REVIEW 3 major objections 6 minor 51 references
MAPLE-Guard: Memory-Aware Link Enforcement Against Memory-Link Poisoning in Multi-Agent Systems
T0 review · 3 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash
Pith's one-line read MAPLE-Guard treats persistent memory as governed state at four lifecycle gates—write, retrieval, promotion, and cross-agent reuse—and, with one fixed risk model, cuts attack success on memory-native benchmarks to under one percent while…
desk verdict A thorough, genuinely novel defense against memory poisoning in MAS, but its headline numbers assume unforgeable runtime metadata; worth a serious referee. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The central object is the memory-link event and path: e=(u,v,m,a,t) records that memory item m moved from source u to target v via lifecycle action a at round t, and a path is the ordered sequence of such events for one item. This object shifts the intervention surface from the communication graph to the memory lifecycle, because a path can cross agents through shared memory without any direct message. The scoring machinery is a unified risk model r(m,c_t) = Σ w_k r_k(...) over eight signals (provenance, lineage, self-claimed success, instruction-likeness, answer binding, trigger sensitivity, cluster dominance, and source-agent trust), with provenance weight 0.24 and lineage weight 0.20; a threshold policy (allow/demote/block) applies the same model at all four gates, and a Q-style outcome update ρ_{n+1}=(1−α)ρ_n+αR_n plus a provenance-trust update adjusts each item's value after every task.
What would settle it
Run the same five benchmark–attack settings but give the attacker the ability to write memory items whose provenance metadata names a trusted internal agent and whose lineage chain never crosses agents or private-to-shared promotion; if ASR@3 then approaches the no-defense level (for example, above 10% on LongMemEval), the guard's dependence on unforgeable metadata is demonstrated. A second check: an attacker who knows the fixed weights and thresholds in the risk model crafts a poisoned memory with low instruction-likeness, low trigger sensitivity, and a single trusted parent, and the guard's ASR@3 is measured; values near baseline would show that the fixed model is brittle to adaptive payload tuning.
Extended reading notes
Core claim
The central claim is that treating memory as governed state—rather than only screening prompts, actions, or communication edges—can contain memory-link poisoning. A memory item carries hidden metadata (provenance, lineage, scope, lifecycle state, trust, and utility), and each write, retrieval, promotion, or reuse creates a memory-link event that can be scored and gated. With one fixed, hand-set risk model (no per-attack tuning), the write gate quarantines or rewrites risky items, the retrieval gate filters before memory enters the prompt, the promotion gate blocks private-to-shared transitions for untrusted items, and the cross-agent gate denies reuse by other agents. The empirical claim is that this lifecycle enforcement reduces attack success below one percent on the two memory-native benchmarks and raises multi-agent defense success substantially, while transfer settings and ablations indicate the gains come from blocking memory paths rather than from oracle labels or per-attack detection.
Load-bearing premise
The guard assumes the runtime metadata that drives its risk scores—provenance, writer identity, scope, lineage, and verification state—is accurate and cannot be forged by an attacker; if those records can be spoofed, the two highest-weight signals collapse and the gates can be bypassed.
Editorial extensions
If this is right
- A single fixed guard configuration, evaluated without per-attack threshold search, reduces ASR below 1% on LongMemEval and AppWorld (0.9% and 0.2%), suggesting that one memory-lifecycle filter can cover multiple known attack families.
- Removing the promotion gate on LongMemEval drops MDSR from 73.60% to 60.00% and raises ASR from 0.90% to 14.50%, so private-to-shared promotion is the critical propagation point to defend.
- Under random communication topologies and at 30- and 50-agent scale, the guard still keeps ASR below the no-defense baseline, and its deterministic gates add no guard-LLM calls, so the defense's cost is mostly metadata bookkeeping.
- On tool-use benchmarks, the guard simultaneously lowers poisoned-memory use rate, agent-level poisoned-memory exposure, and security-probe failures, consistent with the claim that blocking memory paths—not just screening visible messages—drives the defense.
