MIND: A Lightweight Defense for LLM Agents Against Memory Injection Attacks
A new preprint proposes MIND, a lightweight defense that reports cutting memory-injection attack success by more than half on one benchmark.
What problem the researchers describe
Memory-augmented LLM-based agents are vulnerable to memory injection attacks, according to a preprint posted to arXiv on 30 Jul 2026 by Dongyi Liu and three co-authors. The paper explains that agents may retrieve poisoned memory planted by attackers, which diverts their behavior away from the user's initial intent and can cause the task to fail outright. The authors say existing defenses fall into two problems: some incur high computational cost, while others suffer from information redundancy across multi-turn contexts.
What the researchers propose
To address this, the authors propose Memory Intent-Aware Neural Denoising, or MIND, described as a lightweight defense framework for memory injection attacks. The paper says a preliminary analysis found that benign and poisoned trajectories show distinguishable relationships between a user's initial intent and the agent's subsequent behavior. Building on that observation, MIND uses an intent-aware Information Bottleneck to extract compact intent-behavior representations from the initial intent and turn-level behavior. According to the paper, this bottleneck preserves intent-relevant cross-turn attack signals while filtering out task-irrelevant and repetitive information, and a lightweight detector then identifies malicious memories from the resulting representations. The authors say this design avoids the overhead of repeated LLM auditing while cutting down on information redundancy across multi-turn contexts.
What the researchers report measuring
The authors report that extensive experiments show MIND reduces attack success rates while preserving task accuracy and inference efficiency. On one benchmark specifically, ReAct-StrategyQA, the paper reports that MIND reduces two measures of mean attack success rate, called ASR-r and ASR-a, by 55.4% and 55.3% respectively, while matching the undefended agent's average accuracy and latency. Because this is a preprint that has not been peer-reviewed, these are the authors' own reported results rather than an independently confirmed finding.
Key facts
- The preprint is titled "MIND: Lightweight and Effective Memory Injection Defense for LLM Agents via Intent-Aware Information Bottleneck," submitted to arXiv on 30 Jul 2026 by Dongyi Liu and three co-authors.
- MIND stands for Memory Intent-Aware Neural Denoising, a lightweight defense framework against memory injection attacks.
- MIND uses an intent-aware Information Bottleneck to build compact intent-behavior representations, then a lightweight detector flags malicious memories from those representations.
- On ReAct-StrategyQA, the paper reports MIND cuts mean ASR-r and ASR-a by 55.4% and 55.3% respectively.
- The authors report MIND matches the undefended agent's average accuracy and latency on that same benchmark.
Why it matters
Teams building agents that keep memory across turns are dealing with a real attack surface: an attacker who can plant content an agent later retrieves as memory. This paper describes a filter that tries to catch that kind of poisoning without re-running an LLM audit on every turn, an approach the authors report lowers attack success without giving up the speed or accuracy of an undefended agent, at least on the one benchmark reported in detail.
Check your understanding
What do the researchers report ASR-r and ASR-a dropped by on ReAct-StrategyQA?
What does MIND use to build compact intent-behavior representations, according to the paper?