An endogenous memory repair method for a memory pollution-oriented large language model agent

Abstract

The application particularly relates to an endogenous memory repair method for a memory pollution-oriented large language model agent, comprising the following steps: constructing a dynamic weighted retrieval model of an agent long-term memory bank, representing each memory record as a key-value pair, and adjusting the influence of the memory record on retrieval and reasoning through a dynamic memory weight; applying weak isotropic Gaussian disturbance to a memory vector to simulate an implicit reactivation process; fusing geometric stability, competitive retrieval probability and semantic consistency energy to construct a multi-dimensional activation intensity score, and identifying suspicious memories based on an adaptive threshold; combining the suspiciousness score and online task utility feedback to establish a discrete-time dynamic memory repair mechanism, consolidating the weights of stable and useful normal memories, and exponentially attenuating suspicious and polluted memories, so as to realize functional forgetting of the polluted memories. The application can reduce the probability of retrieval and influence on reasoning of the polluted memories while maintaining the continuity of normal memories and the task utility.

Description

Technical Field

[0001] This invention relates to the field of large language model intelligent agents, specifically to an endogenous memory repair method for large language model intelligent agents with memory pollution. It is applicable to large language model intelligent agents that include long-term memory, vector retrieval, retrieval enhancement generation or tool invocation capabilities, including at least one of medical question-answering intelligent agents, knowledge question-answering intelligent agents, code execution intelligent agents, multi-agent collaborative systems and task planning intelligent agents. Background Technology

[0002] As large language model agents are increasingly used in scenarios such as medical question answering, automated office work, complex task planning, multi-agent collaboration, and tool invocation, agents typically need to maintain long-term memory to store historical interaction records, task experience, user preferences, knowledge fragments, and tool invocation results. This long-term memory is usually used in subsequent reasoning through a retrieval-enhanced generation mechanism. Specifically, the agent retrieves the Top-K relevant memories from the memory bank based on the current user query and inputs them as context into the large language model, thereby improving continuous task processing capabilities and personalized interaction capabilities.

[0003] However, long-term memory mechanisms also provide attackers with new attack surfaces. Attackers can use methods such as memory poisoning, backdoor triggering, semantic spoofing, and indirect cue injection to write seemingly normal but insidiously harmful memory records into the agent's memory bank. Once these contaminated memories are retrieved in subsequent tasks, they may hijack the agent's reasoning process, mislead tool calls, induce erroneous task execution, or even form a self-reinforcing loop through the rewriting of erroneous experiences, allowing the contaminated behavior to persist in the agent system for a long time.

[0004] Existing defenses against memory contamination attacks mainly fall into three categories. The first category is online detection methods based on large language model auditors, which invoke an additional model to determine if a memory or output is abnormal each time it is recalled or generated. This type of method requires continuous operation of an external auditing module, resulting in high computational costs and response latency. The second category is anomaly detection methods based on perplexity, statistical distribution, or rule filtering. These methods are insufficient in identifying semantic spoofing attacks and context-dependent attacks. The third category is dual-memory or isolated storage methods, which manage normal memories and suspected harmful memories separately. However, this method increases storage and routing costs, disrupts the continuity of the agent's memory, and can easily lead to inference gaps and decreased performance in normal tasks.

[0005] Therefore, there is an urgent need for an innate memory repair method for intelligent agents that does not rely on continuous online auditing, does not require hard deletion of memories, and does not disrupt the continuity of normal memories. This method would enable intelligent agents to selectively suppress contaminated memories after being attacked, while preserving the positive role of normal memories in task reasoning. Summary of the Invention

[0006] To address the lack of self-repair capability of existing large language model agents after memory contamination attacks, this invention proposes an endogenous memory repair method for memory-contaminated large language model agents. This method introduces a dynamic memory weighting mechanism, extending the static assumption of "all memories are equally reliable" in traditional memory retrieval to a weighted retrieval mechanism in which "the influence of memories can be dynamically adjusted according to the security status and task utility".

[0007] Other features and advantages of the invention will become apparent from the following detailed description, or may be learned in part by practice of the invention.

