通过意图感知信息瓶颈，轻量级防御大模型代理的内存投毒攻击。
MIND: Lightweight and Effective Memory Injection Defense for LLM Agents via Intent-Aware Information Bottleneck
- 基于意图-行为关系构建信息瓶颈，提取紧凑表示
- 在策略问答任务上降低55.4%攻击成功率，保持精度与速度
- 适合需高效安全的多轮对话系统开发者使用
基于记忆增强的大语言模型代理易受内存投毒攻击：攻击者可诱导代理从恶意记忆中检索信息，偏离初始用户意图，导致任务失败。现有防御方法或计算开销高，或在多轮对话中存在信息冗余。为此，我们提出轻量级防御框架MIND（Memory Intent-Aware Neural Denoising），基于初步分析发现良性与中毒行为轨迹在初始意图与后续行为间具有可区分的关系。MIND利用意图感知的信息瓶颈（IB）从初始意图和逐轮行为中提取紧凑的意图-行为表示，保留与攻击相关的跨轮信号，同时过滤无关与重复信息，并通过轻量检测器识别恶意记忆。该方法有效缓解多轮上下文中的信息冗余，避免重复大模型审计的开销。大量实验表明，MIND在保持任务准确率和推理效率的同时显著降低攻击成功率。在ReAct-StrategyQA数据集上，平均攻击成功率（ASR-r）和攻击成功率（ASR-a）分别降低55.4%和55.3%，且与未受防护的代理在平均准确率和延迟上相当。
原文摘要 · Abstract (English)
Memory-augmented LLM-based agents are vulnerable to memory injection attacks: Agents may retrieve poisoned memory from attackers, which diverts their behavior from initial user intent and finally causes task failure. However, existing defense mechanisms either incur high computational cost or suffer from information redundancy in multi-turn contexts. To address these challenges, we propose Memory Intent-Aware Neural Denoising(MIND), a lightweight defense framework for memory injection attack. Our preliminary analysis reveals that benign and poisoned trajectories exhibit distinguishable relationships between the initial user intent and subsequent behavior. Building on this observation, MIND employs an intent-aware Information Bottleneck(IB) to extract compact intent--behavior representations from the initial intent and turn-level behavior. The IB preserves intent-relevant cross-turn attack signals while filtering task-irrelevant and repetitive information, and a lightweight detector identifies malicious memories from the resulting representations. As such, MIND mitigates information redundancy in multi-turn contexts while avoiding the overhead of repeated LLM auditing. Extensive experiments show that MIND reduces attack success rates while preserving task accuracy and inference efficiency. Notably, on ReAct-StrategyQA, MIND reduces mean ASR-r and ASR-a by 55.4% and 55.3%, respectively, while matching the undefended agent in average accuracy and latency.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。