Technical Summary: MIND (Memory Intent-Aware Neural Denoising)

1. Problem Statement

Memory-augmented Large Language Model (LLM) agents rely on external retrieval-based memory systems to handle long-horizon tasks. However, these systems are vulnerable to memory injection attacks, where adversaries manipulate the memory store (either via direct write access or indirect multi-turn interactions) to inject poisoned records. When retrieved, these records divert the agent's behavior from its initial user intent, leading to task failure or harmful outputs.

Existing defense mechanisms face two critical limitations:

1. High Computational Cost: Reasoning-based defenses (e.g., LLM Auditors) repeatedly invoke LLMs to audit retrieved memories or monitor interaction streams, causing significant latency accumulation over long trajectories.
2. Information Redundancy: Lightweight detectors that encode full multi-turn trajectories often suffer from task-irrelevant and repetitive information. This redundancy obscures attack signals, hindering the ability to distinguish between benign and poisoned behaviors.

2. Methodology: MIND

The authors propose MIND (Memory Intent-Aware Neural Denoising), a lightweight defense framework that reformulates memory defense as a denoising problem based on the Information Bottleneck (IB) principle.

Core Observations

Preliminary analysis revealed two key phenomena:

• Separability: In the representation space, benign and poisoned trajectories exhibit distinguishable trends regarding the relationship between the initial user intent and subsequent behavior.
• Intent Decay & Redundancy: As interaction turns increase, the agent's attention to the initial intent decays, a process accelerated by injection attacks. Furthermore, multi-turn states contain significant redundancy that weakens the intent signal.

Framework Architecture

MIND operates in three stages:

1. Trajectory Representation Extraction:

   • A pre-trained LLM (e.g., Llama-3.1-8B-Instruct) extracts turn-level features.
   • The representation for turn $t$ ($h_t$) is defined as the last-token hidden state of the <observation> component.
   • The initial user query is represented as $h_0$.
   • Training data is constructed as pairs $(x_i, x_{anchor})$, where $x_i = [h_0; h_t]$ and $x_{anchor} = h_0$, labeled by whether the retrieved memory at that turn was poisoned.

2. Intent-Aware Information Bottleneck (IB) Encoder:

   • Instead of classifying raw inputs, MIND compresses the input $x_i$ into a latent space $z_i$ using an IB encoder $E$.
   • Objective: Minimize mutual information $I(Z; X)$ (compactness) to discard task-irrelevant redundancy, while maximizing $I(Z; Y)$ (informativeness) to preserve intent-relevant signals.
   • Compactness: Achieved by minimizing the KL divergence between the learned posterior $q_E(z|x)$ and an isotropic Gaussian prior.
   • Informativeness: Achieved via a supervised alignment loss. Benign turns are pulled toward the initial intent anchor ($h_0$), while poisoned turns are pushed away by a margin, ensuring the latent space preserves the relationship between current behavior and original intent.

3. Lightweight Multi-Hyperplane Classifier:

   • A decision boundary is built on the denoised latent space $z_i$.
   • Rather than a single linear boundary, MIND employs $K$ hyperplanes to form a piecewise decision region (Convex Polytope Machine).
   • This design captures diverse attack patterns that a single linear boundary might miss. A turn is classified as benign only if it lies below all $K$ hyperplanes.

Training Objective

The model is optimized to minimize a combined loss function:
$$\mathcal{L} = \mathcal{L}_{benign} + \mathcal{L}_{poison} + \beta \mathcal{L}_{KL} + \lambda \mathcal{L}_{align}$$
Where $\mathcal{L}_{KL}$ enforces compactness, $\mathcal{L}_{align}$ enforces intent separation, and the first two terms enforce the multi-hyperplane classification constraints.

3. Key Contributions

• Analysis: The authors provide preliminary evidence that memory injection attacks cause a distinguishable deviation in the relationship between initial intent and subsequent behavior, and that this signal is obscured by multi-turn redundancy.
• Method: They design a lightweight defense framework that utilizes an intent-aware Information Bottleneck to filter poisoned memories without repeated LLM auditing or full-trajectory encoding.
• Evaluation: Extensive experiments demonstrate that MIND improves the security-utility trade-off, reducing attack success rates while maintaining task accuracy and inference efficiency comparable to undefended agents.

4. Experimental Results

Experiments were conducted on ReAct-StrategyQA and MMLU benchmarks using four backbone models (DeepSeek-V4, GPT-4o-mini, Llama-3.1-8B-Instruct, Qwen3-8B-Instruct) against attacks like AgentPoison and MINJA.

• Attack Reduction: On ReAct-StrategyQA, MIND reduced the mean Retrieval-stage Attack Success Rate (ASR-r) by 55.4% and Agent-reasoning ASR (ASR-a) by 55.3% compared to undefended agents.
• Task Accuracy: MIND preserved average task accuracy (e.g., 67.95% on StrategyQA vs. 67.56% for undefended) and achieved the highest mean accuracy (79.57%) on MMLU among defense methods.
• Efficiency: MIND is computationally efficient. On StrategyQA, it ran 20.6% faster than the LLM Auditor baseline and 70.4% faster than A-MemGuard, with an average episode time comparable to the undefended agent.
• Ablation: Removing either the IB encoder or the multi-hyperplane classifier degraded performance, confirming their complementary roles in reducing false positives while maintaining detection capability.

5. Significance and Claims

The paper claims that MIND addresses the fundamental trade-off between security and efficiency in memory-augmented agents. By leveraging the Information Bottleneck to filter redundant information and focus on the intent-behavior relationship, MIND avoids the computational overhead of repeated LLM auditing and the signal dilution caused by full-trajectory encoding.

The authors position MIND as a practical solution for long-horizon tasks where maintaining low latency is critical, demonstrating that effective defense against memory injection does not require expensive reasoning-based auditing if the underlying intent-behavior dynamics are properly modeled and denoised.