Neuro inspired method improves memory security in large AI agents
Forgetting is Not Always Bad: A Neuro-Inspired Memory Repair Mechanism for Poisoned LLM Agents
Artificial Intelligence
Summary
Large language models that remember information can be tricked by attackers who plant harmful memories. The authors propose a brain-inspired method called DREAM that helps AI systems selectively forget these bad memories while keeping good ones. This approach is training-free and runs faster and more efficiently than previous defenses. Experiments showed DREAM greatly reduces attack success while maintaining the AI’s normal performance on tasks.
What this means in practice
- •For ai security teams: Protect large language model agents from memory poisoning attacks by selectively forgetting harmful implanted memories without retraining.
- •For cloud service providers: Integrate efficient memory repair mechanisms into AI-driven systems to reduce computational overhead when defending against backdoor and injection attacks.
Authors
Lei Liu, Yunji Liang, Xiaowen Zhang, Jingqi Liu, Qi Li, Bin Guo, Zhiwen Yu
Abstract
Large language model (LLM) agents are highly vulnerable to memory-poisoning attacks. Existing defenses primarily rely on external modules for either static memory isolation or continuous online auditing, resulting in low memory efficiency and high computational overhead. To address these limitations, inspired by neuroscientific mechanisms that weak reactivation can destabilize memories and induce decay in the absence of reinforcement, we propose an agent-intrinsic training-free memory repair framework, DREAM (Dynamic Reactivation for Engram Attenuation in Memory), that enables selective functional forgetting of poisoned memories. Specifically, DREAM implements a three-stage pipeline: perturbation-induced implicit reactivation to reveal the structural fragility of malicious memories, adaptive anomaly diagnosis based on multi-dimensional activation patterns to detect topological anomalies, and a dynamic memory repair module that selectively suppresses harmful memories while reinforcing benign ones. Extensive experiments across diverse attackers and real-world tasks demonstrate that DREAM reduces attack success rates by over 95\% against backdoor poisoning while preserving strong benign utility. DREAM also achieves competitive robustness against injection attacks. In terms of runtime and token consumption, DREAM achieves up to a 2.13$\times$ speedup and a 37.7\% reduction in token consumption compared with A-MemGuard. Furthermore, DREAM also achieves a task success rate of 92.96\% on poisoned multi-agent systems.