MAPLE-Guard: Memory-Aware Link Enforcement Against Memory-Link Poisoning in Multi-Agent Systems

May combine two claims.

MAPLE-Guard achieves the lowest ASR@3 in every evaluated setting with Qwen3.5-122B-A10B, including 0.3%, 0.9%, and 0.2% on MMLU, LongMemEval, and AppWorld.

“MAPLE-Guard achieves the lowest ASR@3 in every setting, including 0.3%, 0.9%, and 0.2% on MMLU, LongMemEval, and AppWorld, respectively.”

May combine two claims.

On AppWorld-AgentPoison, MAPLE-Guard shows concurrent reductions in poisoned-memory use, agent-level exposure, and unsafe outputs.

“On AppWorld-AgentPoison, Figure 4 shows concurrent reductions in poisoned-memory use, agent-level exposure, and unsafe outputs.”

May combine two claims.

With Qwen3.5-122B-A10B on AppWorld-AgentPoison, MAPLE-Guard reaches 99.8% MDSR@3 and 0.2% ASR@3; with gemma-4-31B it reaches 95.3% MDSR@3 and 0.0% ASR@3.

“On AppWorld-AgentPoison, MAPLE-Guard achieves 99.8% MDSR@3 and 0.2% ASR@3 with Qwen3.5-122B-A10B, and 95.3% MDSR@3 and 0.0% ASR@3 with gemma-4-31B.”

May combine two claims.

Under no defense, attack success rate at round 3 reaches 51.4% on MMLU-MINJA and 34.7% on AppWorld with Qwen3.5-122B-A10B, and 75.1% on MMLU and 84.4% on InjectAgent with gemma-4-31B.

“Under No Defense, ASR@3 is 51.4% on MMLU-MINJA and 34.7% on AppWorld with Qwen3.5-122B-A10B, and 75.1% on MMLU and 84.4% on InjectAgent with gemma-4-31B.”

May combine two claims.

From round 1 to round 3, MDSR under No Defense changes by -3.5, -9.2, and -19.5 points on MMLU, LongMemEval, and AppWorld, compared with +4.5, -4.4, and 0.0 points under MAPLE-Guard.

“From R1 to R3, MDSR under No Defense changes by -3.5, -9.2, and -19.5 points on MMLU, LongMemEval, and AppWorld, respectively, compared with +4.5, -4.4, and 0.0 points under MAPLE-Guard.”

May combine two claims.

With Qwen3.5-122B-A10B, MDSR@3 gains range from 11.2% on CSQA to 57.3% on AppWorld, and ASR@3 reductions range from 14.1% on CSQA to 51.1% on MMLU.

“MDSR@3 gains range from 11.2% on CSQA to 57.3% on AppWorld, while ASR@3 reductions range from 14.1% on CSQA to 51.1% on MMLU.”

May combine two claims.

MAPLE-Guard raises MDSR@3 from 54.0% to 74.3% and lowers ASR@3 from 38.2% to 0.9% on LongMemEval with Qwen3.5-122B-A10B.

“it increases MDSR@3 from 54.0% to 74.3% and reduces ASR@3 from 38.2% to 0.9% (Table 1)”

• Also stated in: § Abstract · plain

  “MAPLE-Guard lowers attack success rate (ASR) from 38.2% to 0.9% on LongMemEval”

May combine two claims.

In the controlled token audit, MAPLE-Guard cut token use by 35.0% on MMLU and by 27.8% on InjectAgent compared with No Defense, while LLM-based guards added guard-chat tokens.

“Under this controlled setup, MAPLE-Guard reduces Token usage by 35.0% on MMLU and 27.8% on InjectAgent, whereas LLM-based guards incur additional guard-chat tokens.”

May combine two claims.

On LongMemEval-MemoryGraft, removing any single gate lowers MDSR@3; the full guard achieves 73.60% MDSR@3 and 0.90% ASR@3; removing the promotion gate reduces MDSR@3 to 60.00% and increases ASR@3 to 14.50%.

“removing any single gate lowers MDSR@3 under the same outcome-conditioned update rule (Figure 5).The full guard achieves 73.60% MDSR@3 and 0.90% ASR@3.Removing the promotion gate causes the largest degradation, reducing MDSR@3 to 60.00% and increasing ASR@3 to 14.50%”

May combine two claims.

With gemma-4-31B, ASR@3 reductions are 69.3%, 67.1%, and 68.8% on MMLU, LongMemEval, and AppWorld, compared with 6.9% on CSQA and 28.3% on InjectAgent.

“With gemma-4-31B, ASR@3 reductions are 69.3%, 67.1%, and 68.8% on MMLU, LongMemEval, and AppWorld, respectively, compared with 6.9% on CSQA and 28.3% on InjectAgent.”

May combine two claims.

With 30 agents MAPLE-Guard finishes at 23.2% ASR@3 and with 50 agents at 21.8%, both lower than the matching No Defense results.