[0008] According to a first aspect of the present invention, an endogenous memory repair method for a large language model agent with memory contamination is provided, the method comprising: The steps of memory-weighted retrieval modeling are as follows: 1. Obtain the long-term memory of the large language model agent. 2. Represent each memory record as a memory entry containing a memory key and a value. 3. Encode the memory key into a vector representation using an embedding model. 4. Set dynamic memory weights for each memory record. 5. When a user query arrives, calculate a weighted retrieval score based on the query vector, memory vector, and dynamic memory weights to obtain a candidate memory set for the agent's reasoning. Weak perturbation implicit reactivation step: Without knowing the location of the contaminated memory in advance, a weak isotropic Gaussian perturbation is applied to the memory vector in the memory bank to obtain the perturbed memory vector, so as to simulate the weak cue reactivation of the agent's memory and expose the structural vulnerability and instability of the attacked memory in the embedding space. Multidimensional activation intensity anomaly diagnosis steps: For each perturbed memory record, calculate geometric stability, competitive retrieval probability, and semantic consistency energy respectively, and integrate the three indicators into a multidimensional activation intensity score; construct an adaptive anomaly threshold based on the mean and standard deviation of the activation intensity scores in the current memory bank, determine memory records below the threshold as suspicious memories, and update their suspiciousness scores; Dynamic memory repair steps: Construct a memory decay rate based on the suspicion score and online task utility feedback; for stable memory records with high task utility, increase or maintain their dynamic memory weight; for memory records judged as suspicious, gradually reduce their dynamic memory weight in an exponential decay manner, thereby suppressing the influence of contaminated memories in subsequent retrieval and reasoning. Weighted memory retrieval steps: During the subsequent operation of the agent, the memory retrieval score is recalculated based on the updated dynamic memory weights, making it difficult for contaminated memories to enter the Top-K retrieval context, while maintaining the contribution of normal memories to task reasoning, thereby achieving endogenous repair of the attacked agent's memory system.

[0009] In some exemplary embodiments, the memory-weighted retrieval modeling step specifically includes: Let the agent's memory be... }, of which the Memory record as ,in This indicates historical issues, triggering conditions, or memory index content. This indicates the corresponding historical answers, task experience, tool usage records, or environmental interaction results; Embedded model Encode the memory key into a vector , will user query Encoded as query vector Set dynamic memory weights for each memory record. The weighted retrieval score is calculated according to the following formula:

[0010] in, This represents the cosine similarity between the query vector and the memory vector; The top-K memories are selected as the reasoning context for the agent based on the weighted retrieval scores.

[0011] In some exemplary embodiments, the weak perturbation implicit reactivation step specifically includes: For each memory vector Injecting weakly isotropic Gaussian noise yields a perturbed memory vector:

[0012] in, For noise intensity parameters, It is an identity matrix.

[0013] In some exemplary embodiments, the multidimensional activation intensity anomaly diagnosis step specifically includes: Calculate the activation intensity score for each perturbed memory record:

[0014] in, This represents the geometric stability between the perturbation vector and the original vector; This represents the competitive retrieval probability of a perturbed memory relative to the overall distribution of the memory bank; This represents the semantic consistency energy of the memory representation after perturbation.

[0015] In some exemplary embodiments, the competitive retrieval probability is calculated as follows:

[0016] in, This represents the global center vector of all memory vectors in the memory bank. This parameter represents the temperature parameter; it is used to measure whether the perturbed memory record still has an anomaly retrieval advantage relative to the global memory distribution. The semantic consistency energy is calculated as follows:

[0017] This metric measures whether a memory record retains its internal semantic structure after a weak perturbation.

[0018] In some exemplary embodiments, the adaptive anomaly threshold is determined as follows:

[0019] in, and These represent the mean and standard deviation of the activation intensity scores for all memory records in the current round, respectively. This is the sensitivity parameter for abnormal diagnosis; when At that time, the corresponding memory record will be judged as a suspicious memory.

