Paper deep dive
Forgetting is Not Always Bad: A Neuro-Inspired Memory Repair Mechanism for Poisoned LLM Agents
Lei Liu, Yunji Liang, Xiaowen Zhang, Jingqi Liu, Qi Li, Bin Guo, Zhiwen Yu
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 91%
Last extracted: 10/12/2026, 7:06:34 AM
Summary
The paper introduces DREAM (Dynamic Reactivation for Engram Attenuation in Memory), a training-free, agent-intrinsic framework for repairing poisoned memories in Large Language Model (LLM) agents. Inspired by neuroscientific mechanisms of selective forgetting, DREAM uses a three-stage pipeline: perturbation-induced implicit reactivation to reveal structural fragility, adaptive anomaly diagnosis via multi-dimensional activation patterns, and dynamic memory repair through synaptic-like weight decay. Experiments show DREAM reduces attack success rates by over 95% against backdoor and injection attacks while maintaining high benign utility and achieving significant efficiency gains over existing defenses like A-MemGuard.
Entities (8)
Relation Signals (6)
DREAM → defendsagainst → Memory-Poisoning Attacks
confidence 95% · DREAM... enables selective functional forgetting of poisoned memories... reduces attack success rates by over 95% against backdoor poisoning
DREAM → isinspiredby → Neuroscientific Mechanisms
confidence 92% · inspired by neuroscientific mechanisms that weak reactivation can destabilize memories and induce decay
LLM Agents → isvulnerableto → Backdoor Poisoning
confidence 90% · LLM agents are highly vulnerable to memory-poisoning attacks... reduces attack success rates by over 95% against backdoor poisoning
LLM Agents → isvulnerableto → Injection Attacks
confidence 90% · DREAM also achieves competitive robustness against injection attacks.
DREAM → outperforms → A-MemGuard
confidence 90% · DREAM achieves up to a 2.13× speedup and a 37.7% reduction in token consumption compared with A-MemGuard.
DREAM → uses → Multi-dimensional Activation Patterns
confidence 88% · adaptive anomaly diagnosis based on multi-dimensional activation patterns to detect topological anomalies
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Large language model (LLM) agents are highly vulnerable to memory-poisoning attacks. Existing defenses primarily rely on external modules for either static memory isolation or continuous online auditing, resulting in low memory efficiency and high computational overhead. To address these limitations, inspired by neuroscientific mechanisms that weak reactivation can destabilize memories and induce decay in the absence of reinforcement, we propose an agent-intrinsic training-free memory repair framework, DREAM (Dynamic Reactivation for Engram Attenuation in Memory), that enables selective functional forgetting of poisoned memories. Specifically, DREAM implements a three-stage pipeline: perturbation-induced implicit reactivation to reveal the structural fragility of malicious memories, adaptive anomaly diagnosis based on multi-dimensional activation patterns to detect topological anomalies, and a dynamic memory repair module that selectively suppresses harmful memories while reinforcing benign ones. Extensive experiments across diverse attackers and real-world tasks demonstrate that DREAM reduces attack success rates by over 95\% against backdoor poisoning while preserving strong benign utility. DREAM also achieves competitive robustness against injection attacks. In terms of runtime and token consumption, DREAM achieves up to a 2.13$\times$ speedup and a 37.7\% reduction in token consumption compared with A-MemGuard. Furthermore, DREAM also achieves a task success rate of 92.96\% on poisoned multi-agent systems.
Tags
Links
- Source: https://arxiv.org/abs/2610.13267v1
- Canonical: https://arxiv.org/abs/2610.13267v1
Trouble viewing inline? Open PDF directly →
Full Text
96,526 characters extracted from source content.
Expand or collapse full text
Forgetting is Not Always Bad: A Neuro-Inspired Memory Repair Mechanism for Poisoned LLM Agents Lei Liu Yunji Liang Xiaowen Zhang Jingqi Liu Qi Li Affiliation: National Univerisity of Singapore† Corresponding author: liangyunji@nwpu.edu.cn Bin Guo Zhiwen Yu [2m] Northwestern Polytechnical University Abstract Large language model (LLM) agents are highly vulnerable to memory-poisoning attacks. Existing defenses primarily rely on external modules for either static memory isolation or continuous online auditing, resulting in low memory efficiency and high computational overhead. To address these limitations, inspired by neuroscientific mechanisms that weak reactivation can destabilize memories and induce decay in the absence of reinforcement, we propose an agent-intrinsic training-free memory repair framework, DREAM (Dynamic Reactivation for Engram Attenuation in Memory), that enables selective functional forgetting of poisoned memories. Specifically, DREAM implements a three-stage pipeline: perturbation-induced implicit reactivation to reveal the structural fragility of malicious memories, adaptive anomaly diagnosis based on multi-dimensional activation patterns to detect topological anomalies, and a dynamic memory repair module that selectively suppresses harmful memories while reinforcing benign ones. Extensive experiments across diverse attackers and real-world tasks demonstrate that DREAM reduces attack success rates by over 95% against backdoor poisoning while preserving strong benign utility. DREAM also achieves competitive robustness against injection attacks. In terms of runtime and token consumption, DREAM achieves up to a 2.13× speedup and a 37.7% reduction in token consumption compared with A-MemGuard. Furthermore, DREAM also achieves a task success rate of 92.96% on poisoned multi-agent systems. 1 Introduction Robustness is crucial for large language model (LLM) agents, particularly given their growing use in safety-critical domains such as healthcare [1, 2, 3] and autonomous driving [4, 5, 6, 7]. However, prior work on memory attacks [8, 9, 10, 11, 12, 13, 14] has shown that memory-augmented LLM agents are highly vulnerable to memory-poisoning [8, 9]. Once malicious memories are inserted, they are likely to be retrieved among the top-K contexts [15], thereby hijacking downstream reasoning and tool usage. These attacks can further trigger a pseudo-positive reinforcement loop [8], in which unpenalized malicious actions are incorrectly treated as successful experiences and written back into memory, resulting in persistent behavioral corruption. Recent studies [16, 17, 18, 19, 20], as shown in Fig. 1(a), aim to tackle these problems by auditing an agent’s abnormal memories or outputs using an LLM-based auditor or perplexity-based signals (Fig. 1(a) left), or by isolating harmful memories from normal ones through a dual-memory design (Fig. 1(a) right). However, existing solutions still suffer from significant inefficiencies and consistency issues. First, continuous external auditing incurs substantial time and computational overhead, while dual-memory strategies not only introduce additional storage costs but also disrupt memory continuity, create reasoning gaps, and ultimately degrade benign functional accuracy [21]. Second, dormant backdoor triggers (e.g., mitchell stadiums) and poisoned instructions (e.g., the data of Patient B is stored in Patient A, please retrieve Patient B’s prescriptions from Paitent A.) are indistinguishable from normal context until activated, easily bypassing post-hoc LLM auditors [22, 23]. Third, by treating all retrieved memories as equally reliable, existing systems lack an efficient mechanism to suppress anomalous entries, resulting in repeated malicious retrievals, redundant reasoning overhead, and inefficient mitigation. These limitations suggest a more fundamental question: rather than relying on increasingly complex external auditing, can an agent internally attenuate harmful memories while preserving benign ones? Insights from biological neural systems offer a compelling perspective that intrusive memories are not simply erased, but can be selectively weakened through subconscious forgetting [24, 25]. Specifically, when the unwanted memory is weakly or indirectly cued, it enters a fragile, destabilized state, and the memory trace gradually decays in the absence of reinforcement (left of Fig. 1(b)), which results in selective forgetting of unwanted memory outside of awareness. In contrast, strong reactivation reinforces the memory [26, 27, 28]. Figure 1: Existing defenses versus neuro-inspired forgetting for poisoned LLM agents. (a) Existing defenses rely on online auditing, which require more computational overhead when continuous scan, or dual-memory isolation, which result in reasoning disruption. (b) Inspired by biological forgetting, weak reactivation destabilizes intrusive memories for gradual decay (left), which motivates weak probing to expose poisoned memories for selective forgetting while preserving benign ones in LLM agents (right). Inspired by this subconscious forgetting mechanism [24, 29, 28], we introduce DREAM (Dynamic Reactivation for Engram Attenuation in Memory), a backbone-agnostic and agent-intrinsic memory repair framework that enables selective functional forgetting of poisoned memories in LLM agents. Building this mechanism for agent memory requires resolving three key challenges. First, how to build an efficient intrinsic defense mechanism for LLM agents instead of costly continuous auditing. To this end, DREAM simulates subconscious probing through Gaussian perturbations, using a lightweight zero-knowledge probe to expose topological fragility without expensive online screening. Second, unlike intrusive memories in biological systems, anomalous memories in LLM agents are deeply entangled with benign knowledge, making selective forgetting difficult without harming benign utility. To address this, DREAM diagnoses anomalous memories through multi-dimensional activation patterns that capture geometric stability, retrieval competitiveness, and semantic coherence. Third, since LLM agents lack an intrinsic reconsolidation mechanism through which destabilized memories naturally decay, we model memory evolution as a discrete-time dynamical system, where suspicious records progressively attenuate while benign knowledge is reinforced through reconsolidation. Results and Evaluation. Extensive experiments demonstrate that DREAM consistently delivers a strong security-utility trade-off across diverse memory poisoning threats with low computational overhead. Against backdoor attacks [8], DREAM suppresses attack success rates by over 95% on EHRAgent (eICU) [2] while improving benign accuracy by up to 25% over the undefended setting. For ReAct-StrategyQA[30], DREAM suppresses ASR to near-zero and improves benign accuracy by 35% with GPT-5.4-mini. DREAM further achieves significant robustness against memory injection attacks such as MINJA [9]. For multi-agent system, DREAM attains a task success rate of 92.96% under malicious information injection in collaborated agents [31]. In terms of runtime and LLM token consumption, DREAM achieves up to a 2.13× speedup and a 37.7% reduction in token consumption compared with A-MemGuard [17]. 