MAPLE-Guard: Memory-Aware Link Enforcement Against Memory-Link Poisoning in Multi-Agent Systems

AI summary

Authors: Wenjun Xiong, Yijin Zhou, Jiaqian Wang, Shangding Gu, Bo Tang, Zhiyu Li, Feiyu Xiong, Ying Wen, Muning Wen Affiliations: Shanghai Jiao Tong University, Shanghai Innovation Institute, Xidian University, UC Berkeley, MemTensor (Shanghai) Technology Co., Ltd. arXiv: 2608.00426v1 [cs.MA], 01 Aug 2026 — Code: https://github.com/xiong-wenjun/MAPLE-Guard

Overview

Research area: Security and safety of LLM-based multi-agent systems (MAS), specifically attacks and defenses that operate through persistent agent memory rather than through visible message exchanges.

Technical level: Advanced. The paper assumes familiarity with multi-agent architectures, retrieval-augmented memory, threat modeling, and standard defense metrics such as attack success rate.

Scope: The paper formalizes "memory-link poisoning" — attacks that travel along memory lifecycle operations instead of communication edges — and proposes MAPLE-Guard, a lifecycle-gated defense evaluated on five benchmark–attack pairs, two backbones, and multiple communication topologies.

What This Paper Is About

LLM-based multi-agent systems increasingly store experience in persistent private and shared memory so agents can coordinate over long horizons. This creates a durable attack channel: an attacker can write a plausible-looking memory once, have it retrieved many rounds later, promoted into shared memory, and reused by agents that never saw the original attack — all without any malicious message crossing a visible communication edge at the moment of harm. The goal of the paper is to define this attack class formally and to build a guard that governs memory transitions (write, retrieval, promotion, cross-agent reuse) rather than only prompts, actions, or communication links.

Key Contributions

1. Formalization of memory-link poisoning. Building on prior evidence of persistent, cross-agent memory attacks, the authors define a memory link as a dependency induced by a memory operation, and a memory-link event as the tuple (source, target, memory item, action, round). A sequence of such events forms a memory-link path that need not follow the communication graph edges. They instantiate the threat model using representative memory-poisoning and injection attacks, with attacker routes described as the "dialogue route" and the "direct-memory route."

2. A unified lifecycle-gated defense (MAPLE-Guard). The guard applies a single fixed risk model at four checkpoints — a write firewall, a retrieval gate, a promotion gate, and a cross-agent reuse gate — plus outcome-conditioned updates to memory utility and provenance trust. Evaluator-only attack labels are never exposed to the gates or to the LLM.

3. An eight-signal risk model. One variant-agnostic risk model scores every gate using origin signals (provenance, lineage), intent signals (self-claimed success, instruction-likeness, answer binding), retrieval-gaming signals (trigger sensitivity, cluster dominance), and a producer signal (source-agent trust), with the largest weights on provenance and lineage. Signal functions, weights, and thresholds are fixed across all benchmarks and attacks without attack-specific tuning.

4. Evaluation across attacks, topologies, models, and scales. The paper characterizes when memory-level controls provide protection beyond message- and topology-level defenses, including round-level propagation dynamics, an agent-scale stress test, and gate-level ablations.

Main Findings

• Attacks through memory are potent without defenses. With Qwen3.5-122B-A10B and No Defense, ASR@3 is 51.4% ± 0.5 on MMLU-MINJA and 34.7% ± 0.3 on AppWorld-AgentPoison, with MDSR@3 falling to 42.5% ± 1.0 on AppWorld. With gemma-4-31B, ASR@3 is 75.1% ± 2.0 on MMLU, 67.8% ± 2.2 on LongMemEval, 68.8% ± 1.4 on AppWorld, and 84.4% ± 0.4 on InjectAgent-ToolAttack.

• MAPLE-Guard sharply lowers attack success on memory-native benchmarks. With Qwen3.5-122B-A10B, ASR@3 falls from 38.2% to 0.9% on LongMemEval-MemoryGraft and from 34.7% to 0.2% on AppWorld-AgentPoison; MDSR@3 rises from 54.0% to 74.3% and from 42.5% to 99.8% respectively.

• Gains appear across all five benchmark–attack settings and both backbones. With Qwen3.5-122B-A10B, MAPLE-Guard records ASR@3 of 0.3% (MMLU), 0.9% (LongMemEval), 0.2% (AppWorld), 23.6% (CSQA), and 4.9% (InjectAgent), the lowest in every setting, with corresponding MDSR@3 of 89.5%, 74.3%, 99.8%, 79.5%, and 98.3%. On InjectAgent it reduces ASR@3 from 20.6% to 4.9% in the tool-attack transfer setting.