[0020] In some exemplary implementations, the suspicion score is updated as follows:

[0021]

[0022] in, For the first The memory record is in the first The suspiciousness score of the round, This is the natural decay coefficient for the degree of doubt.

[0023] In some exemplary embodiments, the dynamic memory repair step includes: Based on the suspiciousness score of the memory record and online consolidation signal Construction time-dependent memory decay rate:

[0024] in, Based on the attenuation rate, This is an abnormal amplification factor. This indicates the historical utility and reliability of memory records in real-world task interactions.

[0025] In some exemplary embodiments, the online consolidation signal is updated based on the effectiveness of the memory recordings in the task:

[0026] in, Indicates the first The utility feedback of a memory in the current task includes at least one of the following: task success rate, correctness of answer, reward signal, human feedback or tool call result; This represents the historical utility retention coefficient.

[0027] In some exemplary embodiments, the dynamic memory weight update includes two modes: normal memory consolidation and suspected memory decay. When memory records satisfy and At the same time, perform normal memory consolidation:

[0028] in, As the utility threshold, For memory recovery rate; When the memory record does not meet the above conditions, perform suspected memory decay:

[0029] Through the above methods, the weight of suspected contaminated memories gradually approaches the low-weight region, while the weight of normal memories remains in the high-weight region.

[0030] Compared with the prior art, the present invention has the following beneficial effects: First, this invention does not rely on continuous online large model auditing, thus avoiding the time and token costs associated with calling an additional auditing module for each inference.

[0031] Second, this invention does not use hard deletion to process suspicious memories, but achieves functional forgetting through continuous weight decay, thereby reducing the risk of catastrophic forgetting caused by accidental deletion of normal memories.

[0032] Third, the present invention does not require storing normal memories and suspicious memories in completely isolated dual memory banks, thus maintaining the continuity of the memory system and reducing storage overhead and reasoning breaks.

[0033] Fourth, this invention identifies contaminated memories by using multidimensional activation intensity rather than a single detection signal, and can simultaneously capture geometric stability, retrieval competitiveness and semantic consistency anomalies, making it highly adaptable to both backdoor-type memory contamination and semantically disguised memory injection.

[0034] Fifth, this invention adopts a combination of offline repair and online utility feedback, which enables continuous repair of the intelligent agent memory system without retraining the parameters of a large language model.

[0035] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit the invention. Attached Figure Description

[0036] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention. It is obvious that the drawings described below are merely some embodiments of the invention, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0037] Figure 1 This is a schematic framework for the endogenous memory repair method of the present invention for large language model intelligent agents with memory pollution. Detailed Implementation

[0038] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that the invention will be more comprehensive and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0039] Furthermore, the accompanying drawings are merely illustrative of the invention and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0040] While contaminated memories may semantically masquerade as normal memories, they typically exhibit stronger structural fragility, abnormal retrieval competition, or decreased semantic consistency under weak perturbations. Based on this, this invention first applies a weakly isotropic Gaussian perturbation to the memory vector to simulate implicit reactivation of memories; then, it constructs a multidimensional activation intensity score using geometric stability, competitive retrieval probability, and semantic consistency energy to adaptively identify suspicious memories; finally, it gradually reduces the retrieval weight of suspicious memories through an offline dynamic repair process, while simultaneously consolidating normal memories based on online task utility feedback, thereby achieving functional forgetting of contaminated memories.

[0041] The method of this invention includes: First, constructing a dynamically weighted retrieval model for the agent's long-term memory bank, representing each memory record as a key-value pair, and adjusting its influence on retrieval and reasoning through dynamic memory weights; Second, applying a weakly isotropic Gaussian perturbation to the memory vector to simulate the implicit reactivation process and expose the structural vulnerability of contaminated memories in the encoding space; Then, fusing geometric stability, competitive retrieval probability, and semantic consistency energy to construct a multidimensional activation intensity score, and identifying suspicious memories based on an adaptive threshold; Finally, combining the suspiciousness score and online task utility feedback to establish a discrete-time dynamic memory repair mechanism, weighting and consolidating stable and useful normal memories, and exponentially decaying suspicious contaminated memories, thereby achieving functional forgetting of contaminated memories. This invention does not require retraining of large language model parameters, does not rely on continuous online auditing, and does not require hard deletion or double memory isolation. It can reduce the probability of contaminated memories being retrieved and affecting reasoning while maintaining the continuity of normal memories and task utility. It is applicable to large language model intelligent agent systems with long-term memory, such as medical question answering, knowledge question answering, tool invocation, and multi-agent collaboration.

