{"id":"854e3b71-851c-4b28-abd6-7499866083b5","arxiv_id":"2607.28103","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"An intent-aware information bottleneck plus lightweight multi-hyperplane classifier detects poisoned agent memories across turns without repeated LLM auditing.","lead":"MIND filters poisoned memories in LLM agents by compressing each turn’s link to the original user goal through an information bottleneck, then classifying the result with a small multi-hyperplane detector. It cuts memory-injection attack success roughly in half on StrategyQA while keeping task accuracy and latency near the undefended baseline.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.5","headline":"Supervised labels require known M_adv at training time, so the reported ASR cuts may not hold under realistic attack-agnostic or adaptive injection.","rationale":"The reader already isolated the right load-bearing premise: that supervised IB geometry learned from labeled [intent; turn] pairs with known M_adv transfers to unseen domains and attack instances. I sharpen it to the concrete labeling dependence in Eq. 3 and the absence of any attack-holdout or adaptive evaluation, which is the precise point at which the threat-model claim in §3.2 diverges from the training procedure in §4.2. The empirical tables, ablations, and efficiency numbers remain supportive inside the closed world of the two evaluated attacks, so the verdict stays CONDITIONAL rather than moving to REJECT; the condition is exactly the cross-attack / adaptive stress test (plus artifact release) the reader already flagged. No independent concern outranks this one.","tokens_in":14234,"tokens_out":568,"duration_ms":12719,"concrete_test":"Retrain MIND on trajectories poisoned only by AgentPoison, then evaluate ASR-r/ASR-a on the identical ReAct-StrategyQA suite attacked only by MINJA (and the reverse cross). If either direction loses more than ~15 points of the reported relative ASR reduction versus No Defense while ACC stays flat, the transfer premise underlying the 55% headline fails.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim (mean 55.4%/55.3% ASR-r/ASR-a cuts on ReAct-StrategyQA with matched ACC/latency) rests on a detector trained with explicit knowledge of which retrieved sets intersect M_adv (Eq. 3: li = 1 iff Mr ∩ M_adv = ∅). That labeling is available only because the authors control the poison set when building D from QA/EHR trajectories (§4.2). At deployment the defender is stated to know neither M_adv nor the attack strategy (§3.2), yet the paper never evaluates a setting in which the training poisons differ in mechanism, trigger, or target from the test poisons (only AgentPoison and MINJA appear), nor an adaptive attacker who crafts records whose [h0; ht] geometry stays inside the learned benign polytope. If the IB+multi-hyperplane boundary is largely memorizing the geometry of the two seen attacks rather than a general intent–behavior deviation, the headline relative reductions are optimistic for the threat model the paper itself defines. The proxy Llama-3.1-8B extractor for closed-source agents compounds the same issue but is secondary.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.5","summary":"The paper proposes MIND, a lightweight defense against memory-injection attacks on memory-augmented LLM agents. Motivated by preliminary evidence that benign and poisoned multi-turn trajectories differ in how turn representations relate to the initial user intent (§4.1, Fig. 2), MIND extracts last-token hidden states of the intent–turn pair, compresses them with a variational intent-aware Information Bottleneck (Eqs. 4–9), and classifies the denoised latents with a multi-hyperplane (convex polytope) decision head (Eqs. 10–11). Training uses supervised labels that mark whether the retrieved set intersects a known poison set M_adv (Eq. 3). Across four agent backbones on ReAct-StrategyQA and MMLU, and against AgentPoison and MINJA, MIND reports large average reductions in ASR-r/ASR-a relative to No Defense while keeping task accuracy and episode latency near the undefended baseline and below LLM-auditing defenses (Table 1). Ablations (Table 2), hyperparameter sweeps (Table 3), and staged t-SNE (Fig. 4) support the contribution of the IB and multi-hyperplane components.","tokens_in":14576,"tokens_out":1533,"duration_ms":42379,"significance":"Memory injection is a timely and