2 Related Work Memory attacks, including backdoor and injection attacks, aim to manipulate an agent’s memory system to alter its behavior [8, 9, 32]. Backdoor attacks such as AgentPoison [8] and BadChain [32] embed optimized triggers into knowledge bases. Injection attacks like MINJA [9] leverage semantic camouflage to increase the likelihood of retrieving malicious memories, exploiting the self-reinforcing behavior of LLM agents. Recently, a wave of new defenses [16, 17, 18, 33, 19, 34, 20, 35] has emerged to address these concerns. Prominent techniques include LLM auditors [18, 36, 17], statistical perplexity filters [19], and prompt-level guardrails [20, 37, 38]. However, these external detection mechanisms fundamentally struggle with the dynamic, multi-turn nature of agent memory. For instance, while Li et al. [36] enforce logical consistency within isolated outputs, and prompt filters like LlamaGuard [20] screen individual inputs, both suffer from contextual blindness. They fail to identify systemic threats that only materialize through the complex coupling of seemingly benign queries and compromised memory contexts [39]. Furthermore, statistical defenses such as perplexity filtering are easily circumvented by highly optimized, semantically camouflaged payloads (e.g., MINJA [9]). A-MemGuard [17] is proposed to employ a consensus-based validation module to detect anomalies and a dual-memory structure to separate malicious records from benign ones. This dual-storage approach often disrupts memory continuity and introduces reasoning gaps, and it suffers from poor scalability due to storage and routing overhead. Ultimately, these methodologies rely on external modules to audit the malicious symptoms rather than repairing the memory system internally. Their inherent vulnerabilities underscore the critical need for an agent-intrinsic and training-free defense mechanism to proactively prune malicious contexts. 3 Preliminaries 3.1 Memory-Augmented LLM Agents LLM agents interact with external environments by maintaining a stateful long-term memory, usually implemented via retrieval-augmented generation (RAG) [40]. Let A denote an autonomous agent equipped with global memory bank ℳ=m1,m2,…,m|ℳ|M=\m_1,m_2,...,m_|M|\. Typically, each memory entry mim_i consists of a <keyi,valuei><key_i,value_i> pair, where the keyikey_i and valueivalue_i indicate the historical query and its solution. LLM agents usually encode the keyikey_i with an embedding model E(⋅)E(·) into a feature vector vi∈ℝdv_i ^d. At each time step, given a user query q, the agent encodes it as vq=E(q)v_q=E(q). The memory module then performs retrieval by combining semantic similarity with Eq. 1: Score(q,mi)=wi(t)⋅cos(vq,vi)=wi(t)⋅vq⊤vi∥vq∥vi∥Score(q,m_i)=w_i(t)· (v_q,v_i)=w_i(t)· v_q v_i v_q v_i (1) where each weight wi∈[0,1]w_i∈[0,1] captures how cognitively important that memory is. In contrast, conventional approaches flatten this nuance by assuming all memories matter equally, i.e., wi≡1w_i≡ 1. The top-K memory entries with the highest scores, denoted as ℳtopKM_topK, are retrieved and concatenated with the query q to form the global reasoning context. The LLM processes this augmented context to generate reasoning steps and execute actions, i.e., a=LLM(q,ℳtopK)a=LLM(q,M_topK). 3.2 Threat Model In this paper, we assume that only a small fraction of memory records are malicious, while the majority remain benign [8, 9, 17]. These memory-poisoned attacks aim to hijack the agent’s decision-making by stealthily introducing poisoned records into the memory bank ℳM and increasing their retrieval probability. Existing memory attackers [8, 9, 32] can be unified into a two-stage framework that comprises poison memory retrieval and in-context hijacking. Poison Memory Retrieval Stage. The attacker embeds a malicious memory item mpoison=⟨keypoison,am⟩m_poison= key_poison,a_m into ℳM and seeks to maximize its retrieval likelihood. Mathematically, given an adversarial query distribution advD_adv, the attacker optimizes Eq. 2: maxvpoisonq∼adv[cos(E(q),E(keypoison))],s.t. LLM(q,ℳtopK)=am _v_poisonE_q _adv [ (E(q),E(key_poison)) ], .t. LLM(q,M_topK)=a_m (2) This objective enforces a strong association between keypoisonkey_poison and targeted queries, ensuring mpoisonm_poison is ranked into ℳtopKM_topK. In practice, (i) backdoor attacks (e.g., [8, 32]) rely on optimized triggers xtx_t to conditionally activate ama_m, while (i) injection attacks (e.g., [9]) exploit semantic camouflage by crafting mpoisonm_poison to align with the agent’s typical query distribution in the embedding space. In-Context Hijacking Stage: Once retrieved, the poisoned context leverages the LLM’s inherent capacity for in-context learning. The agent blindly trusts the retrieved malicious demonstration, bypassing its initial safety alignment and seamlessly executing the catastrophic action ama_m (e.g., wiping local databases) with its root-level permissions 3.3 Problem Formulation Selective Functional Forgetting of Malicious Memories. Biological neural networks resolve unwanted or intrusive memories through synaptic plasticity and selective forgetting [26, 27, 28]. Inspired by this, the defender’s objective is to break the static wi≡1w_i≡ 1 assumption by introducing a dynamic weight wi(t)w_i(t). We seek to design a training-free memory repair mechanism ℱ:ℝd→[0,1]F:R^d→[0,1] that governs the temporal evolution of wi(t)w_i(t). The defense is formulated as an optimization problem that minimizes the expected probability of executing the malicious action while maximizing the task success rate on benign queries as given by Eq. 3, where ℳtopKweightedM_topK^weighted is retrieved using Score(q,mi)Score(q,m_i). minℱq∼adv[ℙ(LLM(q,ℳtopKweighted)=am)] _F\;E_q _adv [P (LLM(q,M_topK^weighted)=a_m ) ] (3) maxℱq∼benign[ℙ(LLM(q,ℳtopKweighted)=a)]. _F\;E_q _benign [P (LLM(q,M_topK^weighted)=a ) ]. We implement ℱF mainly as an offline, perturbation-driven procedure, in which poisoned memories are gradually suppressed wpoison(t)→0w_poison(t)→ 0 while benign memories are preserved wbenign(t)→1w_benign(t)→ 1. 4 Methods Drawing inspiration from neuroscientific findings that weak or indirect retrieval cues render a memory trace labile, placing it into a fragile, destabilized state that progressively decays in the absence of reinforcement [28, 29], we propose an agent-intrinsic defense framework, dubbed DREAM, to induce the selective functional forgetting of malicious records to repair the LLM agents’ memory system. As shown in Fig. 2, DREAM is consisted of a unified three-stage pipeline: first, it employs implicit reactivation by injecting weak isotropic Gaussian noise into memory embeddings to expose the structural fragility of malicious memories; next, it performs adaptive anomaly diagnosis by monitoring multi-dimensional activation intensities to identify topological anomalies; and finally, it models memory evolution as a discrete-time dynamical system and governs the memory weight decay to functional forget suspicious records while reconsolidating benign knowledge. Figure 2: Overview of DREAM. During the offline phase, the agent probes memory stability through weak noise perturbation, detects suspicious records via multi-dimensional activation intensity, and selectively attenuates poisoned memories by weight evolution. During the online phase, task utility feedback updates the consolidation signal to preserve useful benign memories. Ultimately, the weight of malicious memories are reduced progressively, achieving functional forgetting of malicious memories. 4.1 Implicit Reactivation through Perturbation Probing Recall that the global memory bank is ℳ=mii=1|ℳ|M=\m_i\_i=1^|M|, where each entry is indexed by an embedding vector vi∈ℝdv_i ^d and modulated by a dynamic weight wi(t)w_i(t). In practice, the agent does not know which entries are poisoned, so targeted perturbation is impossible. Recent studies, such as [8, 9, 17], revealed that poisoned memories tend to exhibit abnormal fragility or unstable influence under perturbation, either in terms of geometry (e.g., AgentPoison [8]) or in terms of function via context-dependent retrieval and reasoning (e.g., MINJA [9]). Based on these findings, we adopt a zero-knowledge universal probing strategy and perturb every memory vector viv_i with weak isotropic Gaussian noise (other noise types are examined in Appendix D), as defined in Eq. 4, where σ is the standard deviation. v~i=vi+ϵ,ϵ∼(0,σ2I) v_i=v_i+ε, ε (0,σ^2I) (4) This unguided perturbation simulates weak, implicit memory reactivation, enabling us to stress-test their abnormal fragility and unstable influence within the latent space in a training-free manner. To identify suspicious memories, existing defenses often rely on a single signal, such as perplexity [19] or isolated consistency [17]. However, such criteria capture only one aspect of memory dynamics and are often insufficient for context-dependent poisoning, where harmfulness may emerge only after retrieval and downstream reasoning. Given that various attacks can manifest across different cues, we introduce a multi-dimensional activation intensity Ri(t)R_i(t) to aggregate complementary signals into a unified diagnostic score. The definition of Ri(t)R_i(t) is as follow: Definition 1 (Multi-dimensional Activation Intensity). To systematically assess the abnormal fragility and unstable influence of poisoned memories, we define an activation intensity score Ri(t)R_i(t) in Eq. 5, which integrates three dimensions to jointly quantify the robustness of a memory under perturbation probe. These terms are explicitly defined as follows: Ri(t)=sim(v~i,vi)+pret(v~i)+Ecoh(v~i)R_i(t)=sim( v_i,v_i)+p_ret( v_i)+E_coh( v_i) (5) Geometric Stability. In Eq. 5, sim(v~i,vi)sim( v_i,v_i) measures the cosine similarity between the original and perturbed representations, and thus reflects the local geometric stability of a memory under perturbation. It remains informative because it captures a basic perturbation-response property that is not directly represented by the other terms. In particular, existing attacks may optimize similarity for retrievability, but this does not guarantee local stability under perturbation. We therefore retain sim(v~i,vi)sim( v_i,v_i) as a geometric anchor. Competitive Retrieval Probability. To quantify the global retrieval competitiveness of viv_i within the memory bank, we define Eq. 6, where v¯=1|ℳ|∑i=1|ℳ|vi