[0042] refer to Figure 1 As shown, the specific steps may include: Step 1: Construct an agent memory-weighted retrieval model.

[0043] The long-term memory of the large language model agent is obtained, and the memory records are represented as key-value pairs. The memory keys are encoded into vectors through an embedding model. Dynamic weights are assigned to each memory record. During the retrieval phase, the original semantic similarity is multiplied by the dynamic weights to obtain a weighted retrieval score.

[0044] Step 2: Perform weak perturbation implicit reactivation.

[0045] Weak isotropic Gaussian noise is applied to each memory vector to obtain a perturbed memory vector. This process does not require knowledge of which memory has been contaminated, nor does it rely on attack labels or manual annotations, and is used to expose the instability of contaminated memories in the vector space.

[0046] Step 3: Calculate the multidimensional activation intensity.

[0047] For each memory after perturbation, its geometric stability, competitive retrieval probability, and semantic consistency energy are calculated separately, and the three are integrated into a multidimensional activation intensity score to comprehensively characterize the stability and reliability of memory records under perturbation.

[0048] Step 4: Perform adaptive anomaly diagnosis.

[0049] An anomaly threshold is constructed based on the mean and standard deviation of all current memory activation intensity scores. Memory scores below the threshold are classified as suspicious. Suspicious memories are accumulated with a suspicion score, and suspicion scores are decayed for memories that are not consistently abnormal to avoid misjudgments caused by random noise.

[0050] Step 5: Perform dynamic memory repair.

[0051] A memory decay rate is constructed by combining the doubtfulness score and online task utility feedback. For stable memories with task utility, weighted consolidation is performed; for doubtful memories, exponential decay is performed to gradually reduce their impact in subsequent retrievals.

[0052] Step 6: Perform a secure search based on the updated weights.

[0053] In subsequent task execution, the agent uses updated dynamic weights for Top-K memory retrieval, making it difficult for contaminated memories to enter the reasoning context, thereby reducing the success rate of attacks, while maintaining the availability of normal memories and task continuity.

[0054] The method of this invention does not require retraining the parameters of the large language model, does not require hard deletion of memory records, and does not require storing normal memories and doubtful memories in two completely isolated memory banks. Instead, it achieves functional forgetting of contaminated memories by dynamically adjusting memory weights.

[0055] The steps in this exemplary embodiment will now be described in more detail with reference to the accompanying drawings and embodiments.

[0056] Step 1: Agent memory bank modeling and dynamic weight initialization Given a large language model agent with long-term memory capabilities, its memory bank is represented as follows: },in, Indicates the first Each memory record is a key-value pair. ,in, It represents the content of the memory index, such as historical queries, task descriptions, triggering conditions, user requirements, or environmental states; This indicates the corresponding response result, task experience, tool call records, or knowledge fragments.

[0057] Embedded model Encode each memory key into a vector. At the same time, dynamic weights are assigned to each memory record. During system initialization, all memory weights can be set to... This indicates that all memories are available for retrieval in the initial state. Different initial weights can also be set based on the credibility of the memory source, timestamp, user confirmation status, or historical task success rate.

[0058] When the user enters a query At that time, the system encodes it into a query vector. The weighted retrieval score is then calculated using the following formula:

[0059] The system selects the Top-K memories as the agent's reasoning context based on this score. Unlike traditional methods that rely solely on semantic similarity, this invention introduces dynamic weights during the retrieval process, making it difficult for suspicious memories to enter the final context even if they are semantically similar to the current query, due to a reduced weight.