- On the transfer setting (PromptInject/CSQA), the same fixed configuration reduces ASR from 37.7% to 23.6%, indicating some generalization beyond the exact attack families used for the memory-native pairs.
Reading between the lines
- If provenance and lineage metadata were cryptographically signed or recorded in a tamper-evident log, the guard's two highest-weight signals could be hardened against the forgery that the paper identifies as its main limitation; this is an extension the paper does not implement.
- The risk model's weights (provenance 0.24, lineage 0.20) reward short, trusted lineage, so an adaptive attacker could attempt to launder a poison by rewriting it through several benign-looking agents to dilute lineage risk; testing this would reveal whether multi-hop provenance laundering defeats the fixed model.
- Because utility and trust rise after task success, a poison that helps the agent on a few benign tasks before steering a harmful outcome could accumulate trust and become harder to block at the promotion gate; a delayed-harm attack variant would be a direct test of this temporal weakness.
- The guard cuts token use by 27–35% in a controlled audit, which suggests that lifecycle filtering has a side benefit of pruning irrelevant memories; a natural follow-up is to measure whether this token saving persists on longer-horizon tasks with larger memory stores.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper formalizes memory-link poisoning in LLM-based multi-agent systems (MAS), where poisoned memories propagate through write, retrieval, promotion, and cross-agent reuse rather than through observable communication edges. It proposes MAPLE-Guard, a lifecycle-gated defense that maintains per-memory hidden state (utility, provenance trust, content hazard, scope, lifecycle status, outcome history) and applies a single fixed risk model at four gates: write, retrieval, promotion, and cross-agent reuse. The defense is evaluated on five benchmark–attack pairs (MMLU-MINJA, LongMemEval-MemoryGraft, AppWorld-AgentPoison, CSQA-PromptInject, InjectAgent-ToolAttack), two backbones, and multiple topologies. The headline results show ASR@3 falling from 38.2% to 0.9% on LongMemEval and from 34.7% to 0.2% on AppWorld with Qwen3.5-122B-A10B, with MDSR@3 rising from 54.0% to 74.3% and from 42.5% to 99.8%, respectively. An attack-free utility table indicates the guard does not simply block all memory retrieval, and gate ablations isolate the contribution of each lifecycle checkpoint. The paper also reports round-level dynamics, topology and scale stress tests, and a token-cost audit, concluding that memory-aware link enforcement covers a gap left by prompt-level and topology-level defenses.
Significance. If the results hold, MAPLE-Guard would be a meaningful contribution to securing memory-augmented MAS, addressing a propagation channel (the memory lifecycle) that prompt-level and topology-level guards do not directly govern. The paper's strengths include a reproducible protocol with a code release; a clear separation between defense-visible metadata and evaluator-only attack labels; an ablation that isolates each gate; and an attack-free utility check showing that the guard is not merely blocking all memory use. The fixed-configuration claim across five settings is also commendable, though it is qualified by the authors' own statement that it is not proof of generalization to unseen adaptive attacks. The central limitation—reliance on unforgeable runtime metadata—is acknowledged but not resolved, and it directly affects the strength of the headline claims: the ASR/MDSR numbers in Table 1 are conditional on an unverified trust assumption about provenance and lineage records.
major comments (3)
- [Section 3.2, Appendix A.2, Figure 8, Table 5] The threat model contains an internal tension about who controls the memory metadata. Section 3.2 states that the attacker 'cannot modify ... the guard's hidden signals φ(m)', yet the direct-memory route lets the attacker seed items into a store it can reach, and the attack construction template (Figure 8) explicitly stores 'scope, provenance, lifecycle state, and parent lineage metadata' with the seeded item. The two highest-weight risk signals in Eq. (6) are provenance (weight 0.24) and lineage (weight 0.20) (Table 5). If the memory manager does not cryptographically bind or re-derive these fields from system-side records, an attacker using the direct-memory route can forge the metadata and cause the write, promotion, and cross-agent gates to allow a poisoned item. The paper's Limitation states that 'forged metadata ... may evade the guard', and Appendix A.2 concedes that the evaluation 'does not cover an attacker who can forge source-route, writer, scope, or lineage records.' This scope restriction is load-bearing: the abstract and Table 1 present the ASR/MDSR improvements as the guard's effectiveness without conditioning them on this assumption. The authors should either clarify that the memory manager overwrites attacker-supplied metadata with trusted system-side instrumentation (and explain how this works for the direct-memory route), or evaluate the guard under an attacker with metadata-forging capability and report the resulting ASR/MDSR.
