MAPLE-Guard: Memory-Aware Link Enforcement Against Memory-Link Poisoning in Multi-Agent Systems

• URL: http://arxiv.org/abs/2608.00426v1
• Date: Sat, 01 Aug 2026 03:55:13 GMT
• Title: MAPLE-Guard: Memory-Aware Link Enforcement Against Memory-Link Poisoning in Multi-Agent Systems
• Abstract summary: MAPLE-Guard is a memory-link guard for memory-enabled multi-agent systems.<n>It monitors the memory lifecycle and places gates at write, retrieval, promotion, and cross-agent reuse.<n>Results suggest that memory-aware link enforcement covers a gap left by prompt-level and topology-level defenses.
• Score: 38.58713997316864
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: LLM-based multi-agent systems (MAS) increasingly rely on persistent private and shared memories for long-horizon coordination. This memory layer improves continuity, but it also gives attackers a durable channel: a poisoned memory can be written once, continuously retrieved in later tasks, promoted into shared memory, and reused by other agents. A single poisoned write can therefore steer many later decisions and contaminate agents that never saw the original attack, all while no malicious message crosses a visible communication edge at the moment of harm. Further, because existing safeguards mainly inspect prompts, actions, or communication edges, they can miss attacks whose content appears benign at write time but becomes harmful after retrieval. We introduce Memory-Aware Propagation and Link Enforcement Guard, MAPLE-Guard, a memory-link guard for memory-enabled MAS. MAPLE-Guard monitors the memory lifecycle and places gates at write, retrieval, promotion, and cross-agent reuse, so risky memories can be quarantined, unsafe retrievals filtered, and poisoned private memories blocked before they enter shared memory. In the main evaluation, MAPLE-Guard lowers attack success rate (ASR) from 38.2% to 0.9% on LongMemEval and from 34.7% to 0.2% on AppWorld; it also raises multi-agent defense success rate (MDSR) from 54.0% to 74.3% and from 42.5% to 99.8% on the same benchmarks. These results suggest that memory-aware link enforcement covers a gap left by prompt-level and topology-level defenses. Code is available at the link: https://github.com/xiong-wenjun/MAPLE-Guard.

Related papers

• When Malicious Instructions Persist: Persistent Memory Poisoning Attack on Harness-Based Agents [17.320527773100732]
  We propose PMPA, a Persistent Memory Poisoning Attack against harness-based agents.<n> PMPA embeds malicious instructions into benign external sources and induces the victim agent to write them into persistent memory.<n>Across all settings, PMPA achieves average Injection Success Rate (ISR) and Cross-session Attack Success Rate (C-ASR) of 73.7%/ 55.5% on OpenClaw and 66.9%/ 81.7% on Claude Code.
  arXiv  Detail & Related papers  (2026-09-12T11:27:53Z)
• Salami Attack: Stealthy Collusive Memory Poisoning against OpenClaw [15.739441864484098]
  We introduce MemCollusion, an automated framework for constructing collusive memory poisoning attacks.<n>MemCollusion constructs memory coalitions using four design constraints, five theory-informed strategies, and a fine-tuned generator.<n>MemCollusion achieves an average Memory Save Rate of 81.3% and an Attack Success Rate of 75.0%, and remains effective under both benign memory dilution and memory-level defenses.
  arXiv  Detail & Related papers  (2026-08-03T03:17:26Z)
• MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair [11.307480451677145]
  Memory systems allow agents to retain and reuse information from past interactions, but they can also let malicious content persist.<n>Recent benchmarks increasingly examine agent memory security, yet few trace the same malicious semantics across persistence, downstream consequences, and selective repair.<n>MemSecBench is a benchmark for the lifecycle security of agent memory systems.
  arXiv  Detail & Related papers  (2026-07-29T16:06:54Z)
• When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents [55.87577638514179]
  We study the threat as stealth memory injection, in which a remote black-box delivers a single email payload that must induce the agent to poisoned memory.<n>We propose MemGhost, a one-shot payload generation framework.<n>Across 56 held-out test cases, MemGhost achieves 87.5% end-to-end success on OpenClaw with GPT-5.4 and 71.4% on Claude Code SDK with Sonnet 4.6.
  arXiv  Detail & Related papers  (2026-07-06T15:08:58Z)
• MEMPROBE: Probing Long-Term Agent Memory via Hidden User-State Recovery [58.64329475683699]
  We argue that long-term memory should be evaluated as an auditable post-interaction artifact.<n>We instantiate this view in MEMPROBE, a benchmark in which a memory-equipped agent assists simulated users.<n>We find that successful assistance and recoverable memory behave as distinct capabilities.
  arXiv  Detail & Related papers  (2026-06-23T13:52:46Z)
• MemVenom: Triggered Poisoning of Multimodal Memories in Web Agents [74.64265314956441]
  We propose a unified black-box attack framework that poisons graph-structured external memory with coordinated text-image evidence.<n>MemVenom achieves strong end-to-end attack success with minimal impact on benign performance, reaching up to 99.15% on GPT-5-family web agents.
  arXiv  Detail & Related papers  (2026-06-09T11:53:25Z)
• From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents [3.3489120273076876]
  Memory is a core component of AI agents, enabling them to accumulate knowledge across interactions and improve performance.<n>We present a systematic study of memory poisoning in LLM-based agents.<n>We identify four memory write channels and nine structural vulnerabilities in model capabilities, system prompt design, and agent system architecture.
  arXiv  Detail & Related papers  (2026-06-03T01:04:13Z)
• MemGuard: Preventing Memory Contamination in Long-Term Memory-Augmented Large Language Models [56.31411457917676]
  We introduce MemGuard, a type-aware memory framework that preserves functional memory boundaries during memory construction and retrieval.<n>Across hallucination and long-horizon conversation benchmarks, MemGuard improves memory reliability by up to 28.27% while retrieving up to 5.8x fewer memory tokens than prior methods.
  arXiv  Detail & Related papers  (2026-05-27T06:04:19Z)
• Hidden in Memory: Sleeper Memory Poisoning in LLM Agents [39.7102258719441]
  We study sleeper memory poisoning, a delayed attack in which an adversary manipulates external context to cause the assistant to store a fabricated memory about the user.<n>Unlike conventional prompt injection, the attack can remain dormant and re-emerge across multiple later conversations.<n>Across stateful LLM assistants, poisoned memories were added up to 99.8% on GPT-5.5 and 95% on Kimi-K2.6.
  arXiv  Detail & Related papers  (2026-05-14T19:06:10Z)
• MemoryVLA: Perceptual-Cognitive Memory in Vision-Language-Action Models for Robotic Manipulation [59.31354761628506]
  Temporal context is essential for robotic manipulation because such tasks are inherently non-Markovian, yet mainstream VLA models typically overlook it.<n>We propose MemoryVLA, a Cognition-Memory-Action framework for long-horizon robotic manipulation.<n>We evaluate it on 150+ simulation and real-world tasks across three robots.
  arXiv  Detail & Related papers  (2025-08-26T17:57:16Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.