[0060] Step 2: Weak perturbation implicit reactivation In real-world scenarios, systems typically don't know which memory is contaminated, making it impossible to directly target contaminated memories. This invention employs a label-free, prior-free weak perturbation detection strategy, uniformly perturbing all memory vectors in the memory bank:

[0061] in, This represents the memory vector after perturbation. Indicates Gaussian noise. This indicates the perturbation strength. The perturbation should be set to a small value to avoid disrupting normal memory representations while exposing the instability of contaminated memories in the local vector space. This perturbation does not rely on attack labels, contaminated memory locations, or manually labeled information, and is suitable for memory repair scenarios under black-box or weak prior conditions.

[0062] This step simulates the "weak cue reactivation" process. For normal memories, their vector representations usually maintain high stability after weak perturbations; however, for contaminated memories formed through attack optimization, semantic masquerading, or trigger binding, they are more likely to exhibit anomalous characteristics such as geometric instability, decreased retrieval advantage, or reduced semantic consistency after perturbation.

[0063] Step 3: Calculation of Multidimensional Activation Strength To avoid misjudgment based on a single indicator, this invention designs a multidimensional activation intensity score. It is used to comprehensively measure the stability and reliability of memory records after perturbation:

[0064] Among them, the first item This represents geometric stability and is used to measure the cosine similarity between the perturbation vector and the original vector. A low value indicates that the memory representation changes significantly under local perturbations, potentially indicating structural fragility.

[0065] Second item This represents the competitive retrieval probability, used to measure whether a perturbed memory still maintains reasonable retrieval competitiveness relative to the global memory distribution. Its calculation method is as follows:

[0066] in, Represents the global center of all memory vectors. This is a temperature parameter. When a memory record becomes less stable relative to its original representation after perturbation, and becomes closer to the background distribution, its competitive retrieval probability will decrease.

[0067] Third item Semantic consistency energy is used to measure whether a memory retains its internal semantic structure after perturbation.

[0068] This term can approximate the degree to which the semantic structure of memory is preserved under perturbation with low computational cost.

[0069] By integrating the above three indicators, this invention can simultaneously capture local geometric anomalies, global retrieval anomalies, and semantic consistency anomalies of contaminated memories, thereby improving the ability to identify different types of memory contamination attacks.

[0070] Step 4: Adaptive anomaly threshold and suspicion level update During each round of offline repair, the system collects the set of activation intensity scores for all memory records and calculates their mean and standard deviation:

[0071]

[0072] Then, an adaptive anomaly threshold is constructed:

[0073] in, This is a sensitivity parameter for anomaly diagnosis. If a memory satisfies... If so, it is judged as a suspicious memory.

[0074] To avoid misjudgment caused by a single perturbation, this invention does not directly delete suspicious memories, but instead maintains a continuous suspiciousness score. First, calculate the degree of deviation in memory activation intensity:

[0075] The suspicion level is then updated according to the following rules:

[0076] in, This represents the natural decay coefficient of suspicion. If a memory continues to be abnormal in multiple rounds of perturbation detection, its suspicion gradually increases; if the abnormality no longer occurs, the suspicion gradually decreases.

[0077] Step 5: Online task effectiveness feedback update To prevent useful memories from being erroneously weakened, this invention introduces an online consolidation signal. This is used to represent the historical utility of a memory in the execution of a real task. Whenever a memory... After being retrieved and participating in agent reasoning, the system receives utility feedback based on the task results. This feedback can come from whether the task was successful, whether the answer was correct, whether the tool was used effectively, whether the user confirmed, the reward model's score, or human feedback.

[0078] The online reinforcement signal is updated as follows:

[0079] in, This represents the historical utility retention coefficient. Through this mechanism, normal memories that frequently participate in successful tasks receive a higher consolidation signal, while memories that, although semantically similar, lead to incorrect reasoning or abnormal behavior are difficult to consolidate.

[0080] Step 6: Dynamic Memory Repair Based on Synaptic Dynamics This invention models the evolution of memory weights as a discrete-time dynamic process. For the first... The system calculates the attenuation rate based on the suspicion score and the online consolidation signal.