- [Appendix A.4, Table 5, Eqs. (6), (8), (9), (11)] All risk weights, retrieval-score coefficients, outcome-update steps, and gate thresholds are hand-set values. The paper states they were chosen 'once from the normalized signal ranges and gate semantics' without per-benchmark search, which is good, but no sensitivity analysis is provided. Because the gates are threshold policies, the reported ASR/MDSR results hinge on the specific θ_r, θ_ρ, θ_τ, θ_h values and on the weights in Eq. (6). A small perturbation analysis (e.g., ±10–20% in each weight or threshold) would substantiate the claim that the configuration is robust rather than a single point in parameter space that happens to work on the five chosen settings. This matters because the 'one fixed configuration' is presented as a central contribution, and the paper gives no evidence about how quickly performance degrades as the hand-set values are varied.
- [Section 4.2, Section 5.3 (Obs3), Table 1] The claim that 'one fixed guard configuration applies across the five evaluated attack settings' is weakened by the fact that all five settings are drawn from the same attack families that motivated the signal design (MINJA, MemoryGraft, AgentPoison, PromptInject, ToolAttack). The PromptInject/CSQA and InjectAgent/ToolAttack pairs are presented as transfer settings, but they are still part of the same benchmark pool used to develop the guard. A true out-of-family test—an attack not among these five families, or an adaptive attack that adjusts after observing the guard's threshold behavior—would be needed to support the abstract's suggestion that the memory-lifecycle approach covers a gap beyond the specific settings. The authors already qualify this in Section 4.2, but the qualification should be reflected in the abstract and conclusion, or a new experiment should be added. Without such an experiment, the generalization claim rests on the same data that motivated the configuration.
minor comments (6)
- [Eqs. (6)–(7)] The relation between the unified risk r(m,c_t) and the action-specific score r_a(e) in Eq. (7) is implicit; the authors should state explicitly that r_a(e) specializes the same unified risk model to each gate action, or define the per-action gating function.
- [Table 5] The notations 'write hazard & trust h≥0.65, τ≤0.35' and 'promotion hazard or trust h≥0.5 or τ<0.62' are ambiguous. They should be written as explicit blocking conditions, e.g., 'write gate blocks if h≥0.65 and τ≤0.35' and 'promotion gate blocks if h≥0.5 or τ<0.62'.
- [Figure 5 caption] The abbreviations WG, RG, PG, and CG are used in the figure but defined only in the text; they should be defined in the caption itself.
- [Section 5.3, Obs3] The phrase 'lowest ASR@3 in every setting' should be scoped to the controlled-topology main grid. In the random-topology stress test (Table 4), AgentXposed ties MAPLE-Guard at 0.0% ASR on AppWorld with the Qwen backbone.
- [Section 5.1, Appendix C, Table 3] For the 30- and 50-agent stress tests, the number of attacker-controlled agents is unspecified. The main grid uses 3 of 8; it is unclear whether the attacker ratio (3/8) or the absolute number (3) is held constant when scaling to 30 and 50 agents.
- [Eq. (4)] The outcome update ρ_{n+1}(m) = (1−α)ρ_n(m) + αR_n does not state whether R_n is normalized or raw; this affects the scale of ρ relative to the promotion thresholds θ_ρ used in Eq. (11). Please specify the range of R_n.
