A-MemGuard: A Proactive Defense Framework For LLM-Based Agent Memory

Large Language Model (LLM) agents use memory to learn from past interactions. However, this reliance on memory introduces a critical security risk: an adversary can inject seemingly harmless records into an agent's memory to manipulate its future behavior. This vulnerability is characterized by two core aspects: First, the malicious effect of injected records is only activated within a specific context, making them hard to detect when individual memory entries are audited in isolation. Second, once triggered, the manipulation can initiate a self-reinforcing error cycle: the corrupted outcome is stored as precedent, which not only amplifies the initial error but also progressively lowers the threshold for similar attacks in the future. To address these challenges, we introduce \emph{A-MemGuard} (\underline{A}gent-\underline{Mem}ory \underline{Guard}), the first defense framework for LLM agent memory. The core idea of our work is the insight that memory itself must become both \emph{self-checking} and \emph{self-correcting}. Without modifying the agent's core architecture, A-MemGuard combines two mechanisms: (1) \textbf{consensus-based validation}, which detects anomalies by comparing reasoning paths derived from multiple related memories and (2) a \textbf{dual-memory structure}, where detected failures are distilled into ``lessons'' stored separately and consulted before future actions, breaking error cycles and enabling adaptation. Comprehensive evaluations on multiple benchmarks show that A-MemGuard effectively cuts attack success rates by over 95\% while incurring a minimal utility cost. This work shifts LLM memory security from static filtering to a proactive, experience-driven model where defenses strengthen over time.

AI assistants powered by large language models (LLMs) can learn from past interactions by storing useful information in memory. However, this capability opens the door to a new type of attack: an adversary can secretly plant seemingly harmless records into the agent's memory that, when triggered by a specific context, manipulate the agent into producing incorrect or harmful outputs. What makes this threat particularly dangerous is twofold: (1) the malicious entries appear innocent when reviewed individually, making them hard to detect; and (2) once activated, the corrupted output gets saved back as a trusted "precedent," creating a vicious cycle where errors compound and future attacks become progressively easier. To combat this, we propose A-MemGuard (Agent-Memory Guard) — the first defense framework designed specifically to protect LLM agent memory. Our key insight is that memory itself must become both self-checking and self-correcting, without requiring any changes to the agent's core design. A-MemGuard achieves this through two mechanisms: 1. Consensus-based validation — Before acting on a memory, the system cross-checks it against multiple related memories. If the reasoning paths conflict, the suspicious entry is flagged as potentially malicious. 2. Dual-memory structure — When a failure is detected, the system distills the experience into a "lesson learned" and stores it in a separate protective memory. This lesson is consulted before future actions, effectively breaking the error cycle and enabling the defense to grow stronger over time. Extensive experiments on multiple benchmarks demonstrate that A-MemGuard reduces attack success rates by over 95% with minimal impact on normal performance. This work represents a paradigm shift in LLM memory security — moving from static content filtering to a proactive, experience-driven defense that continuously improves with use.