[0081] in, Based on the attenuation rate, This is the amplification factor for abnormalities. The higher the suspicion level, the greater the attenuation rate; the higher the online consolidation signal, the smaller the attenuation rate.

[0082] For stable memories with high task utility, that is, when the following conditions are met:

[0083] Then perform normal memory consolidation:

[0084] in, This indicates the memory recovery rate. The formula allows normal memory weight to gradually recover or remain in a high value range.

[0085] For doubtful memories or memories with insufficient task utility, the performance decays exponentially:

[0086] As the number of offline repair rounds increases, the weight of contaminated memories gradually decreases, and their contribution to retrieval scores is continuously weakened. Since this invention does not directly delete memory records but rather reduces their impact on retrieval, it can reduce the risk of attacks while avoiding irreversible losses caused by accidental deletion.

[0087] Step 7: Secure Retrieval and Agent Recovery Based on Dynamic Weights During subsequent agent operation, the system recalculates the retrieval score using the updated dynamic weights:

[0088] When the weight of contaminated memories is reduced, even if they still have a high semantic similarity to the current query, their weighted retrieval score will decrease, making it difficult for them to enter the Top-K inference context. Normal memories, on the other hand, can still be accessed normally by the agent because their weight remains high.

[0089] Through the above mechanism, the agent can achieve endogenous repair of contaminated memory without retraining the model, continuously calling external auditors, or disrupting the continuity of memory.

[0090] When this invention is applied to medical intelligent agents, knowledge-based question-answering intelligent agents, and multi-agent collaborative systems, experimental results show that this invention can significantly reduce the success rate of memory backdoor attacks and memory injection attacks, while maintaining a high accuracy rate for normal tasks.

[0091] For backdoor-type memory contamination attacks, this invention can significantly reduce the attack success rate in the retrieval, inference, and end-to-end task stages across different tasks and large language model backbones. For semantic spoofing-type memory injection attacks, this invention can identify contaminated memories written in disguise through normal queries and cut off their subsequent self-reinforcing paths through dynamic weight decay.

[0092] In multi-agent collaborative scenarios, the present invention can maintain a high task success rate under malicious information injection conditions, indicating that the method is not only applicable to long-term memory repair of single agents, but also to memory security maintenance when multiple agents share information, conduct collaborative reasoning, and jointly execute tasks.

[0093] Compared with methods based on perplexity filtering, large language model auditors, distillation classifiers, and dual memory isolation, this invention does not require additional calls to the large model for auditing during each inference, thus resulting in lower runtime and lower token consumption. At the same time, this invention reduces memory continuity disruption and inference gaps by using dynamic weight repair instead of isolated storage.

[0094] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of the present invention, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0095] Other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention herein. This application is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein. The specification and embodiments are to be considered exemplary only, and the true scope and spirit of the invention are indicated by the claims.

[0096] It should be understood that the present invention is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is defined only by the appended claims.

Claims

1. An endogenous memory repair method for large language model intelligent agents with memory pollution, characterized in that, The method includes: The steps of memory-weighted retrieval modeling are as follows:

1. Obtain the long-term memory of the large language model agent.

2. Represent each memory record as a memory entry containing a memory key and a value.

3. Encode the memory key into a vector representation using an embedding model.

4. Set dynamic memory weights for each memory record.

5. When a user query arrives, calculate a weighted retrieval score based on the query vector, memory vector, and dynamic memory weights to obtain a candidate memory set for the agent's reasoning. Weak perturbation implicit reactivation step: Without knowing the location of the contaminated memory in advance, a weak isotropic Gaussian perturbation is applied to the memory vector in the memory bank to obtain the perturbated memory vector; Multidimensional activation intensity anomaly diagnosis steps: For each perturbed memory record, calculate geometric stability, competitive retrieval probability, and semantic consistency energy respectively, and integrate the three indicators into a multidimensional activation intensity score; construct an adaptive anomaly threshold based on the mean and standard deviation of the activation intensity scores in the current memory bank, determine memory records below the threshold as suspicious memories, and update their suspiciousness scores; Dynamic memory repair steps: Construct a memory decay rate based on the suspicion score and online task utility feedback; for stable memory records with high task utility, increase or maintain their dynamic memory weight; for memory records judged as suspicious, gradually reduce their dynamic memory weight according to an exponential decay method. Weighted memory retrieval steps: During the subsequent operation of the agent, the weighted retrieval score is recalculated based on the updated dynamic memory weights, making it difficult for contaminated memories to enter the Top-K retrieval context, while maintaining the contribution of normal memories to task reasoning, thus achieving endogenous repair of the attacked agent's memory system.