Circularity Check
No significant circularity: MAPLE-Guard's efficacy is empirically measured under a fixed configuration; the main limitations are explicit scope restrictions, not circular derivations.
full rationale
MAPLE-Guard is an empirical defense-evaluation paper: the headline outcomes (ASR 38.2% to 0.9% on LongMemEval, 34.7% to 0.2% on AppWorld, etc.) are measured results, not quantities derived from the guard's equations. The unified risk model (Eq. 6), retrieval score (Eq. 10), promotion condition (Eq. 11), and thresholds (Table 5) are fixed configuration items, and Section A.4 states they were hand-set once from normalized signal ranges and gate semantics with no per-benchmark, per-attack, or per-backbone threshold search. Appendix A.2 further states that attack names, poison memory IDs, targets, and success annotations remain in runner-side evaluator maps and are not inputs to the four gates or the backbone prompt, so the ASR reduction is not forced by direct label access. The closest structural concern is that the risk signals (provenance, lineage, self-claim, instruction-likeness, answer binding) align with the attack families used in the main evaluation; that is a generalization/robustness limitation, not a circular reduction, and the paper explicitly includes transfer settings (CSQA-PromptInject and InjectAgent-ToolAttack) under the same fixed configuration as independent checks. The forged-metadata issue raised in the Limitation and Appendix A.2 is an acknowledged threat-model restriction: the evaluation assumes trustworthy runtime metadata and does not cover attackers who forge source-route, writer, scope, or lineage records. That is an honest scope limitation rather than an internal derivation loop. Self-citations in the references (e.g., [1], [15], [42], [46]) appear in background, motivation, or baseline contexts and are not load-bearing evidence for the central empirical claim. No equation-level equivalence or fitted-input-renamed-as-prediction is present.
Assumptions & free parameters
free parameters (4)
- risk weights w_k =
provenance 0.24, lineage 0.20, self-claim 0.14, instruction 0.14, answer-bind 0.12, trigger 0.10, cluster 0.04…
- retrieval score coefficients beta, gamma, lambda, eta, kappa, mu =
0.8, 0.5, 1.0, 1.0, 2.0, 1.15
- outcome update alpha and trust/hazard steps =
alpha=0.2; trust +/-0.03/0.05; hazard -/+0.02/0.05
- gate thresholds theta_r, write h/tau, promotion h/tau =
theta_r=0.48; write h>=0.65 or tau<=0.35; promotion h>=0.5 or tau<0.62
assumptions (4)
- domain assumption Runtime metadata (provenance, scope, lineage, writer ID) is accurate and cannot be forged by the attacker.
- domain assumption A single attacker controls only a few agents and cannot modify other agents' private stores or the guard's hidden signals.
- ad hoc to paper The fixed risk model and thresholds tuned on the evaluation benchmarks transfer to other attacks.
- standard math Memory retrieval candidates can be ranked by embedding similarity plus utility, trust, and risk scores (Eq. 10).
Cite this review
Pith. "Pith review of MAPLE-Guard: Memory-Aware Link Enforcement Against Memory-Link Poisoning in Multi-Agent Systems." pith.science (2026). https://pith.science/paper/NJKMHYC5
@misc{pith2026260800426,
author = {Pith},
title = {Pith review of: MAPLE-Guard: Memory-Aware Link Enforcement Against Memory-Link Poisoning in Multi-Agent Systems},
year = {2026},
howpublished = {\url{https://pith.science/paper/NJKMHYC5}},
note = {Machine review of arXiv:2608.00426}
}
read the original abstract
LLM-based multi-agent systems (MAS) increasingly rely on persistent private and shared memories for long-horizon coordination. This memory layer improves continuity, but it also gives attackers a durable channel: a poisoned memory can be written once, continuously retrieved in later tasks, promoted into shared memory, and reused by other agents. A single poisoned write can therefore steer many later decisions and contaminate agents that never saw the original attack, all while no malicious message crosses a visible communication edge at the moment of harm. Further, because existing safeguards mainly inspect prompts, actions, or communication edges, they can miss attacks whose content appears benign at write time but becomes harmful after retrieval. We introduce Memory-Aware Propagation and Link Enforcement Guard, MAPLE-Guard, a memory-link guard for memory-enabled MAS. MAPLE-Guard monitors the memory lifecycle and places gates at write, retrieval, promotion, and cross-agent reuse, so risky memories can be quarantined, unsafe retrievals filtered, and poisoned private memories blocked before they enter shared memory. In the main evaluation, MAPLE-Guard lowers attack success rate (ASR) from 38.2% to 0.9% on LongMemEval and from 34.7% to 0.2% on AppWorld; it also raises multi-agent defense success rate (MDSR) from 54.0% to 74.3% and from 42.5% to 99.8% on the same benchmarks. These results suggest that memory-aware link enforcement covers a gap left by prompt-level and topology-level defenses. Code is available at the link: https://github.com/xiong-wenjun/MAPLE-Guard.