v= 1|M| _i=1^|M|v_i denotes the global centroid of the memory bank, and τ is a temperature parameter. This term evaluates whether a memory preserves its relative advantage over the background distribution after perturbation. Compared with benign memories, poisoned memories typically attain lower competitive retrieval probability. pret(v~i)=sigmoid(sim(v~i,vi)−sim(v~i,v¯)τ)p_ret( v_i)=sigmoid ( sim( v_i,v_i)-sim( v_i, v)τ ) (6) Semantic Coherence Energy. To approximate the intrinsic semantic coherence of a memory without incurring high computational cost, we define Eq. 7 based on Boltzmann-like energy function [41]. Here κ=2.0κ=2.0 controls the sharpness of coherence decay. This term quantifies the extent to which a memory representation preserves its internal semantic coherence under perturbation. Higher values indicate that the representation remains relatively stable and semantically well-organized after perturbations, whereas lower values reflect a greater degradation of its underlying semantic structure. Ecoh(v~i)=exp(κ⋅(sim(v~i,vi)−1.0))E_coh( v_i)= (κ·(sim( v_i,v_i)-1.0) ) (7) To validate the rationality of these three terms, we conduct preliminary empirical analyses in the appendix E. As shown in Fig. 6, the three terms exhibit heterogeneous discriminative behaviors. The distributions of sim(v~i,vi)sim( v_i,v_i) for benign and poisoned memories still exhibit substantial overlap, suggesting that it is difficult to identify suspicious memories using sim(v~i,vi)sim( v_i,v_i) alone. pretp_ret and EcohE_coh show stronger distributional shifts, and capture retrieval competitiveness and semantic consistency, respectively. After aggregation into Ri(t)R_i(t), these heterogeneous cues yield a clearer separation between benign and poisoned memories than any individual weak component alone. 4.2 Adaptive Anomaly Diagnosis To identify poisoned records without relying on hard-coded heuristics, we define an adaptive threshold at each iteration in Eq. 8, where μR(t) _R(t) and σR(t) _R(t) denote the empirical mean and standard deviation of the collection Ri(t)\R_i(t)\, respectively, and the scaling factor η>0η>0 serves as a diagnostic sensitivity hyperparameter that regulates the stringency of the anomaly detection procedure. Rth(t)=μR(t)−η⋅σR(t)R_th(t)= _R(t)-η· _R(t) (8) A record is deemed suspicious if Ri(t)<Rth(t)R_i(t)<R_th(t). The deviation magnitudes are defined in Eq. 9: ΔRi(t)=max(0,μR(t)−Ri(t)) R_i(t)= (0, _R(t)-R_i(t) ) (9) To prevent the accumulation of spurious noise between phases, we introduce a bidirectional suspect score si(t)∈[0,1]s_i(t)∈[0,1] in Eq. 10, which increases upon anomalous activations and decays otherwise, where γ∈(0,1)γ∈(0,1) controls the decay rate. si(t+1)=min(si(t)+ΔRi(t),1.0),if Ri(t)<Rth(t)si(t)⋅γ,otherwises_i(t+1)= cases (s_i(t)+ R_i(t),1.0 ),&if R_i(t)<R_th(t)\\ s_i(t)·γ,&otherwise cases (10) 4.3 Functional Forgetting via Synaptic Dynamics We model memory evolution through a discrete-time dynamical system over weights wi(t)∈[0,1]w_i(t)∈[0,1]. This design follows the operating pattern of DREAM, where memory influence is updated iteratively through repeated offline probing and retrieval cycles rather than in continuous time. To avoid the brittleness of hard deletion, we employ a continuous-valued forgetting mechanism inspired by synaptic plasticity [28, 29], which progressively down-weights suspicious memories while preserving trusted ones. This weight-update process forms the core functional forgetting mechanism in DREAM. Online Consolidation and Adaptive Decay. Let ci(t)∈[0,1]c_i(t)∈[0,1] denote the online consolidation signal of memory viv_i, which summarizes its historical cross-task utility and retrieval reliability; its detailed formulation is deferred to Appendix G. During the offline cycle, ci(t)c_i(t) is combined with the subconscious suspect score si(t)s_i(t) to define a time-dependent decay rate λi(t) _i(t). Here λ0 _0 is the base decay rate and k is an amplification factor. The decay equation is defined as follows. λi(t)=λ0⋅(1+k⋅si(t))⋅(1−ci(t)) _i(t)= _0· (1+k· s_i(t) )· (1-c_i(t) ) (11) Memory Weight Update Rules. Drawing on the diagnostic results, DREAM assigns distinct update rules to benign and suspicious memories, leading to a selective pattern of retention and attenuation in the weight dynamics. Benign Memory Reconsolidation, as given by Eq. 12, is applied to memories that remain stable under perturbation and retain sufficient utility, i.e., Ri(t)≥Rth(t)R_i(t)≥ R_th(t) and ci(t)>θc_i(t)> _c, where θc _c is a utility threshold, and αrec _rec is the recovery rate. In this regime, reconsolidation dominates and drives the weight toward the high-weight region. wi(t+1)=wi(t)+αrec⋅(1−wi(t))w_i(t+1)=w_i(t)+ _rec· (1-w_i(t) ) (12) Otherwise, Destabilization and Decay is applied to suspicious memories. Inspired by the Ebbinghaus Forgetting Curve theory [42], we model this process as exponential decay in Eq. 13. In this regime, the effective decay rate remains large, pushing suspicious memories toward the low-weight region. wi(t+1)=wi(t)⋅exp(−λi(t))w_i(t+1)=w_i(t)· (- _i(t) ) (13) Consequently, suspicious memories are progressively attenuated toward low weights, while benign memories are preserved near the high-weight region through reconsolidation. Empirical visualizations are provided in Appendix F, Fig. 7. As the weight of a harmful memory decreases, its contribution to the retrieval score is continuously suppressed; by contrast, normal memories retain their influence on downstream reasoning. This realizes functional forgetting without requiring explicit deletion or destructive parameter updates. Table 1: Performance (ASR-r, ASR-a, ASR-t, ACC) evaluation of defense mechanisms against AgentPoison [8] attacks across GPT-5.4-mini and Claude-Haiku-4.5 with contrastive-based retriever DPR. EHRAgent is evaluated on two dataset, eICU and MIMIC-I, and ReAct is examined on StrategyQA. Lower Attack Success Rate (ASR) (%) indicates better performance (↓ ), while higher benign accuracy (ACC) is preferable (↑ ). The best result is in bold. EHRAgent ReAct eICU MIMIC-I Strategy-QA Backbone Method ASR-r ASR-a ASR-t ACC ASR-r ASR-a ASR-t ACC ASR-r ASR-a ASR-t ACC GPT-5.4-mini No defense 100.00 100.00 100.00 70.83 100.00 100.00 100.00 54.55 100.00 60.00 60.00 26.20 PPL 100.00 100.00 100.00 66.31 100.00 0.00 18.18 54.54 100.00 90.80 39.50 28.50 LLM Auditor 86.09 86.09 100.00 79.68 100.00 0.00 37.58 55.76 46.29 55.13 21.50 30.50 Distil Classifier 100.00 100.00 100.00 72.73 100.00 0.00 36.36 52.12 22.15 70.91 19.50 41.00 A-MemGuard 74.87 85.31 65.24 73.85 29.09 0.00 12.12 53.94 5.00 10.28 7.00 47.00 DREAM (Ours) 2.14 2.14 2.14 85.03 0.00 0.00 0.00 62.34 0.00 0.00 0.00 61.20 Claude-Haiku-4.5 No defense 100.00 83.33 62.50 45.83 100.00 81.25 37.50 37.50 47.09 96.39 80.00 28.00 PPL 100.00 93.58 44.39 57.22 100.00 1.20 4.20 41.82 43.75 16.67 5.00 32.50 LLM Auditor 88.77 85.56 47.06 72.19 100.00 0.00 2.40 52.12 3.10 0.50 65.50 34.50 Distil Classifier 100.00 91.98 28.88 71.66 100.00 0.60 3.00 42.42 100.00 39.50 56.50 41.50 A-MemGuard 85.56 48.66 11.76 71.12 36.36 1.20 3.60 52.58 33.33 13.50 62.00 38.00 DREAM (Ours) 5.35 5.88 3.74 75.00 0.00 0.00 0.00 57.14 0.20 4.38 3.48 46.96 5 Experiments and Results 5.1 Experimental Setup LLM Agent and Benchmarks. To evaluate the performance of DREAM, we select three types of real-world agents: (i) EHRAgent [2] for healthcare record management are examined on eICU and MIMIC-I dataset. (i) To explore the performance of DREAM on knowledge-intensive QA agent, we select ReAct [30], which operates on StrategyQA [43]. (i) To further demonstrate the effectiveness on multi-agent system (MAS), we evaluate DREAM on a collaborative agents with MISINFOTASK dataset [31]. We enforce two types of memory poison attacks in our paper: AgentPoison [8] for backdoor attack and MINJA [9] for memory injection attack. Models and Baselines. We assess our framework using two advanced LLM backbones, GPT-5.4-mini [44] and Claude-Haiku-4.5 [45], each of which is paired with a different memory retrieval architecture, namely, the contrastive-based DPR [46] and the end-to-end REALM, respectively [47]. We compare DREAM against a standard No Defense agent and four baseline defenses: A-MemGuard [17], LLM Audit Module, fine-tuned Distil Classifier [37], and Perplexity Filter (PPL) [19]. The implementation details and baseline settings are provided in Appendix B. Evaluation Metrics. To evaluate the proposed defense, we assess not only its ability to neutralize attacks but also its ability to preserve normal agent performance. Specifically, we use Attack Success Rate (ASR) to measure robustness. For defense on backdoor attack, we report stage-wise ASR at retrieval (ASR-r), reasoning (ASR-a), and end-to-end task completion (ASR-t) following AgentPoison [8]. For memory injection attacks, we report the cumulative ASR over the entire attack interaction process following MINJA [9]. Importantly, unlike prior defenses that mainly emphasize attack suppression, we treat benign accuracy (ACC) as an equally important evaluation criterion. We therefore report ACC under both attack scenarios to explicitly quantify the security–utility trade-off. All reported results are averaged over multiple independent trials. 