practically important threat for long-horizon LLM agents. If the reported security–utility trade-off holds under realistic defender knowledge, MIND would be a useful contribution: it targets cross-turn intent–behavior deviation rather than single-record content, avoids repeated LLM auditing, and demonstrates competitive accuracy and latency on multiple backbones including closed-source models. Strengths include a clear problem formulation (§3), multi-backbone evaluation with standard baselines (Table 1), component ablations, and efficiency comparisons against A-MemGuard and LLM Auditor. The work is incremental relative to existing trajectory monitors and record-level filters, but the intent-anchored IB framing and polytope head are a coherent lightweight design that the community can build on.","major_comments":[{"comment":"§3.2 states that the defender knows neither M_adv nor the attack strategy, yet §4.2 Eq. (3) defines training labels li from exact intersection of the retrieved set with a known M_adv, and D is built from QA/EHR trajectories under author-controlled poisons. This is ordinary supervised learning, but it is a stronger training assumption than the stated threat model. The manuscript should explicitly separate (i) offline supervised training with labeled poisoned trajectories from (ii) attack-agnostic deployment, and should report at least one mismatched-attack or held-out-attack protocol (train on one of AgentPoison/MINJA, test on the other; or train without the test trigger/target family). Without that, the headline mean 55.4%/55.3% ASR-r/ASR-a cuts on ReAct-StrategyQA (abstract, Table 1) may overstate robustness under the paper’s own defender knowledge.","section":"§3.2, §4.2 Eq. (3), Table 1"},{"comment":"Evaluation covers only AgentPoison and MINJA (§5.1). There is no adaptive attacker who optimizes injected records so that [h0; ht] (or the Llama-3.1-8B proxy states used for closed-source agents) remain inside the learned benign polytope of Eqs. (10)–(11). Given that the decision boundary is a low-capacity multi-hyperplane classifier on a fixed frozen encoder, adaptive evasion is a load-bearing risk for the central security claim. A minimal adaptive or transfer attack study—or a clear limitation statement with a concrete negative result—belongs in the main evaluation, not only as future work.","section":"§5.1, §4.3 Eqs. (10)–(11)"},{"comment":"The IB ‘informativeness’ term max I(Z;Y) is replaced by a label-conditioned margin alignment of μ(x) to μ(h0) (Eq. 9), not by a standard supervised IB decoder p(y|z). That surrogate is reasonable but is an ad-hoc axiom: it assumes that intent–behavior geometric deviation is the right Y-signal for poison detection. The paper should either (a) justify why this surrogate tracks I(Z;Y) more tightly than a simple classification head on z, or (b) ablate against a plain VIB+classifier without L_align (beyond the coarser ‘w/o IB’ row in Table 2). Table 2’s w/o IB and w/o Multi-hyperplane variants still leave ASR-a near 51%, so the quantitative necessity of the intent-alignment surrogate for the claimed gains needs a sharper control.","section":"§4.2 Eqs. (4), (9); Table 2"}],"minor_comments":[{"comment":"Table 1: AV Filter is dashed for closed-source backbones (expected) but also shows weak open-source numbers; a one-sentence note on why attention-variance filtering fails under these multi-turn memory attacks would help readers.","section":"Table 1"},{"comment":"§5.1 Implementation: latent dimension d, K, margins m and m_a, and encoder depth are free parameters (Eqs. 8–12) but only β and λ are swept in Table 3. Report default K, d, and m in the main text or a compact appendix table.","section":"§5.1, Table 3"},{"comment":"Fig. 1 and Fig. 3 captions are helpful; ensure Fig. 4’s three panels share axis scales or state that scales differ, so ‘enlarged margin’ is not a plotting artifact.","section":"Figure 4"},{"comment":"Minor prose issues: spacing typos such as ‘memoryinjectionattacks’, ‘frominformationredundancy’, and ‘ReAct-StrategyQA, MIND reduces mean ASR-r’ appear in the abstract/intro PDF text; clean these in production.","section":"Abstract, §1"},{"comment":"Related Work should briefly position MIND against concurrent trajectory guardrails (e.g., SafeHarbor-style hierarchical memory guards cited as Liu et al. 2026) so novelty of the intent-aware IB is sharper.","section":"§2"}],"recommendation":"major_revision","confidential_remarks":"The empirical package is above average for agent-security submissions, but the training-label vs threat-model gap is the issue most likely to draw sharp reviewer disagreement. If the authors add a mismatched-attack split and an honest adaptive/limitation experiment, this is close to a solid accept at a systems/security venue; without it I would not green-light on the abstract’s strong relative-ASR claims. Fit for a serious AI/security journal is reasonable after revision; novelty is applied rather than foundational."