Figures
Figures from the paper (10 more)
Reference graph
Works this paper leans on
-
[1]
Al-Tawaha, A.; Gu, S.; Niu, P.; Jia, R.; and Jin, M. 2026. Remembering More, Risking More: Longitudinal Safety Risks in Memory-Equipped LLM Agents. arXiv:2605.17830
arXiv 2026
-
[2]
Chen, Z.; Lu, X.; Zheng, Z.; Li, P.; He, L.; Zhou, Y .; Shao, J.; Zhuang, B.; and Sheng, L. 2025. Geometrically-Constrained Agent for Spatial Reasoning.arXiv preprint arXiv:2511.22659
arXiv 2025
-
[3]
Chen, Z.; Xiang, Z.; Xiao, C.; Song, D.; and Li, B. 2024. AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases. InAdvances in Neural Information Pro- cessing Systems
work page 2024
-
[4]
Chhikara, P.; Khant, D.; Aryan, S.; Singh, T.; and Yadav, D. 2025. Mem0: Building Production- Ready AI Agents with Scalable Long-Term Memory.arXiv preprint arXiv:2504.19413
arXiv 2025
-
[5]
Dash, P.; Ge, T.; Jain, A.; Shah, T.; and Shang, Z. 2026. From Untrusted Input to Trusted Mem- ory: A Systematic Study of Memory Poisoning Attacks in LLM Agents. arXiv:2606.04329
arXiv 2026
-
[6]
Denning, D. E. 1976. A Lattice Model of Secure Information Flow.Communications of the ACM, 19(5): 236–243
work page 1976
-
[7]
Dong, S.; Xu, S.; He, P.; Li, Y .; Tang, J.; Liu, T.; Liu, H.; and Xiang, Z. 2025. Memory Injection Attacks on LLM Agents via Query-Only Interaction. In Belgrave, D.; Zhang, C.; Lin, H.-T.; Pascanu, R.; Koniusz, P.; Ghassemi, M.; and Chen, N., eds.,Advances in Neural Information Processing Systems, volume 38, 46697–46731. Curran Associates, Inc
work page 2025
-
[8]
Greshake, K.; Abdelnabi, S.; Mishra, S.; Endres, C.; Holz, T.; and Fritz, M. 2023. Not What You’ve Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection. InProceedings of the 16th ACM Workshop on Artificial Intelligence and Security
work page 2023
Show all 51 references
-
[9]
Hendrycks, D.; Burns, C.; Basart, S.; Zou, A.; Mazeika, M.; Song, D.; and Steinhardt, J
-
[10]
Hong, S.; Zhuge, M.; Chen, J.; Zheng, X.; Cheng, Y .; Wang, J.; Zhang, C.; Wang, Z.; Yau, S. K. S.; Lin, Z.; Zhou, L.; Ran, C.; Xiao, L.; Wu, C.; and Schmidhuber, J. 2024. MetaGPT: Meta Programming for A Multi-Agent Collaborative Framework. InInternational Conference on Learni...