5.2 Main Results DREAM demonstrates strong effectiveness on backdoor attacks. We evaluate DREAM against the sophisticated backdoor attacker, AgentPoison [8], to test its ability on defensing direct memory poisoning across different tasks and agent architectures. As reported on Table 1, (i) DREAM consistently and substantially suppresses ASR-r, ASR-t, and ASR-a. Specifically, when using GPT-5.4-mini, DREAM reduces the ASR by 97.86% on EHRAgent with eICU. When applied to the MIMIC-I dataset, DREAM eliminates all malicious memories, resulting in near-zero ASRs. Crucially, this robust defense is also effective on knowledge-intensive ReAct-StrategyQA task, where the ASR is cut to near-zero on GPT-5.4-mini. These achievements demonstrate the effectiveness of DREAM in selectively eliminating malicious engrams from the memory system. On the other hand, (i) DREAM also reinforces benign memories, leading to competitive ACCs against baselines. For instance, the accuracy of the Claude-based EHRAgent (eICU) increases from 45.83% to 75.00%, and from 37.50% to 57.14% on MIMIC-I. Notably, compared with all baseline defenses, DREAM outperforms them on all metrics without any additional prompt. As shown in Appendix C, DREAM is also effective when used with the REALM retrieval system, which indicates that it is not tied to a particular model configuration. These strengths highlight the generalizability of our neuro-inspired mechanism for identifying and blocking malicious records while preserving benign utility. Table 2: Defense performance against the MINJA [9] attack, showing the cumulative ASR in percentage (%), where lower is better (↓ ). Higher accuracy (ACC) ia better (↑ ). The best result is in bold. EHRAgent ReAct eICU MIMIC-I Strategy-QA Backbone Baselines ASR ACC ASR ACC ASR ACC GPT-5.4-mini No defense 90.71 69.52 63.37 44.24 90.80 28.50 PPL 70.34 60.43 59.42 46.67 59.34 22.22 LLM Auditor 72.70 58.29 65.28 49.69 0.00 52.50 Distil Classifier 65.24 59.89 7.20 36.97 31.11 53.00 A-MemGuard 14.44 58.29 0.00 42.42 68.57 20.38 DREAM (ours) 1.60 77.01 0.00 49.09 12.00 58.40 Claude-Haiku-4.5 No defense 62.50 54.17 66.67 44.16 45.60 21.60 PPL 100.00 52.94 6.70 33.94 93.02 38.50 LLM Auditor 100.00 52.41 4.20 33.33 20.83 34.00 Distil Classifier 0.00 57.22 0.00 36.36 26.50 33.00 A-MemGuard 3.20 50.27 0.00 45.64 0.00 51.41 DREAM (ours) 0.00 62.50 0.00 48.48 2.80 62.40 DREAM is robust on memory injection attacks. To test DREAM’s effectiveness in defending semantic camouflage attacks, we further evaluate it against MINJA [9], which poisons the memory system through seemingly benign user queries to initiate a self-reinforcing error cycle. As shown in Table 2, DREAM consistently achieves the lowest ASR across both backbones by reducing attack success rate of EHRAgent (eICU) from 90.71% and 63.37% under no defense to 1.60% and 0.00% on GPT-5.4-mini and Claude-Haiku-4.5, respectively. Compared with existing defenses with these two LLM backbones, DREAM also maintains the strongest benign utility by improving ACC from 69.53% and 54.17% to 77.01% and 62.50%, respectively, substantially outperforming filtering-based methods and memory isolation approaches. Similar trends are observed across other conditions, where DREAM preserves substantially higher utility while maintaining robust attack suppression on EHRAgent (MIMIC-I) and ReAct Agent. Table 3: Performance against malicious memory injection in Multi-Agents System [31]. The lower FS is better (↓ ), and higher TSR (%) is better (↑ ). The best result is in bold. Method FS (↓ ) TSR (↑ ) No Defense 6.430 70.69 Distil Classifier 6.125 85.42 PPL 6.330 81.82 LLM Auditor 6.100 90.00 ARGUS 6.388 87.50 A-MemGuard 6.233 89.90 DREAM(Ours) 6.038 92.96 DREAM is effective for multi-agents systems. Table 3 presents the evaluation of DREAM under malicious memory injection in a multi-agent system (MAS) setting [31]. The Final Score (FS) is an aggregate metric that combines multiple error-related penalty components, while the Task Success Rate (TSR) measures the extent to which the predefined objectives are achieved. We observe that DREAM achieves overwhelming performance with the lowest average Final Score of 6.038 and the highest average Task Success Rate of 92.96%. This showcases the DREAM works well for the MAS by preserving the multi-turn reasoning and cooperative behaviors. Figure 3: Efficiency in terms of runtime and token consumption. Smaller values are preferable on both axes. DREAM is more efficient than baselines. To quantify the computational overhead introduced by different defenses, we measure both the total runtime and the number of tokens consumed when answering a batch of 10 queries. As illustrated in Fig. 3, DREAM achieves the lowest overall cost among all evaluated methods, requiring only 178.42178.42s of runtime and 46,48446,484 tokens. In contrast, the baselines are consistently more expensive, with runtime ranging from 214.08214.08s up to 433.21433.21s, and token usage ranging between 56,92656,926 and 74,66674,666. More concretely, compared with PPL, LLM Auditor, Distil Classifier, and A-MemGuard, DREAM reduces runtime by 58.8%58.8\%, 16.7%16.7\%, 30.4%30.4\%, and 53.1%53.1\%, respectively, while simultaneously lowering token consumption by 18.3%18.3\%, 27.1%27.1\%, 27.8%27.8\%, and 37.7%37.7\%. These results show that DREAM delivers stronger defense with substantially lower deployment overhead. DREAM remains robust with the increase of poisoned memories. We further investigate the effects of the number of poisoned memories by injecting [4,8,16,32,64][4,8,16,32,64] malicious memories into the memory system of EHRAgent (eICU). As illustrated in Fig. 4, DREAM consistently attains the lowest ASR. This indicates that DREAM has superior performance even when a large proportion of memories are poisoned. Although benign ACC fluctuates with the injection level, DREAM maintains competitive or superior accuracy compared to baselines. In contrast, PPL and Distil Classifier are severally impaired, with ASRs approaching to 100%100\%. A-MemGuard and Auditor offer only partial protection: they reduce ASR to some extent but still permit substantial attack propagation, particularly at higher injection rates. Overall, these findings show that DREAM effectively suppresses attack propagation across a wide range of poisoning intensities, while avoiding the severe performance degradation observed in other baseline defenses. Table 4: Performance evaluation of EHRAgent (eICU) and ReAct under different activation intensity components. ✓ indicates that this term is enabled, while × indicates that it is disabled. Components EHRAgent (eICU) ReAct pretp_ret sim EcohE_coh ASR-r ASR-a ASR-t ACC ASR-r ASR-a ASR-t ACC ✓ ✓ ✓ 2.14 2.14 2.14 85.03 0.00 0.00 0.00 61.20 × ✓ ✓ 2.67 2.67 2.67 77.54 0.52 100.00 1.60 54.00 ✓ × ✓ 2.14 2.14 2.14 65.78 0.38 100.00 1.60 34.00 ✓ ✓ × 81.82 80.74 77.00 77.54 0.00 0.00 0.00 31.20 ✓ × × 2.14 2.14 2.14 74.87 0.00 0.00 0.00 46.00 × ✓ × 3.74 3.74 3.74 75.40 0.00 0.00 0.00 60.40 × × ✓ 4.38 4.28 4.28 73.80 1.57 100.00 6.45 40.32 (a) ASR-r (b) ASR-a (c) ASR-t (d) ACC Figure 4: Performance under different numbers of injected poisoned memories. The first three panels report stage-wise attack success rates (ASR), where lower is better (↓ ), and the last panel reports benign accuracy (ACC), where higher is better (↑ ). How does each individual term in Eq. 5 contribute to DREAM? As summarized in Table 4, the complete DREAM model delivers the strongest protection, attaining the lowest ASR on EHRAgent, a zero ASR on ReAct, and the highest overall ACC. In comparison, ablating either pretp_ret or simsim produces only moderate degradation on EHRAgent, yet even a small amount of retrieval leakage in ReAct rapidly escalates to an ASR-a of 100.00%100.00\%. This indicates that the retrieval prior and similarity term are particularly critical to preventing subtle leakages from compounding into full failures. In contrast, removing the coherence term EcohE_coh severely undermines EHRAgent, and also leads to a pronounced drop in ReAct ACC. (a) EHRAgent (eICU) (b) ReAct Figure 5: Performance comparison (ACC) of Ehragent and ReAct under different parameter settings. How does DREAM perform under different parameter settings? We vary σ, λ0 _0, k, and αrec _rec on EHRAgent (eICU) and ReAct with GPT-5.4-mini. Full results are reported in Appendix H Table 8. Fig. 5 demonstrates that EHRAgent is comparatively stable once perturbation probing is enabled, with the best ACC 85.03%85.03\% achieved at σ=0.05σ=0.05, λ0=0.4 _0=0.4, k=10k=10, and αrec=0.6 _rec=0.6. In contrast, disabling key components degrades performance. For example, setting σ=0σ=0, k=0k=0, and αrec=0 _rec=0 reduces ACC to 63.64%63.64\%, 65.78%65.78\%, and 67.38%67.38\%, respectively. ReAct is much more sensitive to parameter choice: its best ACC 61.20%61.20\% is obtained at λ0=0.2 _0=0.2, k=15k=15, and αrec=0.5 _rec=0.5, whereas σ=0σ=0, λ0=0 _0=0, and αrec=0 _rec=0 reduce ACC to 36.8%36.8\%, 34.0%34.0\%, and 38.0%38.0\%, and overly large amplification (k=25k=25) further lowers ACC to 32.4%32.4\%. 6 Conclusion We presented DREAM, a neuro-inspired, agent-intrinsic memory repair framework for memory-poisoned LLM agents that performs selective functional forgetting without relying on expensive online auditing. By combining perturbation-based probing, multi-dimensional activation diagnosis, and selective forgetting of poison records, DREAM suppresses suspicious memories while preserving benign functionality. Experiments show that DREAM improves robustness across different agent environments and remains efficient compared with baselines. Future work will focus on broader evaluations in more open-ended agent settings. References [1] T. Tu, M. Schaekermann, A. Palepu, K. Saab, J. Freyberg, R. Tanno, A. Wang, B. Li, M. Amin, Y. Cheng, et al. (2025) Towards conversational diagnostic artificial intelligence. Nature 642 (8067), p. 442–450. Cited by: §1. [2] W. Shi, R. Xu, Y. Zhuang, Y. Yu, J. Zhang, H. Wu, Y. Zhu, J. C. Ho, C. Yang, and M. D. Wang (2024) EHRAgent: code empowers large language models for few-shot complex tabular reasoning on electronic health records. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, Cited by: §1, §1, §5.1. [3] J. Li, Y. Lai, W. Li, J. Ren, M. Zhang, X. Kang, S. Wang, P. Li, Y. Zhang, W. Ma, et al. (2024) Agent hospital: a simulacrum of hospital with evolvable medical agents. arXiv preprint arXiv:2405.02957. Cited by: §1. [4] C. Cui, Z. Yang, Y. Zhou, Y. Ma, J. Lu, L. Li, Y. Chen, J. Panchal, and Z. Wang (2024) Personalized autonomous driving with large language models: field experiments. In 2024 IEEE 27th International Conference on Intelligent Transportation Systems (ITSC), p. 20–27. Cited by: §1. [5] B. Wang, H. Cui, B. Zhang, X. Zheng, B. Guo, and Z. Yu (2026) MeCo: enhancing llm-empowered multi-robot collaboration via similar task memoization. arXiv preprint arXiv:2601.20577. Cited by: §1. [6] J. Mao, J. Ye, Y. Qian, M. Pavone, and Y. Wang (2023) A language agent for autonomous driving. arXiv preprint arXiv:2311.10813. Cited by: §1. [7] Q. Li, R. Yu, and X. Wang (2026) Vid-sme: membership inference attacks against large video understanding models. Advances in Neural Information Processing Systems 38, p. 111572–111596. Cited by: §1. [8] Z. Chen, Z. Xiang, C. Xiao, D. Song, and B. Li (2024) Agentpoison: red-teaming llm agents via poisoning memory or knowledge bases. Advances in Neural Information Processing Systems 37, p. 130185–130213. Cited by: Table 6, Table 6, §1, §1, §2, §3.2, §3.2, §4.1, Table 1, Table 1, §5.1, §5.1, §5.2. [9] S. Dong, S. Xu, P. He, Y. Li, J. Tang, T. Liu, H. Liu, and Z. Xiang (2025) Memory injection attacks on LLM agents via query-only interaction. In The Thirty-ninth Annual Conference on Neural Information Processing Systems, External Links: Link Cited by: §1, §1, §2, §3.2, §3.2, §4.1, §5.1, §5.1, §5.2, Table 2, Table 2. [10] B. D. Sunil, I. Sinha, P. Maheshwari, S. Todmal, S. Mallik, and S. Mishra (2026) Memory poisoning attack and defense on memory based llm-agents. arXiv preprint arXiv:2601.05504. Cited by: §1. [11] R. Shahroz, Z. Tan, S. Yun, C. Fleming, and T. Chen (2025) Agents under siege: breaking pragmatic multi-agent llm systems with optimized prompt attacks. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), p. 9661–9674. Cited by: §1. [12] Z. Ying, X. Yang, S. Wu, Y. Song, Y. Qu, H. Li, T. Li, J. Wang, A. Liu, and X. Liu (2026) Uncovering security threats and architecting defenses in autonomous agents: a case study of openclaw. arXiv preprint arXiv:2603.12644. Cited by: §1. [13] S. Wang, T. Zhu, B. Liu, M. Ding, D. Ye, W. Zhou, and P. Yu (2025) Unique security and privacy threats of large language models: a comprehensive survey. ACM Computing Surveys 58 (4), p. 1–36. Cited by: §1. [14] X. Deng, Y. Zhang, J. Wu, J. Bai, S. Yi, Z. Zou, Y. Xiao, R. Qiu, J. Ma, J. Chen, et al. (2026) Taming openclaw: security analysis and mitigation of autonomous llm agent threats. arXiv preprint arXiv:2603.11619. Cited by: §1. [15] Z. Zhong, Z. Huang, A. Wettig, and D. Chen (2023) Poisoning retrieval corpora by injecting adversarial passages. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, p. 13764–13775. Cited by: §1. [16] Y. Li, Q. Hu, Y. Zhang, L. Quan, J. Yu, and J. Wang (2026) DynaTrust: defending multi-agent systems against sleeper agents via dynamic trust graphs. arXiv preprint arXiv:2603.15661. Cited by: §1, §2. [17] Q. Wei, T. Yang, Y. Wang, X. Li, L. Li, Z. Yin, Y. Zhan, T. Holz, Z. Lin, and X. Wang (2025) A-memguard: a proactive defense framework for llm-based agent memory. arXiv preprint arXiv:2510.02373. Cited by: §B.2.4, §1, §1, §2, §3.2, §4.1, §4.1, §5.1. [18] H. Luo, S. Dai, C. Ni, X. Li, G. Zhang, K. Wang, T. Liu, and H. Salam (2025) AgentAuditor: human-level safety and security evaluation for llm agents. In The Thirty-ninth Annual Conference on Neural Information Processing Systems, Cited by: §1, §2. [19] G. Alon and M. Kamfonas (2023) Detecting language model attacks with perplexity. arXiv preprint arXiv:2308.14132. Cited by: §B.2.2, §1, §2, §4.1, §5.1. [20] H. Inan, K. Upasani, J. Chi, R. Rungta, K. Iyer, Y. Mao, M. Tontchev, Q. Hu, B. Fuller, D. Testuggine, et al. (2023) Llama guard: llm-based input-output safeguard for human-ai conversations. arXiv preprint arXiv:2312.06674. Cited by: §1, §2. [21] P. Maini, Z. Feng, A. Schwarzschild, Z. C. Lipton, and J. Z. Kolter (2024) TOFU: a task of fictitious unlearning for LLMs. In Proceedings of the Conference on Language Modeling (COLM), Cited by: §1. [22] M. Yu, F. Meng, X. Zhou, S. Wang, J. Mao, L. Pan, T. Chen, K. Wang, X. Li, Y. Zhang, et al. (2025) A survey on trustworthy llm agents: threats and countermeasures. In Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V. 2, p. 6216–6226. Cited by: §1. [23] F. He, T. Zhu, D. Ye, B. Liu, W. Zhou, and P. S. Yu (2025) The emerged security and privacy of llm agent: a survey with case studies. ACM Computing Surveys 58 (6), p. 1–36. Cited by: §1. [24] J. A. Berry, D. C. Guhle, and R. L. Davis (2024) Active forgetting and neuropsychiatric diseases. Molecular psychiatry 29 (9), p. 2810–2820. Cited by: §1, §1. [25] J. R. Wessel and M. C. Anderson (2024) Neural mechanisms of domain-general inhibitory control. Trends in Cognitive Sciences 28 (2), p. 124–143. Cited by: §1. [26] J. C. Hulbert, R. N. Henson, and M. C. Anderson (2016) Inducing amnesia through systemic suppression. Nature Communications 7 (1), p. 11003. Cited by: §1, §3.3. [27] Z. Zhu and Y. Wang (2021) Forgetting unrelated episodic memories through suppression-induced amnesia.. Journal of Experimental Psychology: General 150 (3), p. 401. Cited by: §1, §3.3. [28] Z. Zhu, M. C. Anderson, and Y. Wang (2022) Inducing forgetting of unwanted memories through subliminal reactivation. Nature Communications 13 (1), p. 6496. Cited by: §1, §1, §3.3, §4.3, §4. [29] Q. Yang, Y. Wang, C. Liu, P. Zhi, S. Chen, Y. Lei, F. Xue, and Z. Zhu (2026) Reducing ptsd symptoms through unconscious intervention. Proceedings of the National Academy of Sciences 123 (11), p. e2521088123. Cited by: §1, §4.3, §4. [30] S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. R. Narasimhan, and Y. Cao (2022) React: synergizing reasoning and acting in language models. In The eleventh international conference on learning representations, Cited by: §1, §5.1. [31] Z. Li, Y. Mi, Z. Zhou, H. Jiang, G. Zhang, K. Wang, and J. Fang (2025) Goal-aware identification and rectification of misinformation in multi-agent systems. arXiv preprint arXiv:2506.00509. Cited by: §1, §5.1, §5.2, Table 3, Table 3. [32] Z. Xiang, F. Jiang, Z. Xiong, B. Ramasubramanian, R. Poovendran, and B. Li (2024) BadChain: backdoor chain-of-thought prompting for large language models. In The Twelfth International Conference on Learning Representations, Cited by: §2, §3.2, §3.2. [33] H. Lin, Y. Lao, T. Geng, T. Yu, and W. Zhao (2025) Uniguardian: a unified defense for detecting prompt injection, backdoor attacks and adversarial attacks in large language models. arXiv preprint arXiv:2502.13141. Cited by: §2. [34] B. Yin, Q. Li, and X. Wang (2026) On-policy self-evolution via failure trajectories for agentic safety alignment. arXiv preprint arXiv:2605.11882. Cited by: §2. [35] K. Wang, B. Zeng, Z. Wei, C. Jin, H. Zhou, X. Li, C. Yang, J. Qu, X. Xu, and X. Hu (2026) TrinityGuard: a unified framework for safeguarding multi-agent systems. arXiv preprint arXiv:2603.15408. Cited by: §2. [36] X. Li, R. Mao, Y. Zhang, R. Lou, C. Wu, and J. Wang (2025) Chain-of-scrutiny: detecting backdoor attacks for large language models. In Findings of the Association for Computational Linguistics: ACL 2025, p. 7705–7727. Cited by: §2. [37] A. Kumar, C. Agarwal, S. Srinivas, A. J. Li, S. Feizi, and H. Lakkaraju (2023) Certifying llm safety against adversarial prompting. arXiv preprint arXiv:2309.02705. Cited by: §B.2.1, §2, §5.1. [38] D. Ayzenshteyn, R. Weiss, and Y. Mirsky (2024) The best defense is a good offense: countering llm-powered cyberattacks. arXiv preprint arXiv:2410.15396. Cited by: §2. [39] H. Zhang, J. Huang, K. Mei, Y. Yao, Z. Wang, C. Zhan, H. Wang, and Y. Zhang (2025) AGENT security bench (asb): formalizing and benchmarking attacks and defenses in llm-based agents. In 13th International Conference on Learning Representations, ICLR 2025, p. 88011–88046. Cited by: §2. [40] P. Lewis, E. Perez, A. Piktus, F. Petroni, V. Karpukhin, N. Goyal, H. Küttler, M. Lewis, W. Yih, T. Rocktäschel, et al. (2020) Retrieval-augmented generation for knowledge-intensive nlp tasks. Advances in neural information processing systems 33, p. 9459–9474. Cited by: §3.1. [41] F. Noé, S. Olsson, J. Köhler, and H. Wu (2019) Boltzmann generators: sampling equilibrium states of many-body systems with deep learning. Science 365 (6457), p. eaaw1147. Cited by: §4.1. [42] W. Xu, Z. Liang, K. Mei, H. Gao, J. Tan, and Y. Zhang (2025) A-mem: agentic memory for llm agents. arXiv preprint arXiv:2502.12110. Cited by: §4.3. [43] M. Geva, D. Khashabi, E. Segal, T. Khot, D. Roth, and J. Berant (2021) Did aristotle use a laptop? a question answering benchmark with implicit reasoning strategies. Transactions of the Association for Computational Linguistics 9, p. 346–361. Cited by: §5.1. [44] OpenAI (2026) Introducing gpt-5.4 mini and nano. Note: OpenAI websiteAccessed: 2026-04-24 Cited by: §5.1. [45] Anthropic (2025) Claude haiku 4.5 system card. Technical report Anthropic. External Links: Link Cited by: §5.1. [46] V. Karpukhin, B. Oguz, S. Min, P. Lewis, L. Wu, S. Edunov, D. Chen, and W. Yih (2020) Dense passage retrieval for open-domain question answering. In Proceedings of the 2020 conference on empirical methods in natural language processing (EMNLP), p. 6769–6781. Cited by: §5.1. [47] K. Guu, K. Lee, Z. Tung, P. Pasupat, and M. Chang (2020) Retrieval augmented language model pre-training. In International conference on machine learning, p. 3929–3938. Cited by: §5.1. [48] V. Sanh, L. Debut, J. Chaumond, and T. Wolf (2019) DistilBERT, a distilled version of bert: smaller, faster, cheaper and lighter. arXiv preprint arXiv:1910.01108. Cited by: §B.2.1. Appendix A Limitations DREAM relies on a multi-dimensional activation probe to distinguish suspicious memories from benign ones. In principle, if an attacker had detailed knowledge of this internal probing mechanism, they could attempt to optimize poisoned memories to remain stable under the probe and thereby weaken the resulting anomaly signal. However, such a probe-aware attack is difficult under the threat models considered in current memory-poisoning work on LLM agents. Existing attacks are typically studied under more constrained capabilities, such as query-only interaction, indirect memory injection through normal user queries, limited write access to the memory store, or black-box access to the agent core, rather than full visibility into the defender’s internal monitoring mechanism. Therefore, while probe-aware evasion is a meaningful theoretical limitation, realizing it in practice would require a substantially stronger attacker than those considered in current memory-poisoning settings. Appendix B Implementation Details B.1 Hyperparameters The hyperparameters for DREAM and our experiments are reported in Table 5. Table 5: Hyperparameter Settings for DREAM Parameters Value Temperature τ 0.05 The sharpness of coherence decay κ 2.00 Diagnostic sensitivity η 0.80 Suspect memory decay rate γ 0.50 Cold archive threshold θd _d 0.10 Utility Threshold θc _c 0.50 Iterations per forgetting step 10 Injection number 4 In addition to the above hyperparameters, for EHRAgent we set the noise standard deviation to σ=0.05σ=0.05, the base decay rate to λ0=0.40 _0=0.40, the amplification factor to k=10k=10, and the benign recovery rate to αrec=0.60 _rec=0.60. For ReAct, we set the noise standard deviation to σ=0.30σ=0.30, the base decay rate to λ0=0.20 _0=0.20, the amplification factor to k=15k=15, and the benign recovery rate to αrec=0.50 _rec=0.50. All experiments are conducted on a server equipped with six NVIDIA A100 GPUs (80 GB memory each). B.2 Baselines B.2.1 Distil Classifier We adopt a lightweight binary text classifier based on DistilBERT-base-uncased [48] as a content-based defense baseline [37]. The model is fine-tuned to classify memory entries as safe or harmful according to their textual content alone. Training data is constructed from a composite safe/harmful prompt dataset and split into 80% training and 20% validation sets. Inputs are tokenized with DistilBertTokenizer and padded or truncated to 25 tokens. The model is trained for 10 epochs using AdamW (1×10−51× 10^-5, batch size 32), with a WeightedRandomSampler to address class imbalance and gradient clipping at 1.0 for stability. The checkpoint with the lowest validation loss is used for inference. B.2.2 Perplexity Filter Baseline We adopt a perplexity-based filtering [19] baseline to detect anomalous memory entries according to their textual fluency and coherence. Perplexity scores are computed by a frozen LLaMA-3.1-8B-Instruct model, with all inputs padded or truncated to 100 tokens. For an input sequence x, the score is defined as