MAPLE-Guard slashes multi-agent memory poisoning by 98%
A single poisoned write can hijack an entire AI agent team
LLM-based multi-agent systems increasingly rely on shared persistent memory for long-horizon coordination, but that creates a dangerous new attack surface. Researchers from Shanghai Jiao Tong University and collaborators introduce MAPLE-Guard (Memory-Aware Propagation and Link Enforcement Guard), a defense framework that inspects the entire memory lifecycle—not just prompts or communication edges. Once a single poisoned memory is written, it can be retrieved, promoted into shared memory, and reused by other agents, silently steering decisions without ever triggering visible communication alerts. MAPLE-Guard places gates at each step: write-time quarantine, retrieval-time filtering, blocked promotion, and cross-agent reuse checks.
In benchmark tests, MAPLE-Guard cuts attack success rate from 38.2% to 0.9% on LongMemEval and 34.7% to 0.2% on AppWorld. Multi-agent defense success rate rises from 54.0% to 74.3% and from 42.5% to 99.8% respectively. Because it catches harmful content that looks benign at write time but becomes dangerous after retrieval, it fills a gap left by prompt-level and topology-level defenses. Code is available for developers to integrate into existing agent frameworks.
- Attacks exploit persistent memory: one poisoned write can later steer all agents via shared memory reuse
- MAPLE-Guard gates write, retrieval, promotion, and cross-agent reuse across the full memory lifecycle
- Cuts ASR from 38.2% to 0.9% on LongMemEval and from 34.7% to 0.2% on AppWorld
Why It Matters
As AI agents gain shared memory, this guard prevents a single poisoned entry from silently corrupting entire multi-agent workflows.