},"author_rebuttal":null,"desk_editor":{"model":"grok-4.5","letter":"Punchline: MIND is a competent, usable defense for memory injection on ReAct-style agents. It cuts mean ASR-r/ASR-a on StrategyQA by roughly half relative to no defense across four backbones, keeps accuracy near the undefended baseline, and stays cheap—about 20% faster than the LLM auditor. That efficiency claim is the part worth caring about if you run multi-turn agents.\n\nWhat is actually new is not IB or polytope classifiers (both standard and cited). It is the packaging: last-token [intent; turn] features, variational IB that anchors to the initial query, then a multi-hyperplane head, trained once and applied per retrieval. The prelims in §4.1 are honest motivation—attention to the query decays faster under poison, and the t-SNE story is consistent with Fig. 4. Table 1 is the real contribution; ablations and the β/λ sweep move the right way.\n\nSoft spots, in proportion. The stress-test lands: labels in Eq. 3 need known M_adv when building D, while the defender at test time is not supposed to know the attack. They only evaluate AgentPoison and MINJA, with no cross-mechanism or adaptive attacker who stays inside the benign polytope. That caps how far you can push the “general intent–behavior deviation” story. Proxy Llama-3.1-8B features for closed models and missing main-text architecture/code are secondary but real for reproduction. None of this makes the tables fake; it makes the threat-model match incomplete.\n\nMath is ordinary VIB + margin losses—no circularity, no load-bearing sleight. Citations cover the right attack and defense lines. Who it is for: people building or hardening memory/RAG agents who need a cheap filter, not a theory audience. I would send it to referees; I would bring it to reading group only if we are deep in agent security that month. Engage if that is your lane; do not treat the 55% figure as attack-agnostic until someone stress-tests it.","headline":"Solid agent-memory defense paper: real ASR cuts at near-zero latency tax, but the detector is supervised on known poisons and only two attack families.","tokens_in":15213,"tokens_out":527,"would_cite":true,"duration_ms":16192,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.5","headline":"MIND cuts memory-injection attack success on LLM agents by about half by keeping only the intent–behavior signal and discarding trajectory clutter.","keywords":["memory injection","LLM agents","information bottleneck","intent-aware defense","multi-turn trajectories","lightweight detector","retrieval-augmented agents"],"falsifier":"Train MIND only on the paper’s QA/EHR trajectories, then measure ASR-r, ASR-a, and accuracy on ReAct-StrategyQA and MMLU under AgentPoison and MINJA; if mean ASR-r/ASR-a do not fall by roughly half versus no defense while accuracy and latency stay comparable to the undefended agent, the central claim fails.","tokens_in":15084,"feed_emoji":"🛡️","tokens_out":947,"duration_ms":23757,"temperature":0.7,"pith_summary":"Memory-augmented LLM agents can be steered off task when attackers plant records that later get retrieved. Existing defenses either call a full LLM auditor on every turn, which is slow, or encode whole multi-turn histories, which bury the attack signal in repetition and task noise. This paper argues that benign and poisoned trajectories differ in how tightly each turn stays aligned with the user’s original intent, and that this difference is visible in compact representations. MIND therefore trains an intent-aware information bottleneck to compress each turn together with the initial query into a small latent that keeps intent-relevant attack cues and drops the rest, then scores those latents with a lightweight multi-hyperplane detector. The result is lower attack success at roughly the same accuracy and latency as an undefended