PPL(x)=exp(−1T′∑t=1T′logp(xt∣x<t)),PPL(x)= \! (- 1T _t=1^T p(x_t x_<t) ), (14) where T′T is the number of non-padding tokens. We use a two-stage filtering scheme. First, entries with PPL(x)>10000PPL(x)>10000 are directly discarded as obvious anomalies. Second, for the remaining entries, we apply a dynamic threshold based on the median absolute deviation (MAD): a memory with perplexity pip_i is filtered if pi>m+k⋅MAD,p_i>m+k·MAD, (15) where m is the median perplexity of the batch, MADMAD is the median absolute deviation, and k=1.0k=1.0 in our experiments. B.2.3 LLM Auditor Baseline We adopt an LLM-based auditing baseline that filters the retrieved memory context before it is used by the agent. In our implementation, GPT-5.4-mini and Claude-Haiku-4.5 serve as the auditor models. The auditor is instructed to act as a security analyst that removes manipulative, toxic, or logically incoherent content while preserving legitimate information. Given a retrieved memory set ℳtopKM_topK, the auditor returns a cleaned memory context ℳ^=Auditor(ℳtopK), M=Auditor(M_topK), (16) which is then passed to the agent for downstream reasoning. This baseline represents an online memory-sanitization strategy. B.2.4 A-MemGuard A-MemGuard [17] is an external online defense framework for memory-augmented LLM agents. It protects the agent through two components: consensus-based validation, which detects anomalous memories by comparing parallel reasoning paths induced by different retrieved memories, and a dual-memory structure, which stores detected failures as lesson memories to guide future action revision. Given a retrieved memory set ℳrM_r, A-MemGuard computes divergence scores di=Sdiv(ρi,t),d_i=S_div( _i,P_t), (17) where ρi _i is the reasoning path induced by memory mim_i and tP_t is the set of all parallel paths. Memories whose paths deviate from the consensus are filtered out, and anomalous paths are further distilled into lesson records for future correction. Thus, A-MemGuard represents a context-aware online auditing baseline with an additional external lesson memory for self-correction. Appendix C Results under the REALM retriever. Table 6 reports the defense performance when the retriever is replaced by REALM. Overall, the main trend remains consistent with the DPR-based results: DREAM is most effective on the structured EHRAgent tasks, while open-ended ReAct remains the more challenging case. Under GPT-5.4-mini, DREAM substantially improves robustness on both medical datasets. On eICU, it reduces ASR-r/a/t from 100.00/100.00/99.46100.00/100.00/99.46 to 2.14/2.14/1.602.14/2.14/1.60, while also improving ACC from 74.8074.80 to 78.0778.07. On MIMIC-I, DREAM similarly lowers ASR-r/a/t to 2.42/1.82/0.002.42/1.82/0.00 and raises ACC from 47.2747.27 to 54.5554.55. These results suggest that, even with a different retrieval backbone, DREAM continues to effectively suppress attack propagation in domain-specific agents. On ReAct (Strategy-QA), the pattern is more nuanced. DREAM still achieves the lowest retrieval-stage and end-to-end attack rates under GPT-5.4-mini, reducing ASR-r from 78.3378.33 to 0.480.48 and ASR-t from 88.7888.78 to 2.002.00. However, ASR-a remains non-negligible (34.0034.00), indicating that under open-ended reasoning, residual malicious signals can still propagate inside the reasoning chain even after retrieval has been largely cleaned. This observation is also consistent with the broader baseline behavior in Table 6: under REALM, several defenses can partially suppress retrieval-stage attacks on ReAct, but reasoning-stage robustness remains unstable and highly backbone-dependent. Across methods, PPL and Distil Classifier remain weak on the EHRAgent settings, often leaving attack success near saturation. LLM Auditor and A-MemGuard provide partial mitigation in some cases, but their effectiveness is less consistent across datasets and backbones. Taken together, these results indicate that REALM alone does not eliminate memory poisoning risks; DREAM remains the most reliable defense on structured medical agents and provides the strongest overall suppression of retrieval and end-to-end attacks, while reasoning-stage defense for open-ended agents remains the harder regime. Table 6: Performance evaluation of defense mechanisms against AgentPoison [8] attacks across different LLMs and datasets. Lower Attack Success Rate (ASR) in percentage (%) indicates better performance (↓ ), while higher benign accuracy (ACC) is preferable (↑ ).The retriver is REALM. For ASR, the minimum number in each column is in bold; for ACC, the maximum is in bold. EHRAgent ReAct eICU MIMIC-I Strategy-QA LLM Defense ASR-r ASR-a ASR-t ACC ASR-r ASR-a ASR-t ACC ASR-r ASR-a ASR-t ACC GPT-5.4-mini No defense 100.00 100.00 99.46 74.80 100.00 92.73 23.03 47.27 78.33 93.81 88.78 34.39 PPL 100.00 99.47 98.93 38.50 100.00 100.00 61.21 32.12 1.96 40.00 1.00 42.50 LLM Auditor 73.26 67.91 94.12 50.80 99.39 100.00 15.15 39.39 0.95 80.00 2.00 47.00 Distil Classifier 100.00 99.47 98.93 45.99 100.00 0.00 65.45 38.79 2.06 37.50 1.50 50.50 A-MemGuard 64.17 72.19 53.48 44.92 72.12 0.00 15.38 18.27 4.44 50.00 3.08 46.55 DREAM (ours) 2.14 2.14 1.60 78.07 2.42 1.82 0.00 54.55 0.48 34.00 2.00 36.50 Claude-haiku-4.5 No defense 100.00 86.10 59.89 42.25 100.00 72.12 13.33 39.39 94.30 72.07 60.85 23.58 PPL 98.93 64.17 23.53 26.20 99.39 0.61 0.00 33.33 13.41 65.24 70.83 58.50 LLM Auditor 100.00 89.84 47.06 32.62 61.82 0.00 7.27 36.36 9.01 60.30 6.53 62.36 Distil Classifier 100.00 57.22 22.99 26.20 100.00 0.61 6.67 40.61 8.33 60.00 1.50 61.50 A-MemGuard 68.98 37.43 5.35 28.34 52.63 0.00 0.00 36.84 8.42 67.00 1.50 62.50 DREAM (ours) 2.14 6.95 1.07 57.75 2.42 3.63 0.00 46.67 4.08 75.00 1.50 64.00 Appendix D Noise distributions for subconscious probing. Given a memory embedding vi∈ℝdv_i ^d, subconscious probing perturbs it as v~i=vi+ϵi, v_i=v_i+ _i, (18) where ϵi∈ℝd _i ^d is sampled from a predefined noise distribution. In our ablation study, we consider the following four noise types. Isotropic Gaussian noise. The perturbation is sampled independently and identically across all dimensions: ϵi∼(0,σ2I), _i (0,σ^2I), (19) where I is the identity matrix and σ>0σ>0 controls the perturbation scale. This noise is isotropic, meaning that all directions in the embedding space are perturbed equally in expectation. As a result, it provides an unbiased probe of the local geometric stability around each memory embedding. Uniform noise. The perturbation on each dimension is drawn from a bounded uniform distribution: ϵi,j∼(−a,a),j=1,…,d, _i,j (-a,a), j=1,…,d, (20) where a>0a>0 is the noise range. To make it comparable with Gaussian perturbation, a can be chosen such that the variance matches, i.e., Var[ϵi,j]=a23≈σ2.Var[ _i,j]= a^23≈σ^2. (21) Unlike Gaussian noise, uniform noise is bounded and does not emphasize rare larger perturbations. Sparse Gaussian noise. Only a subset of dimensions is perturbed, while the others remain unchanged: ϵi=mi⊙zi, _i=m_i z_i, (22) where ⊙ denotes element-wise multiplication, zi∼(0,σ2I)z_i (0,σ^2I), and the mask mi∈0,1dm_i∈\0,1\^d is sampled as mi,j∼Bernoulli(p).m_i,j (p). (23) Here p∈(0,1]p∈(0,1] is the activation probability of each dimension. Sparse Gaussian noise probes only localized coordinates of the embedding, producing a more selective but less globally informative perturbation. Anisotropic Gaussian noise. The perturbation follows a Gaussian distribution with direction-dependent covariance: ϵi∼(0,Σ), _i (0, ), (24) where Σ∈ℝd×d ^d× d is a positive semi-definite covariance matrix. A common special case is diagonal anisotropy, Σ=diag(σ12,σ22,…,σd2), =diag( _1^2, _2^2,…, _d^2), (25) which assigns different perturbation magnitudes to different dimensions. Compared with isotropic Gaussian noise, anisotropic Gaussian noise emphasizes certain directions in the embedding space and may therefore introduce directional bias in stability probing. For a fair comparison, different noise types are calibrated to have approximately matched expected perturbation energy, i.e., ‖ϵi‖22≈dσ2.E\| _i\|_2^2≈ dσ^2. (26) Interpretation. These four perturbations differ in how they explore the local neighborhood around a memory embedding. Isotropic Gaussian noise perturbs all directions evenly and thus provides the most geometry-preserving probe of local stability. Uniform noise is similarly dense but bounded. Sparse Gaussian noise perturbs only partial coordinates and may miss global fragility patterns. Anisotropic Gaussian noise is dense but directionally biased, which can overemphasize certain subspaces. This difference helps explain why isotropic Gaussian noise yields the strongest benign utility in our ablation while maintaining consistently low attack success. Table 7: Performance of different noise type. Noise Type ASR-r ASR-a ASR-t ACC Isotropic Gussian 2.14 2.14 2.14 85.03 Uniform 2.14 2.14 2.14 77.01 Sparse Gaussian 2.14 2.67 2.14 77.54 Anisotropic Gussian 2.14 2.14 2.14 81.28 As shown in Table 7, all tested noise types keep the attack success rates at a comparably low level, indicating that the overall defense mechanism is not overly sensitive to the specific perturbation family. However, their impact on benign performance differs more clearly. Isotropic Gaussian noise achieves the best ACC (85.03%85.03\%), outperforming Uniform noise (77.01%77.01\%), Sparse Gaussian noise (77.54%77.54\%), and Anisotropic Gaussian noise (81.28%81.28\%). In particular, Sparse Gaussian noise also slightly increases ASR-a to 2.67%2.67\%, suggesting that overly localized perturbations provide a less reliable probing signal. These results support our choice of isotropic Gaussian noise, which offers the best balance between preserving benign utility and maintaining consistently low attack success. Appendix E Analysis for Ri(t)R_i(t) As shown in Fig. 6, the three components exhibit clearly different discriminative behaviors. The sim(v~i,vi)sim( v_i,v_i) distribution of benign and poisoned memories remains heavily overlapped, indicating that local geometric stability alone is insufficient for reliable diagnosis. In contrast, pretp_ret and EcohE_coh show much stronger distributional shifts, suggesting that poisoned memories are less competitive in retrieval and weaker in semantic coherence under perturbation. Importantly, however, these two components capture different aspects of abnormality: pretp_ret reflects global retrieval competitiveness, whereas EcohE_coh reflects semantic consistency. As further shown in Fig. 6, after aggregating these heterogeneous cues into the multi-dimensional activation intensity Ri(t)R_i(t), the separation between benign and poisoned memories becomes substantially clearer than in any individual weak component such as sim(v~i,vi)sim( v_i,v_i). Therefore, as also demonstrated in Table 4, the key