MemShield: A Three-Tier Retrieval-Time Defense Against Coordinated Memory Poisoning in LLM Agents

LLM agents now lean on persistent long-term memory through retrieval-augmented generation, and that memory is an attack surface. An attacker who controls a few user accounts, an upstream feed, or a compromised internal writer can drop entries that quietly steer the agent across sessions. Existing defenses are either expensive or need white-box access, and none gives a finite-sample false-positive bound that survives a change of LLM backbone. Coordinated attacks announce themselves in metadata; existing defenses look only at content. We exploit this with \textsc{MemShield}, a three-tier retrieval-time defense. A structural detector reads batch metadata (writer overlap, temporal burst, write-context overlap) and flags coordinated poisoning at zero LLM cost. A conformal-calibrated judge handles borderline batches with a marginal FPR bound from split-conformal prediction. Clean batches pass through. The per-entry judge fails two ways. On Mistral-7B-v0.3 it saturates and collapses to zero recall; on Llama-3.1-70B it stays sharp but rarely flags individual entries (recall $0.31$). In both cases, the structural tier carries detection at $\geq 0.93$ recall. Across 48 cells (4 backbones $\times$ 3 retrievers $\times$ 4 datasets) and 12 attacks, the composition lifts median recall from $0.30$ to $1.00$ at $67.8\%$ fewer judge calls and within the conformal bound $$\alpha + \frac{1}{N+1} \approx 0.082.$$