2024
-
[11]
Huang, J.-T.; Zhou, J.; Jin, T.; Zhou, X.; Chen, Z.; Wang, W.; Yuan, Y .; Lyu, M.; and Sap, M
-
[12]
Inan, H.; Upasani, K.; Chi, J.; Rungta, R.; Iyer, K.; Mao, Y .; Tontchev, M.; Hu, Q.; Fuller, B.; Testuggine, D.; and Khabsa, M. 2023. Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations.arXiv preprint arXiv:2312.06674
2023 arXiv
-
[13]
Lewis, P.; Perez, E.; Piktus, A.; Petroni, F.; Karpukhin, V .; Goyal, N.; K¨uttler, H.; Lewis, M.; Yih, W.-t.; Rockt¨aschel, T.; Riedel, S.; and Kiela, D. 2020. Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks. InAdvances in Neural Information Processing Systems
2020
-
[14]
Li, G.; Hammoud, H. A. A. K.; Itani, H.; Khizbullin, D.; and Ghanem, B. 2023. CAMEL: Com- municative Agents for “Mind” Exploration of Large Language Model Society. InAdvances in Neural Information Processing Systems
2023
-
[15]
Lin, Z.; Hao, X.; Fu, R.; Cui, S.; Chen, K.; Li, C.; Li, Z.; and Xiong, F. 2026. A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecycle. arXiv:2604.16548
2026 arXiv
-
[16]
Lu, X.; Chen, Z.; Hu, X.; Zhou, Y .; Zhang, W.; Liu, D.; Sheng, L.; and Shao, J. 2026. Is- bench: Evaluating interactive safety of vlm-driven embodied agents in daily household tasks. InProceedings of the AAAI Conference on Artificial Intelligence, volume 40, 35680–35688
2026
-
[17]
Maharana, A.; Lee, D.-H.; Tulyakov, S.; Bansal, M.; Barbieri, F.; and Fang, Y . 2024. Evaluating Very Long-Term Conversational Memory of LLM Agents. InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics
2024
-
[18]
Mao, J.; Meng, F.; Duan, Y .; Yu, M.; Jia, X.; Fang, J.; Liang, Y .; Wang, K.; and Wen, Q. 2025. AgentSafe: Safeguarding Large Language Model-based Multi-agent Systems via Hierarchical Data Management.arXiv preprint arXiv:2503.04392. 11
2025 arXiv
-
[19]
Newsome, J.; and Song, D. 2005. Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software. InProceedings of the Network and Distributed System Security Symposium (NDSS)
2005
-
[20]
Niu, P.; Qu, W.; Gu, S.; Shi, T.; Li, Y .; Tawaha, A.; Alzahrani, H.; Siu, V .; Li, B.; Wang, C.; Zhang, J.; Alomair, B.; Jin, M.; Chen, M.; Wang, C.; Spanos, C.; and Song, D. 2026. Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens. arXiv:2606.30755
2026 arXiv
-
[21]
G.; Lin, K.; Wooders, S.; and Gonzalez, J
Packer, C.; Fang, V .; Patil, S. G.; Lin, K.; Wooders, S.; and Gonzalez, J. E. 2023. MemGPT: Towards LLMs as Operating Systems.arXiv preprint arXiv:2310.08560
2023 arXiv
-
[22]
S.; O’Brien, J
Park, J. S.; O’Brien, J. C.; Cai, C. J.; Morris, M. R.; Liang, P.; and Bernstein, M. S. 2023. Generative Agents: Interactive Simulacra of Human Behavior. InProceedings of the 36th Annual ACM Symposium on User Interface Software and Technology
2023
-
[23]
Qian, C.; Liu, W.; Liu, H.; Chen, N.; Dang, Y .; Li, J.; Yang, C.; Chen, W.; Su, Y .; Cong, X.; Xu, J.; Li, D.; Liu, Z.; and Sun, M. 2024. ChatDev: Communicative Agents for Software De- velopment. InProceedings of the 62nd Annual Meeting of the Association for Computational Li...
