An AI agent that forgets on purpose might be safer than one that remembers everything.
Researchers have built DREAM, a training-free framework for cleaning poisoned memories out of large language model agents. The method takes a cue from neuroscience: memories that get weakly reactivated without reinforcement tend to decay. DREAM applies the same idea to an agent's memory store, nudging it with small perturbations to expose which memories are structurally fragile, flagging the anomalous ones, then selectively suppressing the bad memories while reinforcing the good ones. Across tests against backdoor poisoning and injection attacks, the approach cut attack success rates by more than 95 percent without hurting the agent's normal performance, and on poisoned multi-agent systems, agents using DREAM still completed their tasks 92.96 percent of the time.
That matters because agent memory is becoming a real attack surface. As more products give LLM agents persistent memory to reuse context across sessions and tasks, that memory becomes something an attacker can plant false information in, and today's defenses mostly bolt on separate modules that isolate or audit memory continuously, which is expensive to run. DREAM instead works from inside the agent itself, and the researchers say it runs up to 2.13 times faster and uses 37.7 percent fewer tokens than a prior defense called A-MemGuard.
The 95 percent figure comes from the researchers' own unreviewed benchmarks, so the real test is whether it holds once attackers start designing poisoning attacks specifically to beat a known forgetting trick.