“MAPLE-Guard ends at 23.2% ASR@3 with 30 agents and 21.8% with 50 agents, below the corresponding No Defense results.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Since each ablation removes just one gate, the experiment cannot capture interactions between gates.

“Because each ablation removes only one gate, the experiment does not capture interactions among gates.”

Classified as probably not a substantial claim.

For a given benchmark, every guard gets identical backbone prompts, task inputs, source memory candidates, and output contracts.

“Within a benchmark, all guards receive the same backbone prompt, task input, source memory candidates, and output contract.”

Classified as probably not a substantial claim. May combine two claims.

In each benchmark block, all compared methods received identical benchmark inputs, backbone models, communication topologies, attacker settings, output contracts, and evaluators.

“For fairness, all methods use the same benchmark input, backbone model, communication topology, attacker setting, output contract, and evaluator within each benchmark block.”

Classified as probably not a substantial claim.

Within each benchmark of the token audit, every method used identical task IDs, seed, sampled random adjacency, communication round count, and generation limit.

“Within each benchmark, every method uses the same task IDs, seed, sampled random adjacency, number of communication rounds, and generation limit.”

Classified as probably not a substantial claim. May combine two claims.

All methods start with the same task input and source candidate pool. The memory text that reaches the backbone may differ, because retrieval filtering is part of the evaluated policy.

“All methods start from the same task input and source candidate pool, but the memory text ultimately shown to the backbone can differ because retrieval filtering is part of the evaluated policy.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The agent-scale runs raised the agent count while holding fixed the backbone model, attacker ratio, attack type, random communication policy, and communication rounds.

“These runs increase the number of agents while keeping the backbone, attacker ratio, attack, random communication policy, and communication rounds fixed.”

May combine two claims.

Since each benchmark uses only one attack, the evaluation allows comparisons among defenses within a benchmark but cannot isolate the causal effect of the attack entry point.

“because each benchmark is paired with a single attack, the evaluation supports withinbenchmark comparisons among defenses but does not isolate the causal effect of the attack entry point.”

Classified as probably not a substantial claim.

MAPLE-Guard uses those hidden metadata fields only for memory governance before any surviving memory text is shown to the backbone model.

“MAPLE-Guard uses these fields only for memory governance before surviving memory text is exposed to the backbone model.”

Classified as probably not a substantial claim.

The risk score uses production path and steering cues rather than an attack-name feature.

“The score uses production path and steering cues rather than an attack-name feature.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The standard deviation in Table 1 measures between-topology variation, not task-level uncertainty or variation across all 45 runs.

“Thus the standard deviation in Table 1 measures between-topology variation, not task-level uncertainty or variation across all 45 runs.”

May combine two claims.

Across five benchmark-attack settings, several topologies, and two backbones, MAPLE-Guard lowers ASR and raises MDSR under attack.

“Across five benchmark-attack settings, multiple topologies, and two backbones, MAPLE-Guard reduces ASR and improves MDSR under attack.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Runtime was measured separately from ASR and MDSR since the guard can alter both model calls and memory operations.

“Runtime is measured separately from ASR/MDSR because the guard can change both model calls and memory operations.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Cross-setting performance is evidence about this fixed configuration, not proof of generalization to unseen adaptive attacks.

“cross-setting performance is therefore evidence about this fixed configuration, not proof of generalization to unseen adaptive attacks.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Memory items are stateful, persisting across rounds and tasks and carrying unsafe influence beyond the interactions that created them.

“memory items are stateful: they can persist across rounds and tasks and carry unsafe influence beyond their originating interactions.”

May combine two claims.

MAPLE-Guard does not rely on a separate LLM guard prompt; instead, it filters memory items before they enter the shared prompt interface.

“MAPLE-Guard does not use a separate LLM guard prompt; it filters memory items before they are inserted into the shared prompt interface.”

• Also stated in: § MAPLE-Guard Decision Schema · plain

  “MAPLE-Guard is not implemented as an LLM guard prompt.It is a lifecycle guard over hidden memory metadata.”

May combine two claims.

The observed association is consistent with blocked memory paths contributing to lower ASR, though other differences between guard implementations cannot be ruled out.

“This association is consistent with blocked memory paths contributing to lower ASR, but does not rule out other differences between guard implementations.”

May combine two claims.

The signal functions, weights, and thresholds stay fixed, with no parameter search tailored to any attack.

“The signal functions, weights, and thresholds remain fixed without attack-specific parameter search.”

May combine two claims.

A single poisoned memory write can be retrieved repeatedly in later tasks, promoted into shared memory, and reused by other agents.

“a poisoned memory can be written once, continuously retrieved in later tasks, promoted into shared memory, and reused by other agents.”

• cites [3]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [7]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [27]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

The random-topology traces are stress-test results, not substitutes for the controlled-topology means in Table 1.

“These random-topology traces are stress-test results, not substitutes for the controlledtopology means in Table 1.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The guard's deterministic gates require no additional guard-LLM calls.

“Its deterministic gates require no additional guard-LLM calls.”

May combine two claims.