agent, without repeated LLM auditing.","feed_headline":"Memory defense halves agent attack success without extra lag","feed_subtitle":"An intent-aware bottleneck keeps the attack signal and drops multi-turn clutter, matching undefended speed and accuracy.","key_machinery":"Intent-aware Information Bottleneck (IB): a variational compressor on the concatenated initial-intent and turn hidden states that minimizes mutual information with the raw input while maximizing (via margin alignment) information about the benign/poisoned label relative to the intent anchor, feeding a multi-hyperplane decision region.","core_discovery":"Benign and poisoned agent trajectories are distinguishable by the relationship between the initial user intent and later turn behavior; an intent-aware information bottleneck can extract compact representations of that relationship, filter out task-irrelevant and repetitive multi-turn content, and let a small classifier reject poisoned memories while preserving task performance and inference speed.","pith_inferences":["If intent–turn geometry is the real signal, similar bottlenecks might flag other gradual steering attacks (prompt drift, tool-policy hijacks) without storing full histories.","Proxy hidden states from an open 8B model working for closed-source agents suggests defense can sit outside the agent API, which matters for production stacks that cannot expose internals.","When benign and poisoned classes become separable only after IB compression, representation-level monitoring may outperform content-only filters on attacks that look locally harmless.","A natural next measurement is whether the same IB detector holds when the attacker optimizes directly against the bottleneck latents rather than against the agent’s answers."],"forward_implications":["Memory defense for long-horizon agents can be cast as intent-conditioned denoising rather than full-trajectory encoding or per-turn LLM auditing.","On ReAct-StrategyQA, mean ASR-r and ASR-a drop by about 55% relative to no defense across four backbones while average accuracy and latency match the undefended agent.","Defense latency stays near the undefended baseline and is substantially lower than LLM-auditor and A-MemGuard-style methods.","Cross-domain transfer from QA/EHR training trajectories to StrategyQA and MMLU is feasible for this detector under the tested attacks.","Write-time and retrieve-time filtering can both use the same compact intent–behavior score without re-invoking a large judge model."],"fun_headline_variants":["Intent-aware bottleneck cuts memory-injection ASR in half","MIND filters poisoned agent memory without extra lag","Compact intent-behavior signals flag malicious memories","Lightweight IB defense halves agent attack success rates","Intent-aware denoising blocks memory injection, keeps speed"],"cache_read_input_tokens":128,"weakest_assumption_plain":"Last-token hidden states of the pair [initial user intent, current turn]—even when taken from a frozen proxy model for closed-source agents—carry attack-discriminative geometry that a supervised bottleneck trained on labeled trajectories will still see on new domains and new attacks.","fun_headline_variants_meta":{"raw":{"variants":["Intent-aware bottleneck cuts memory-injection ASR in half","MIND filters poisoned agent memory without extra lag","Compact intent-behavior signals flag malicious memories","Lightweight IB defense halves agent attack success rates","Intent-aware denoising blocks memory injection, keeps speed"]},"model":"grok-4.5","effort":"low","cost_usd":0.003783,"raw_usage":{"total_tokens":1221,"prompt_tokens":777,"num_sources_used":0,"completion_tokens":56,"cost_in_usd_ticks":37828000,"prompt_tokens_details":{"text_tokens":777,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":388,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":777,"tokens_out":56,"duration_ms":6940,"temperature":1.0,"reasoning_tokens":388,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-31T17:44:22.313740+00:00","model_set":{"reader":"grok-4.5"},"falsifier":"Train MIND only on the paper’s QA/EHR trajectories, then measure ASR-r, ASR-a, and accuracy on ReAct-StrategyQA and MMLU under AgentPoison and MINJA; if mean ASR-r/ASR-a do not fall by roughly half versus no defense while accuracy and latency stay comparable to the undefended agent, the central claim fails.","supporting_citations":[],"review_version":1}