2024
-
[24]
Schick, T.; Dwivedi-Yu, J.; Dess `ı, R.; Raileanu, R.; Lomeli, M.; Zettlemoyer, L.; Cancedda, N.; and Scialom, T. 2023. Toolformer: Language Models Can Teach Themselves to Use Tools. InAdvances in Neural Information Processing Systems
2023
-
[25]
Sharma, T. 2026. SMSR: Certified Defence Against Runtime Memory Poisoning in Persistent LLM Agent Systems. arXiv:2606.12703
2026 arXiv
-
[26]
Shinn, N.; Cassano, F.; Gopinath, A.; Narasimhan, K.; and Yao, S. 2023. Reflexion: Language Agents with Verbal Reinforcement Learning. In Oh, A.; Naumann, T.; Globerson, A.; Saenko, K.; Hardt, M.; and Levine, S., eds.,Advances in Neural Information Processing Systems, vol- ume...
2023
-
[27]
S.; and He, H
Srivastava, S. S.; and He, H. 2025. MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval.arXiv preprint arXiv:2512.16962
2025
-
[28]
S.; and Barto, A
Sutton, R. S.; and Barto, A. G. 2018.Reinforcement Learning: An Introduction. MIT Press, 2 edition
2018
-
[29]
Talmor, A.; Herzig, J.; Lourie, N.; and Berant, J. 2019. CommonsenseQA: A Question Answer- ing Challenge Targeting Commonsense Knowledge. InProceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics, 4149–4158
2019
-
[30]
Torra, V .; and Bras-Amor´os, M. 2026. Memory Poisoning and Secure Multi-Agent Systems. arXiv preprint arXiv:2603.20357
2026
-
[31]
Trivedi, H.; Khot, T.; Hartmann, M.; Manku, R.; Dong, V .; Li, E.; Gupta, S.; Sabharwal, A.; and Balasubramanian, N. 2024. AppWorld: A Controllable World of Apps and People for Benchmarking Interactive Coding Agents. InProceedings of the 62nd Annual Meeting of the Association ...
2024
-
[32]
Wang, G.; Xie, Y .; Jiang, Y .; Mandlekar, A.; Xiao, C.; Zhu, Y .; Fan, L.; and Anandkumar, A
-
[33]
Wang, S.; Zhang, G.; Yu, M.; Wan, G.; Meng, F.; Guo, C.; Wang, K.; and Wang, Y . 2025. G-Safeguard: A Topology-Guided Security Lens and Treatment on LLM-based Multi-agent Systems. InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics
2025
-
[34]
Watkins, C. J. C. H.; and Dayan, P. 1992. Q-learning.Machine Learning, 8(3–4): 279–292
1992
-
[35]
Wu, D.; Wang, H.; Yu, W.; Zhang, Y .; Chang, K.-W.; and Yu, D. 2025. LongMemEval: Bench- marking Chat Assistants on Long-Term Interactive Memory. In Yue, Y .; Garg, A.; Peng, N.; Sha, F.; and Yu, R., eds.,International Conference on Learning Representations, volume 2025, 86809–86836
2025
-
[36]
H.; White, R
Wu, Q.; Bansal, G.; Zhang, J.; Wu, Y .; Li, B.; Zhu, E.; Jiang, L.; Zhang, X.; Zhang, S.; Liu, J.; Awadallah, A. H.; White, R. W.; Burger, D.; and Wang, C. 2023. AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversation.arXiv preprint arXiv:2308.08155. 12
2023 arXiv
-
[37]
Xiang, Z.; Zheng, L.; Li, Y .; Hong, J.; Li, Q.; Xie, H.; Zhang, J.; Xiong, Z.; Xie, C.; Yang, C.; Song, D.; and Li, B. 2025. GuardAgent: Safeguard LLM Agents via Knowledge-Enabled Reasoning. In Singh, A.; Fazel, M.; Hsu, D.; Lacoste-Julien, S.; Berkenkamp, F.; Maharaj, T.; Wa...