• Effect sizes vary by setting and backbone. Relative to No Defense with Qwen3.5-122B-A10B, MDSR@3 gains range from 11.2% on CSQA to 57.3% on AppWorld, and ASR@3 reductions range from 14.1% on CSQA to 51.1% on MMLU. With gemma-4-31B, ASR@3 reductions are 69.3% (MMLU), 67.1% (LongMemEval), 68.8% (AppWorld), 6.9% (CSQA), and 28.3% (InjectAgent); on InjectAgent, MAPLE-Guard still records 56.1% ASR@3 with gemma-4-31B versus 4.9% with Qwen3.5-122B-A10B.

• Baseline defenses are inconsistent. On MMLU with Qwen3.5-122B-A10B, all six message- and topology-level guards reduce ASR relative to No Defense, but on AppWorld, GUARDIAN increases ASR from 34.7% to 56.5%. The authors attribute mixed baseline results to incomplete coverage of stored-memory paths while cautioning that benchmark–attack differences prevent isolating intervention level as the sole cause.

• Benign utility is largely preserved. Under random topology with attacks disabled (MDSR@3, Qwen3.5-122B-A10B / gemma-4-31B): MMLU 88.5 → 87.0 and 56.5 → 55.0; LongMemEval 64.5 → 71.5 and 34.2 → 32.8; AppWorld 99.0 → 100 and 75.1 → 80.4; CSQA 80.1 → 81.5 and 81.5 → 83.5; InjectAgent 97.0 → 97.9 and 45.8 → 46.8.

• Influence accumulates over rounds under No Defense. From R1 to R3 under random topology with Qwen3.5-122B-A10B, MDSR under No Defense changes by −3.5, −9.2, and −19.5 points on MMLU, LongMemEval, and AppWorld, compared with +4.5, −4.4, and 0.0 points under MAPLE-Guard.

• Topology-robust and scale-robust. On AppWorld-AgentPoison across star, chain, and tree topologies, MAPLE-Guard reaches 99.8% MDSR@3 and 0.2% ASR@3 (Qwen3.5-122B-A10B) and 95.3% MDSR@3 and 0.0% ASR@3 (gemma-4-31B). In the larger-agent stress test, No Defense ASR rises from R1 to R3 at both scales, while MAPLE-Guard ends at 23.2% ASR@3 with 30 agents and 21.8% with 50 agents (No Defense: 26.5% and 24.3%).

• Every gate contributes, and promotion matters most. On LongMemEval-MemoryGraft, the full guard achieves 73.60% MDSR@3 and 0.90% ASR@3. Removing the promotion gate causes the largest degradation — MDSR@3 to 60.00% and ASR@3 to 14.50% — while removing the write, retrieval, or cross-agent gate produces smaller but consistent losses. The ablation removes only one gate at a time, so interactions among gates are not captured.

Methodology in Plain English

The researchers first model a memory-enabled multi-agent system as a communication graph of N agents, where each agent is defined by its backbone LLM, role, persistent memory store, and tools. They then define a memory item as text plus metadata: scope (private, shared, or blocked), provenance, lifecycle state (active, retrievable, promotable, or quarantined), and guard-side signals such as risk, trust, and utility that are never shown to the LLM.

The key conceptual move is to treat memory operations — write, retrieve, promote, reuse, update — as first-class events that can be gated, much like firewall rules. For every stored item the system keeps hidden state: utility, provenance trust, content hazard, scope, lifecycle status, and outcome history, plus a provenance chain of the memory-link events that produced it. Memory derived from untrusted, externally sourced, or cross-agent parents inherits part of that parent's risk, analogous to dynamic taint tracking.

MAPLE-Guard then places four gates along the lifecycle:

• Write firewall: evaluates a candidate item before storage, choosing to reject (forbidden content such as credentials), quarantine (high risk, retained but not retrievable), rewrite (strip imperative phrasing and store as low-trust evidence), or store as private memory.
• Retrieval gate: ranks candidates with a value-aware score that rewards relevance plus learned utility and trust while penalizing hazard, taint, scope, and query-conditioned risk; the top items then pass a rule-based filter before entering the prompt. If the best candidate falls below a similarity threshold, the agent answers from the prompt alone.
• Promotion gate: allows a private memory to enter shared memory only when it is useful, trusted, and low risk.
• Cross-agent gate: a broker applies the same scope, status, and risk checks before a shared item becomes visible to another agent.

A single fixed risk model scores every gate, producing a risk value that maps through thresholds to allow, demote, or block. Memory utility is identified with a Q-value updated from task outcomes, and provenance trust is updated separately, so items linked to bad outcomes become less likely to be retrieved or promoted — and the update stays local, so unrelated failures do not penalize the whole pool.

