent behavior. Building on this observation, MIND employs an intent-aware Information Bottleneck(IB) to extract compact intent--behavior representations from the initial intent and turn-level behavior. The IB preserves intent-relevant cross-turn attack signals while filtering task-irrelevant and repetitive information, and a lightweight detector identifies malicious memories from the resulting representations. As such, MIND mitigates information redundancy in multi-turn contexts while avoiding the overhead of repeated LLM auditing. Extensive experiments show that MIND reduces attack success rates while preserving task accuracy and inference efficiency. Notably, on ReAct-StrategyQA, MIND reduces mean ASR-r and ASR-a by 58.1% and 53.5%, respectively, while matching the undefended agent in average accuracy and latency.
| Subjects: | Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2607.28103 [cs.AI] |
| (or arXiv:2607.28103v2 [cs.AI] for this version) | |
| https://doi.org/10.48550/arXiv.2607.28103 arXiv-issued DOI via DataCite |
Submission history
From: Dongyi Liu [view email]
[v1]
Thu, 30 Jul 2026 12:11:49 UTC (2,862 KB)
[v2]
Mon, 12 Oct 2026 16:09:44 UTC (3,441 KB)
来源：arXiv：cs.AI · arxiv.org