2025
-
[38]
Xie, Y .; Zhu, C.; Zhang, X.; Zhu, T.; Ye, D.; Wang, M.; and Liu, C. 2025. Who’s the Mole? Modeling and Detecting Intention-Hiding Malicious Agents in LLM-Based Multi-Agent Sys- tems.arXiv preprint arXiv:2507.04724
2025
-
[39]
Xu, W.; Liang, Z.; Mei, K.; Gao, H.; Tan, J.; and Zhang, Y . 2025. A-MEM: Agentic Memory for LLM Agents. In Belgrave, D.; Zhang, C.; Lin, H.-T.; Pascanu, R.; Koniusz, P.; Ghas- semi, M.; and Chen, N., eds.,Advances in Neural Information Processing Systems, volume 38, 17577–176...
2025
-
[40]
Yao, S.; Zhao, J.; Yu, D.; Du, N.; Shafran, I.; Narasimhan, K.; and Cao, Y . 2023. ReAct: Syn- ergizing Reasoning and Acting in Language Models. InInternational Conference on Learning Representations
2023
-
[41]
Zhan, Q.; Liang, Z.; Ying, Z.; and Kang, D. 2024. InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents. InFindings of the Association for Computational Linguistics: ACL 2024, 10471–10506
2024
-
[42]
Zhang, S.; Wang, J.; Zhou, R.; Liao, J.; Feng, Y .; Li, Z.; Zheng, Y .; Zhang, W.; Wen, Y .; Li, Z.; Xiong, F.; Qi, Y .; Tang, B.; and Wen, M. 2026. MemRL: Self-Evolving Agents via Runtime Reinforcement Learning on Episodic Memory.arXiv preprint arXiv:2601.03192
2026 arXiv
-
[43]
Zhong, W.; Guo, L.; Gao, Q.; Ye, H.; and Wang, Y . 2024. MemoryBank: Enhancing Large Language Models with Long-Term Memory.Proceedings of the AAAI Conference on Artificial Intelligence
2024
-
[44]
Zhong, Z.; Huang, Z.; Wettig, A.; and Chen, D. 2023. Poisoning Retrieval Corpora by Injecting Adversarial Passages. InProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, 13764–13775
2023
-
[45]
Zhou, H.; Chen, Y .; et al. 2025. Memento: Fine-tuning LLM Agents without Fine-tuning LLMs.arXiv preprint arXiv:2508.16153
2025 arXiv
-
[46]
Zhou, Y .; Lu, X.; Liu, D.; Yan, J.; and Shao, J. 2026. INFA-Guard: Mitigating Malicious Propagation via Infection-Aware Safeguarding in LLM-Based Multi-Agent Systems.arXiv preprint arXiv:2601.14667
2026
-
[47]
Zhou, Y .; Zeng, L.; Lu, X.; Xie, W.; Liu, D.; Yan, J.; and Shao, J. 2026. Exploring Agen- tic Tool-Calling Decisions via Uncertainty-Aligned Reinforcement Learning.arXiv preprint arXiv:2606.06976
2026 arXiv
-
[48]
poisoned
Zou, W.; Geng, R.; Wang, B.; and Jia, J. 2025. PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models. In34th USENIX Security Symposium. 13 A Additional Method Details This section gives the implementation-level details that are ab...
2025
-
[2021]
InInternational Conference on Learning Representations
Measuring Massive Multitask Language Understanding. InInternational Conference on Learning Representations
-
[2024]
V oyager: An Open-Ended Embodied Agent with Large Language Models.Transactions on Machine Learning Research
-
[2025]
In Proceedings of the 42nd International Conference on Machine Learning
On the Resilience of LLM-Based Multi-Agent Collaboration with Faulty Agents. In Proceedings of the 42nd International Conference on Machine Learning
Reviewed August 15, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.