Experimental protocol: five benchmark–attack pairs — MINJA on MMLU, MemoryGraft on LongMemEval, AgentPoison on AppWorld, PromptInject on CSQA, and ToolAttack on InjectAgent. Each main-grid run uses 200 instances, eight agents (three attacker-controlled), and three rounds under star, chain, or tree topology, with each guard–backbone–benchmark cell containing 15 runs per topology. Backbones are Qwen3.5-122B-A10B and gemma-4-31B; comparisons within a benchmark block hold the backbone and a Qwen3.5-122B-A10B judge at temperature 0 fixed, and retrieval-based settings use Qwen3-Embedding-8B. Metrics are final-round ASR@3, MDSR@3, and memory-use diagnostics PMUR (poisoned-memory use rate), PMUR-A (agent-level poisoned-memory use rate), and Sec. ASR@3 (security-probe attack success rate at round 3). Random and fully connected graphs are evaluated separately as stress tests, and a controlled five-task token audit is reported in the appendix.

Why This Matters

Impact on research. The paper argues that prompt-level and topology-level defenses leave a structural gap: they inspect what agents say and which edges they use, not how stored state moves between scopes and agents. By positioning memory lifecycle transitions as additional intervention points, it reframes an important part of MAS security as a state-governance problem. The formalization of memory-link events and paths gives subsequent work a vocabulary and a measurable target, and the finding that a promotion gate dominates the ablation is a concrete hypothesis for future defenses to test.

Real-world applications:

• Enterprise AI assistants with long-term memory: a poisoned "user preference" or "prior recommendation" stored once could steer many later tasks, including for users who never interacted with the attacker.
• Tool-using agent pipelines: the InjectAgent-ToolAttack setting shows attacks that push agents toward a risky tool; guards at retrieval and promotion limit how far such steering travels.
• Shared-knowledge agent fleets: multi-agent customer service or operations systems where private observations get promoted into a shared knowledge base used by other agents.
• Audit and incident response: quarantine and provenance-chain records give operators a retained, non-retrievable evidence trail for high-risk memories instead of silently discarding them.

Industry relevance. The guard is described as deterministic in its gate decisions and as requiring no additional guard-LLM calls, which matters for latency and cost in production memory systems. The reported benign-utility table suggests the filtering does not uniformly degrade task performance (AppWorld and CSQA even improve slightly under no attack), which is the kind of evidence deployment teams need before adding a memory-layer control.

Future Directions

• Adaptive and evasion-resistant attacks. The paper explicitly notes that forged metadata or payloads designed to stay below per-event thresholds may evade the guard, and that its cross-setting performance is evidence about one fixed configuration rather than proof of generalization to unseen adaptive attacks.
• Gating beyond single-gate ablations. The ablation removes one gate at a time and therefore does not capture interactions among the four gates; understanding how write, retrieval, promotion, and cross-agent decisions compound is an open question.
• Separating attack entry point from defense effect. Because each benchmark is paired with a single attack, the evaluation supports within-benchmark comparisons among defenses but does not isolate the causal effect of the attack entry point.
• Better provenance guarantees and initial-compromise prevention. MAPLE-Guard is designed to contain memory-link poisoning after it enters the system rather than prevent every initial compromise, and it assumes reliable provenance metadata and retrieval traces — a dependency that motivates work on verifiable lineage and on pre-write compromise prevention.

Target Audience

Researchers and practitioners working on LLM agent security, multi-agent system architecture, and persistent-memory design. It is most useful to readers who already understand agent memory pipelines and threat modeling and want a concrete formulation of memory-mediated attacks plus a lifecycle-gated defense with benchmark numbers to compare against. Security engineers building production memory layers, and evaluators designing adversarial benchmarks for agent systems, will also find the metrics (ASR@3, MDSR@3, PMUR, PMUR-A, Sec. ASR@3) and the gate design directly transferable.

Authors’ abstract

LLM-based multi-agent systems (MAS) increasingly rely on persistent private and shared memories for long-horizon coordination. This memory layer improves continuity, but it also gives attackers a durable channel: a poisoned memory can be written once, continuously retrieved in later tasks, promoted into shared memory, and reused by other agents. A single poisoned write can therefore steer many later decisions and contaminate agents that never saw the original attack, all while no malicious message crosses a visible communication edge at the moment of harm. Further, because existing safeguards mainly inspect prompts, actions, or communication edges, they can miss attacks whose content appears benign at write time but becomes harmful after retrieval. We introduce Memory-Aware Propagation and Link Enforcement Guard, MAPLE-Guard, a memory-link guard for memory-enabled MAS. MAPLE-Guard monitors the memory lifecycle and places gates at write, retrieval, promotion, and cross-agent reuse, so risky memories can be quarantined, unsafe retrievals filtered, and poisoned private memories blocked before they enter shared memory. In the main evaluation, MAPLE-Guard lowers attack success rate (ASR) from 38.2% to 0.9% on LongMemEval and from 34.7% to 0.2% on AppWorld; it also raises multi-agent defense success rate (MDSR) from 54.0% to 74.3% and from 42.5% to 99.8% on the same benchmarks. These results suggest that memory-aware link enforcement covers a gap left by prompt-level and topology-level defenses. Code is available at the link: https://github.com/xiong-wenjun/MAPLE-Guard.