2. The endogenous memory repair method for large language model intelligent agents with memory pollution according to claim 1, characterized in that, The specific steps of the memory-weighted retrieval modeling are as follows: Let the agent's memory be... }, of which the Memory record as ,in This indicates historical issues, triggering conditions, or memory index content. This indicates the corresponding historical answers, task experience, tool usage records, or environmental interaction results; Embedded model Encode the memory key into a vector , will user query Encoded as query vector Set dynamic memory weights for each memory record. The weighted retrieval score is calculated according to the following formula: in, This represents the cosine similarity between the query vector and the memory vector; The top-K memories are selected as the reasoning context for the agent based on the weighted retrieval scores.

3. The endogenous memory repair method for large language model intelligent agents with memory pollution according to claim 1, characterized in that, The specific steps of the weak perturbation implicit reactivation are as follows: For each memory vector Injecting weakly isotropic Gaussian noise yields a perturbed memory vector: in, For noise intensity parameters, It is an identity matrix.

4. The endogenous memory repair method for large language model intelligent agents with memory pollution according to claim 3, characterized in that, The specific steps for diagnosing abnormal multidimensional activation intensity are as follows: Calculate the activation intensity score for each perturbed memory record: in, This represents the geometric stability between the perturbation vector and the original vector; This represents the competitive retrieval probability of a perturbed memory relative to the overall distribution of the memory bank; This represents the semantic consistency energy of the memory representation after perturbation.

5. The endogenous memory repair method for large language model intelligent agents with memory pollution according to claim 4, characterized in that, The competitive retrieval probability is calculated as follows: in, This represents the global center vector of all memory vectors in the memory bank. Indicates temperature parameter; The semantic consistency energy is calculated as follows: This metric measures whether a memory record retains its internal semantic structure after a weak perturbation.

6. The endogenous memory repair method for large language model intelligent agents with memory pollution according to claim 1, characterized in that, The adaptive anomaly threshold is determined as follows: in, and These represent the mean and standard deviation of the activation intensity scores for all memory records in the current round, respectively. This is the sensitivity parameter for abnormal diagnosis; when At that time, the corresponding memory record will be judged as a suspicious memory.

7. The endogenous memory repair method for large language model intelligent agents with memory pollution according to claim 6, characterized in that, The suspicion score is updated as follows: in, For the first The memory record is in the first The suspiciousness score of the round, This is the natural decay coefficient for the degree of doubt.

8. The endogenous memory repair method for large language model intelligent agents with memory pollution according to claim 7, characterized in that, The dynamic memory repair steps are as follows: Based on the suspiciousness score of the memory record and online consolidation signal Construction time-dependent memory decay rate: in, Based on the attenuation rate, This is an abnormal amplification factor. This indicates the historical utility and reliability of memory records in real-world task interactions.

9. The endogenous memory repair method for large language model intelligent agents with memory pollution according to claim 8, characterized in that, The online consolidation signal is updated based on the effectiveness of the memory recordings in the task: in, Indicates the first Feedback on the utility of each memory in the current task. This represents the historical utility retention coefficient.

10. The endogenous memory repair method for large language model intelligent agents with memory pollution according to claim 1, characterized in that, The dynamic memory weight update includes two modes: normal memory consolidation and suspected memory decay. When memory records satisfy and At the same time, perform normal memory consolidation: in, As the utility threshold, For memory recovery rate; When the memory record does not meet the above conditions, perform suspected memory decay: Through the above methods, the weight of suspected contaminated memories gradually approaches the low-weight region, while the weight of normal memories remains in the high-weight region.

Images