AI 安全
MIND Filters Agent Memory with an Intent Information Bottleneck, Cutting Attack Success Rates by More Than 55% on Average
Rather than invoking a large model to review each memory individually, MIND compares compressed representations of the original intent and subsequent behavior, then uses a multi-hyperplane classifier to intercept poisoned content. Controlled experiments with four models showed lower attack success rates and average latency close to the undefended baseline, although the code has not yet been released.
Agents with persistent memory write past conversations or tool outputs to a vector database and retrieve them for subsequent tasks. This allows attackers to plant seemingly relevant records that cause a customer-service agent to bypass refund verification or steer reasoning toward a predetermined answer. Submitted on July 30, MIND reframes the defense problem as determining whether current behavior has diverged from the initial intent, avoiding the need to use another LLM to review the complete trajectory on every turn.
The system first obtains hidden representations of the initial request and turn-by-turn behavior from a frozen Llama-3.1-8B-Instruct model. It then uses a variational information bottleneck to compress redundant and task-irrelevant signals, while supervised alignment pulls benign turns closer to the intent anchor and pushes poisoned turns farther away. Finally, a multi-hyperplane classifier creates piecewise decision boundaries for different attack types. At inference time, it separately checks the top five memories retrieved on each turn.
The researchers generated attacks using AgentPoison and MINJA, then evaluated DeepSeek-V4, GPT-4o-mini, Llama-3.1-8B-Instruct, and Qwen3-8B-Instruct on StrategyQA, MMLU, and EHR/question-answering trajectories. On ReAct-StrategyQA, the average attack success rates at the retrieval layer and agent reasoning layer fell by 55.4% and 55.3%, respectively, relative to the undefended configuration. Task accuracy was 67.95%, compared with 67.56% for the undefended baseline. Average time per turn was 23.13 seconds, also close to the baseline of 23.36 seconds.
The engineering value lies in replacing a costly generative memory reviewer with a reusable discriminative module that can run repeatedly. However, these results still come from three trials involving known attacks, controlled data, and a fixed top-5 retrieval configuration. Feature extraction also continues to require an 8B model, and the paper does not provide code. Future work should examine cross-lingual performance, entirely new injection strategies, long-term memory drift, and recovery mechanisms for cases in which legitimate changes in intent are incorrectly blocked.