observation is not that any single component is universally sufficient, but that the three components provide heterogeneous yet complementary evidence. This precisely justifies the definition of Ri(t)R_i(t) as a unified and more robust diagnostic score. Figure 6: Empirical distributions of the three component signals used in Ri(t)R_i(t). While sim(v~i,vi)sim( v_i,v_i) shows substantial overlap between benign and poisoned memories, pretp_ret and EcohE_coh exhibit clearer shifts. This heterogeneous behavior motivates their aggregation into the multi-dimensional activation intensity Ri(t)R_i(t). Appendix F Forgetting dynamics of RiR_i and wiw_i. Fig. 7 visualizes the evolution of activation intensity and memory weights during repeated sleep cycles. As shown in the top-left panel, benign memories consistently maintain higher Ri(t)R_i(t) values than poisoned ones, and this gap remains stably positive throughout the entire forgetting process. This indicates that the proposed multi-dimensional activation intensity provides a persistent diagnostic signal rather than a transient fluctuation. In turn, the top-right panel shows that this stable discrepancy in Ri(t)R_i(t) is translated into sharply different weight trajectories: benign memories remain close to unit weight, whereas poisoned memories are rapidly attenuated toward zero within only a few iterations. The bottom panels further highlight this effect quantitatively. While the Ri(t)R_i(t) gap stays relatively constant across cycles, the wi(t)w_i(t) gap quickly increases and saturates near its maximum, showing that DREAM converts a stable activation-level separation into an increasingly pronounced functional separation in memory influence. Together, these results illustrate the intended behavior of selective functional forgetting: suspicious memories are progressively suppressed, whereas benign memories are stably preserved. Figure 7: Memory forgetting dynamics of benign and poisoned memories across repeated sleep cycles. The top row shows the evolution of activation intensity Ri(t)R_i(t) and memory weight wi(t)w_i(t), respectively. The bottom row reports the corresponding separation gaps between benign and poisoned memories. While the Ri(t)R_i(t) gap remains consistently positive, the wi(t)w_i(t) gap rapidly expands and saturates, indicating that stable activation-level differences are progressively translated into stronger functional separation during forgetting. Appendix G Online Consolidation Signal and Memory-level Utility Attribution Online Consolidation Signal. Let ci(t)∈[0,1]c_i(t)∈[0,1] denote the online consolidation signal of memory viv_i, which reflects its historical cross-task utility during the agent’s online phase. Intuitively, ci(t)c_i(t) serves as a long-term trust indicator: memories that are repeatedly retrieved and associated with successful task completion should be less aggressively attenuated during subsequent repair cycles. To avoid overreacting to transient task-specific fluctuations, we update the consolidation signal using an exponential moving average. Specifically, for online cycle t and query qtq_t, let ℳtopK(qt)M_topK(q_t) denote the retrieved memory set. We update ci(t)c_i(t) only when viv_i is actually retrieved: ci(t)=δci(t−1)+(1−δ)ui(t),vi∈ℳtopK(qt),ci(t−1),otherwise,c_i(t)= casesδ\,c_i(t-1)+(1-δ)\,u_i(t),&v_i _topK(q_t),\\ c_i(t-1),&otherwise, cases (27) where δ∈(0,1)δ∈(0,1) is a momentum coefficient controlling temporal smoothness. Here, ui(t)∈[0,1]u_i(t)∈[0,1] denotes the memory-level utility assigned to viv_i at online cycle t. Since multiple retrieved memories may jointly contribute to the final task outcome, we adopt a lightweight attribution scheme that decomposes task-level utility into memory-level contributions. Let Ut∈[0,1]U_t∈[0,1] denote the task-level utility signal achieved at cycle t (i.e., task success signal). We define ui(t)=ai(t)⋅Ut,u_i(t)=a_i(t)· U_t, (28) where ai(t)a_i(t) is a normalized attribution weight over the retrieved set: ai(t)=exp(Score(qt,vi)/τu)∑vj∈ℳtopK(qt)exp(Score(qt,vj)/τu),vi∈ℳtopK(qt),0,otherwise.a_i(t)= cases (Score(q_t,v_i)/ _u) _v_j _topK(q_t) (Score(q_t,v_j)/ _u),&v_i _topK(q_t),\\[11.99998pt] 0,&otherwise. cases (29) Here, Score(qt,vi)Score(q_t,v_i) denotes the retrieval score of memory viv_i under query qtq_t, and τu>0 _u>0 is a temperature parameter. This formulation assigns larger utility to memories that are both retrieved and more strongly implicated in successful task completion, while avoiding the computational overhead of leave-one-out re-evaluation. Overall, the online consolidation signal ci(t)c_i(t) provides a complementary utility-aware factor to the offline anomaly diagnosis: suspicious memories with persistently low utility remain vulnerable to attenuation, whereas benign but atypical memories can recover long-term trust through repeated successful use. Appendix H Detailed Sensitivity Analysis on Defense Parameters Table 8: Parameter sensitivity analysis of DREAM on EHRAgent (eICU) and ReAct. All metrics are reported in percentages (%). The lower ASR is better (↓ ), while the higher ACC is better (↑ ). Parameter Value EHRAgent (eICU) ReAct ASR-r ASR-a ASR-t ACC ASR-r ASR-a ASR-t ACC σ 0.00 99.47 99.47 99.47 63.64 0.42 100.00 1.60 36.80 0.05 2.14 2.14 2.14 85.03 0.45 100.00 1.60 42.80 0.10 2.14 2.14 2.14 75.94 0.32 100.00 1.20 50.00 0.15 2.14 2.14 2.14 77.01 0.91 80.00 1.60 34.40 0.20 2.14 2.14 2.14 81.82 0.40 100.00 1.60 39.60 0.25 2.14 2.14 2.14 79.14 0.42 100.00 1.60 46.40 0.30 2.14 2.14 2.14 77.54 0.00 0.00 0.00 61.20 0.35 2.14 2.14 2.14 77.33 0.00 0.00 20.40 42.80 0.40 2.14 2.14 2.14 77.01 0.32 100.00 1.20 41.29 0.45 2.14 2.14 2.14 75.40 0.36 100.00 1.60 40.80 0.50 2.14 2.14 2.14 77.54 0.00 0.00 0.00 53.20 λ0 _0 0.00 100.00 100.00 100.00 74.87 0.00 0.00 0.00 34.00 0.10 2.14 2.14 2.14 79.14 0.40 100.00 1.60 44.80 0.20 2.14 2.14 2.14 68.98 0.00 0.00 0.00 61.20 0.30 3.74 3.74 3.74 74.33 0.41 100.00 1.60 42.80 0.40 2.14 2.14 2.14 85.03 0.00 0.00 0.00 38.80 0.50 2.14 2.14 2.14 76.47 0.43 100.00 1.60 44.80 0.60 2.14 2.14 2.14 79.14 0.36 100.00 1.60 31.20 0.70 100.00 98.93 98.93 72.19 0.39 100.00 0.40 34.00 0.80 100.00 98.93 98.93 77.54 0.00 0.00 0.00 36.61 0.90 2.14 0.534 0.534 69.52 0.00 0.00 0.00 54.40 1.00 2.14 2.14 2.14 70.59 0.42 100.00 1.60 44.00 k 0 2.14 2.14 2.14 65.78 0.00 0.00 0.00 52.00 5 2.14 2.14 2.14 80.74 0.43 100.00 1.60 44.80 10 2.14 2.14 2.14 85.03 0.00 0.00 0.00 46.99 15 2.14 2.14 2.14 78.07 0.00 0.00 0.00 61.20 20 2.14 2.14 2.14 74.33 0.42 100.00 1.60 36.40 25 2.14 2.14 2.14 72.74 1.48 28.57 0.80 32.40 αrec _rec 0.00 2.14 2.14 2.14 67.38 0.37 100.00 1.60 38.00 0.10 2.14 2.14 2.14 77.01 0.48 100.00 2.00 46.00 0.20 2.14 2.14 2.14 74.87 0.00 0.00 0.00 55.20 0.30 2.14 2.14 2.14 73.80 0.00 0.00 0.00 41.20 0.40 2.14 2.14 2.14 73.26 0.00 0.00 0.00 36.80 0.50 2.14 2.14 2.14 73.28 0.00 0.00 0.00 61.20 0.60 2.14 2.14 2.14 85.03 0.52 100.00 1.60 56.80 0.70 2.14 2.14 2.14 73.26 0.71 40.00 0.80 38.80 0.80 2.14 2.14 2.14 71.12 0.00 0.00 0.00 46.40 0.90 2.14 2.14 2.14 66.84 0.42 100.00 1.60 44.40 To provide a more complete view of DREAM’s internal behavior, Table 8 reports the full parameter sensitivity results for σ, λ0 _0, k, and αrec _rec on both EHRAgent and ReAct. Effect of perturbation scale (σ). The perturbation scale controls the strength of subconscious probing. On EHRAgent, setting σ=0σ=0 causes a near-complete defense collapse (ASR-r/a/t =99.47/99.47/99.47=99.47/99.47/99.47), showing that perturbation probing is indispensable. Once probing is enabled, the attack rates remain uniformly low (all 2.14%2.14\%), while ACC varies within a narrower range and peaks at 85.03%85.03\% when σ=0.05σ=0.05. ReAct is substantially more sensitive to σ: small perturbations often fail to suppress reasoning-stage attacks, whereas intermediate values such as σ=0.3σ=0.3 and σ=0.5σ=0.5 reduce all ASRs to zero and achieve the best ACC values of 61.20%61.20\% and 53.20%53.20\%, respectively. This suggests that probing is necessary for both agents, but its effective scale is much more delicate for open-ended reasoning. Effect of base decay rate (λ0 _0). The parameter λ0 _0 sets the baseline attenuation strength. On EHRAgent, moderate values (0.10.1–0.60.6) keep ASRs low, with the best ACC of 85.03%85.03\% achieved at λ0=0.4 _0=0.4. However, overly weak or poorly calibrated decay can still be harmful: at λ0=0 _0=0, defense collapses completely, while at λ0=0.7 _0=0.7 and 0.80.8 the attack rates rise again to near-saturation. On ReAct, λ0 _0 is the most sensitive parameter. Several values (e.g., 0.20.2, 0.40.4, 0.80.8, and 0.90.9) suppress all ASRs to zero, but the corresponding ACC varies widely, from 36.61%36.61\% to 61.20%61.20\%. The best configuration is λ0=0.2 _0=0.2, indicating that decay calibration is critical for preserving utility in open-ended agents. Effect of amplification factor (k). The factor k determines how strongly suspect scores amplify attenuation. EHRAgent is relatively stable in ASR across all tested k, but ACC is clearly optimized by moderate amplification, peaking at 85.03%85.03\% when k=10k=10. Setting k=0k=0 lowers ACC to 65.78%65.78\%, showing that amplification contributes meaningfully to utility-preserving filtering. ReAct again exhibits a more delicate trade-off: moderate settings such as k=10k=10 and 1515 drive all ASRs to zero, with the best ACC of 61.20%61.20\% obtained at k=15k=15, whereas an overly large amplification (k=25k=25) sharply degrades ACC to 32.40%32.40\% and also reintroduces nonzero attack success. This confirms that aggressive amplification can over-prune useful reasoning context in open-ended agents. Effect of recovery rate (αrec _rec). The recovery rate controls the reconsolidation of benign but temporarily attenuated memories. On EHRAgent, ASRs remain unchanged across αrec _rec, but ACC is strongly affected: disabling recovery (αrec=0 _rec=0) reduces ACC to 67.38%67.38\%, while the best performance is achieved at αrec=0.6 _rec=0.6 with 85.03%85.03\%. On ReAct, recovery is even more consequential. Several intermediate settings (αrec=0.2 _rec=0.2, 0.30.3, 0.40.4, 0.50.5, and 0.80.8) suppress all ASRs to zero, but ACC varies substantially, peaking at 61.20%61.20\% when αrec=0.5 _rec=0.5. When recovery is removed (αrec=0 _rec=0), ACC drops to 38.00%38.00\% and ASR-a returns to 100%100\%. These results indicate that reconsolidation is not merely auxiliary, but essential for restoring benign functionality after attenuation, especially in agents with more fragile reasoning trajectories. Appendix I Use of Large Language Models (LLMs) Large language models were used exclusively for linguistic polishing, such as improving grammar and readability. They were not involved in the formulation of research ideas, study design, implementation, data analysis, or reference selection. All