Existing safeguards mainly inspect prompts, actions, or communication edges, so they can miss attacks whose content appears benign at write time but becomes harmful after retrieval.

“because existing safeguards mainly inspect prompts, actions, or communication edges, they can miss attacks whose content appears benign at write time but becomes harmful after retrieval.”

• cites [11]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [18]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [33]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [37]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [38]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [46]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The round-wise pattern is consistent with repeated retrieval and cross-agent reuse amplifying stored influence and lifecycle filtering limiting exposure.

“This pattern is consistent with repeated retrieval and cross-agent reuse amplifying stored influence and lifecycle filtering limiting exposure, but it does not establish causal mediation.”

Classified as probably not a substantial claim.

The completed ablation protocol removes one lifecycle gate at a time while retaining the outcome update.

“The completed ablation protocol removes one lifecycle gate at a time while retaining the outcome update of Eq. ( 4)-( 5) in the full model and every ablated variant.”

Classified as probably not a substantial claim.

The retrieval gate is the final checkpoint before memory reaches the prompt.

“The retrieval gate is the last checkpoint before memory enters the prompt.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The main table did not use random-topology runs, because graph sampling alters the graph itself, not just the controlled topology family.

“Random-topology runs are not used to compute the main table because graph sampling changes the graph itself rather than only changing the controlled topology family.”

May combine two claims.

ASR@3 and MDSR@3 are not complementary; ASR@3 + MDSR@3 ≤ 100%.

“The two are not complementary: a benign mistake with ŷ ̸ = y and ŷ ̸ = y ⋆ counts toward neither, so ASR@3 + MDSR@3 ≤ 100%.”

May combine two claims.

A single poisoned write can steer many later decisions and contaminate agents that never saw the original attack.

“A single poisoned write can therefore steer many later decisions and contaminate agents that never saw the original attack”

• cites [3]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [7]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [27]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Classified as probably not a substantial claim.

The same backbone and judge configuration is held fixed across guards within a benchmark block.

“For comparisons across guards within each benchmark block, we hold the agent backbone and the Qwen3.5-122B-A10Bjudge (temperature 0) fixed.”

May combine two claims.

The evaluator maps on the runner side kept poison memory identifiers, the target y⋆, and attack-success annotations for computing ASR, MDSR, PMUR, and related metrics; these were not fed into the four memory gates or the backbone prompt.

“Poison memory IDs, the target y ⋆ , and attack-success annotations remain in runner-side evaluator maps used to compute ASR, MDSR, PMUR, and related metrics; they are not inputs to the four memory gates or the backbone prompt.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Token counts from MiniLM/BERT for G-Safeguard, GUARDIAN, and INFA-Guard were omitted because they are not comparable to Qwen tokenization.

“MiniLM/BERT token counts for G-Safeguard, GUARDIAN, and INFA-Guard are omitted because they are not comparable to Qwen tokenization.”

May combine two claims.

Across all five evaluated benchmarks and attacks, MAPLE-Guard uses one fixed configuration: its risk signals are deterministic functions based on provenance and rules, not per-attack detectors or a learned classifier, and all weights and thresholds stay constant.

“MAPLE-Guard uses a single fixed configuration across all five evaluated benchmarks and attacks: the risk signals are deterministic provenance and rule-based functions rather than per-attack detectors or a learned classifier, and all weights and thresholds are held constant.”

Classified as probably not a substantial claim. May combine two claims.

Both panels of the token audit used identical five tasks and graph, three rounds, eight agents, and a maximum of 128 tokens.

“Both panels use the same five tasks and graph, three rounds, eight agents, and max tokens=128.”

Probably not a substantial claim: may not pass S3 (load-bearing).

These token measurements characterize token use only for this fixed configuration.

“These measurements characterize token use for this fixed configuration.”

Classified as probably not a substantial claim. May combine two claims.

Only memory text that survives the guard's metadata checks is exposed to the backbone model; hidden metadata and guard-side signals are not exposed as instructions to the backbone LLM.

“The text is the only part that may be inserted into an agent prompt.”

• Also stated in: § MAPLE-Guard Decision Schema · plain

  “The backbone model receives only memory text that survives these metadata checks.”

• Also stated in: § Additional information · plain

  “These signals are used by the guard but are not exposed as instructions to the backbone LLM.”

Classified as probably not a substantial claim. May combine two claims.

The main memory-native experiments followed the metadata clean path: defense-visible source strings and parent markers had attack names stripped, newly written memories began with neutral source-agent trust, and later updates relied on recorded task outcomes.

“The primary memory-native experiments use the metadata clean path.Attack names are removed from defense-visible source strings and parent markers, source-agent trust starts from a neutral value for newly written memories, and later changes use recorded task outcomes.”

Classified as probably not a substantial claim. May combine two claims.

We set this configuration by hand once, using the normalized signal ranges and gate semantics, and did not search thresholds per benchmark, per attack, or per backbone.

“We hand-set this configuration once from the normalized signal ranges and gate semantics; we did not run a per-benchmark, per-attack, or per-backbone threshold search.”