论文测量 LLM 智能体记忆投毒防御在无攻击时的代价：token 开销 0% 至 4.5%，准确率无明显损失
The Price of Safety: Benign-Case Utility and Token Overhead of Memory-Poisoning Defenses in LLM Agents
AI 导读
arXiv 论文 2609.22818 测量 LLM 智能体记忆投毒防御在无攻击时的良性代价，固定骨干模型、记忆后端、检索与评测，只更换防御。
正文 · 原文
Abstract:Memory-poisoning defenses for LLM agents are usually judged by how well they stop attacks, yet almost all the traffic an agent sees is benign. We measure what these defenses cost when no attack is present. Our harness holds the backbone model, memory backend, retrieval, answer prompt, and judge fixed and changes only the defense. Both LLM-based defenses run on the agent's own backbone, and an integrity check verifies every run. We test four defenses on half of LoCoMo: five long conversations (750 turns and 255 questions per run), with each condition run three times. Sanitization and provenance checking never fired. LLM-based anomaly detection blocked 9 of 2,250 turns (0.4%). A read-time reranker dropped 2.2% of the memories it judged, withholding at least one memory from 14.9% of questions. A blind audit found content-based justification for only 2 of 50 sampled drops. No defense showed a detectable accuracy cost, at 95% intervals of $\pm$2.4 to $\pm$4.6 points; the reranker changed accuracy by +0.6 points (95% CI [-2.6, +3.8]). Anomaly detection and the stacked condition gained 4.7 points, but a blocked turn changes the memories extracted after it, so we do not count this as a benefit. Token overhead was 0% for sanitization and provenance, 1.5% for anomaly detection, 3.0% for the reranker, and 4.5% with all four stacked. An earlier version of this study ran the reranker condition on a different model than its baseline. A baseline on that same model shows the swap produced 2.9 of the 4.4 points of accuracy cost we then reported. Attack success rate reveals none of this, so we report benign cost alongside it. We release the harness, labels, and per-run outputs.
| Comments: | 16 pages, 4 figures, 5 tables. v3: corrects a model mismatch in v2; all LLM defenses now run on the agent's backbone; results updated |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2609.22818 [cs.CR] |
| (or arXiv:2609.22818v3 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2609.22818 arXiv-issued DOI via DataCite |
Submission history
From: Pritom Bhowmik [view email]
[v1]
Sat, 19 Sep 2026 06:39:21 UTC (261 KB)
[v2]
Thu, 22 Oct 2026 08:33:17 UTC (40 KB)
[v3]
Wed, 4 Nov 2026 20:05:32 UTC (74 KB)
来源：arXiv cs.AI · arxiv.org