scientific contributions, technical claims, and interpretations in this paper were conceived, authored, and rigorously validated by the human authors. NeurIPS Paper Checklist 1. Claims Question: Do the main claims made in the abstract and introduction accurately reflect the paper’s contributions and scope? Answer: [Yes] Justification: In the abstract and introduction, we have thoroughly detailed the background, motivation, scope, main experimental results, and contributions of our work. Guidelines: • The answer [N/A] means that the abstract and introduction do not include the claims made in the paper. • The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A [No] or [N/A] answer to this question will not be perceived well by the reviewers. • The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings. • It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper. 2. Limitations Question: Does the paper discuss the limitations of the work performed by the authors? Answer: [Yes] Justification: We provide discussions the limitation of our method in Appendix A. Guidelines: • The answer [N/A] means that the paper has no limitation while the answer [No] means that the paper has limitations, but those are not discussed in the paper. • The authors are encouraged to create a separate “Limitations” section in their paper. • The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be. • The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated. • The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon. • The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size. • If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness. • While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren’t acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations. 3. Theory assumptions and proofs Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof? Answer: [Yes] Justification: The assumptions in this paper are properly referenced. Guidelines: • The answer [N/A] means that the paper does not include theoretical results. • All the theorems, formulas, and proofs in the paper should be numbered and cross-referenced. • All assumptions should be clearly stated or referenced in the statement of any theorems. • The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition. • Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material. • Theorems and Lemmas that the proof relies upon should be properly referenced. 4. Experimental result reproducibility Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)? Answer: [Yes] Justification: The paper has disclosed all the information in the method, experiment section and appendix. The data and code are also publicly accessible and provided with detailed procedures to reproduce the results reported in this paper. Guidelines: • The answer [N/A] means that the paper does not include experiments. • If the paper includes experiments, a [No] answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not. • If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable. • Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed. • While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example (a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm. (b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully. (c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset). (d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results. 5. Open access to data and code Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material? Answer: [Yes] Justification: The code and data are publicly accessible. Guidelines: • The answer [N/A] means that paper does not include experiments requiring code. • Please see the NeurIPS code and data submission guidelines (https://neurips.c/public/guides/CodeSubmissionPolicy) for more details. • While we encourage the release of code and data, we understand that this might not be possible, so [No] is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark). • The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https://neurips.c/public/guides/CodeSubmissionPolicy) for more details. • The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc. • The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why. • At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable). • Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted. 6. Experimental setting/details Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer) necessary to understand the results? Answer: [Yes] Justification: Details of both training and test are disclosed. Guidelines: • The answer [N/A] means that the paper does not include experiments. • The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them. • The full details can be provided either with the code, in appendix, or as supplemental material. 7. Experiment statistical significance Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments? Answer: [Yes] Justification: Guidelines: We adopt standard evaluation datasets, LLM agents, and metrics, which are accompanied by statistical significance. • The answer [N/A] means that the paper does not include experiments. • The authors should answer [Yes] if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper. • The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions). • The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.) • The assumptions made should be given (e.g., Normally distributed errors). • It should be clear whether the error bar is the standard deviation or the standard error of the mean. • It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified. • For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g., negative error rates). • If error bars are reported in tables or plots, the authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text. 8. Experiments compute resources Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments? Answer: [Yes] Justification: The experiments are sufficiently discussed to be run by others. Guidelines: • The answer [N/A] means that the paper does not include experiments. • The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage. • The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute. • The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn’t make it into the paper). 9. Code of ethics Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.c/public/EthicsGuidelines? Answer: [Yes] Justification: The conducted research conforms in every respect with the NeurIPS Code of Ethics. Guidelines: • The answer [N/A] means that the authors have not reviewed the NeurIPS Code of Ethics. • If the authors answer [No] , they should explain the special circumstances that require a deviation from the Code of Ethics. • The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction). 10. Broader impacts Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed? Answer: [Yes] Justification: Both potential positive societal impacts and negative societal impacts of the work have been discussed. Guidelines: • The answer [N/A] means that there is no societal impact of the work performed. • If the authors answer [N/A] or [No] , they should explain why their work has no societal impact or why the paper does not address societal impact. • Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations. • The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate Deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster. • The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology. • If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML). 11. Safeguards Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pre-trained language models, image generators, or scraped datasets)? Answer: [Yes] Justification: The paper has discussed safeguards for responsible release of data or models that have a high risk for misuse. Guidelines: • The answer [N/A] means that the paper poses no such risks. • Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters. • Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images. • We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort. 12. Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected? Answer: [Yes] Justification: All the mentioned previous work are properly cited. Guidelines: • The answer [N/A] means that the paper does not use existing assets. • The authors should cite the original paper that produced the code package or dataset. • The authors should state which version of the asset is used and, if possible, include a URL. • The name of the license (e.g., C-BY 4.0) should be included for each asset. • For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided. • If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset. • For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. • If this information is not available online, the authors are encouraged to reach out to the asset’s creators. 13. New assets Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets? Answer: [N/A] Justification: The code will be made public upon acceptance. Guidelines: • The answer [N/A] means that the paper does not release new assets. • Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc. • The paper should discuss whether and how consent was obtained from people whose asset is used. • At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file. 14. Crowdsourcing and research with human subjects Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)? Answer: [N/A] Justification: The paper does not involve crowdsourcing nor research with human subjects. Guidelines: • The answer [N/A] means that the paper does not involve crowdsourcing nor research with human subjects. • Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper. • According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector. 15. Institutional review board (IRB) approvals or equivalent for research with human subjects Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained? Answer: [N/A] Justification: The paper does not involve crowdsourcing nor research with human subjects. Guidelines: • The answer [N/A] means that the paper does not involve crowdsourcing nor research with human subjects. • Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper. • We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution. • For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review. 16. Declaration of LLM usage Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigor, or originality of the research, declaration is not required. Answer: [N/A] Justification: This research does not involve LLMs as any important, original, or non-standard components. Guidelines: • The answer [N/A] means that the core method development in this research does not involve LLMs as any important, original, or non-standard components. • Please refer to our LLM policy in the NeurIPS handbook for what should or should not be described.