arXiv cs.AI· Pritom Bhowmik·· 12 小时前AI 评分36
LLM 智能体记忆投毒防御的代价：良性场景下的效用与 Token 开销
The Price of Safety: Benign-Case Utility and Token Overhead of Memory-Poisoning Defenses in LLM Agents
AI 导读
研究在无攻击的良性场景下测量 LLM 智能体记忆投毒防御的成本：在 LoCoMo 一半数据上测试四种防御，清洗与来源校验从未触发，基于 LLM 的异常检测仅拦截 2250 轮中的 9 轮（0.4%），读取时重排器丢弃 2.2% 记忆、使 14.9% 的问题至少缺失一条记忆。
正文 · 原文
Abstract:Memory-poisoning defenses for LLM agents are usually judged by how well they stop attacks, yet almost all the traffic an agent sees is benign. We measure what these defenses cost when no attack is present. Our harness holds the backbone model, memory backend, retrieval, answer prompt, and judge fixed and changes only the defense. Both LLM-based defenses run on the agent's own backbone, and an integrity check verifies every run. We test four defenses on half of LoCoMo: five long conversations (750 turns and 255 questions per run), with each condition run three times. Sanitization and provenance checking never fired. LLM-based anomaly detection blocked 9 of 2,250 turns (0.4%). A read-time reranker dropped 2.2% of the memories it judged, withholding at least one memory from 14.9% of questions. A blind audit found content-based justification for only 2 of 50 sampled drops. No defense showed a detectable accuracy cost, at 95% intervals of $\pm$2.4 to $\pm$4.6 points; the reranker changed accuracy by +0.6 points (95% CI [-2.6, +3.8]). Anomaly detection and the stacked condition gained 4.7 points, but a blocked turn changes the memories extracted after it, so we do not count this as a benefit. Token overhead was 0% for sanitization and provenance, 1.5% for anomaly detection, 3.0% for the reranker, and 4.5% with all four stacked. An earlier version of this study ran the reranker condition on a different model than its baseline. A baseline on that same model shows the swap produced 2.9 of the 4.4 points of accuracy cost we then reported. Attack success rate reveals none of this, so we report benign cost alongside it. We release the harness, labels, and per-run outputs.
| Comments: | 16 pages, 4 figures, 5 tables. v3: corrects a model mismatch in v2; all LLM defenses now run on the agent's backbone; results updated |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2609.22818 [cs.CR] |
| (or arXiv:2609.22818v3 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2609.22818 arXiv-issued DOI via DataCite |
Submission history
From: Pritom Bhowmik [view email]
[v1]
Sat, 19 Sep 2026 06:39:21 UTC (261 KB)
[v2]
Thu, 22 Oct 2026 08:33:17 UTC (40 KB)
[v3]
Wed, 4 Nov 2026 20:05:32 UTC (74 KB)
来源：arXiv cs.AI · arxiv.org