Detection and Mitigation of Prompt Injection and Memory Poisoning Attacks in Agentic AI Systems

Abstract

large language model (LLM) agents have tended to integrate external tools, retrieval-augmented generation (RAG), and persistent memory with natural-language reasoning. These features make tasks more autonomous but also make them more vulnerable: prompt injection can change an agent's direction during a session and memory poisoning can carry malicious input at later tasks and tool calls. In this paper, we present TAMGuard: A Trust-Aware Framework for Prompt Injection and Memory Poisoning Detection and Mitigation in Agentic AI systems. TAMGuard combines input canonicalization, a transformer-based semantic detector, a provenance-aware trust scoring model, a consistency checker based on trusted memory, quarantined memory writes, trust-aware retrieval and a risk-sensitive tool-action gate. TAMGuard has been tested with Agent Security Bench; external testing also has been conducted with AgentDojo and InjecAgent for direct, observation-based, indirect, and memory-oriented attacks. Experimental results demonstrate that TAMGuard achieves a 95.31% accuracy, 95.30% macro F1, and 98.70% macro AUROC for three-way classification of benign, prompt-injection, and memory-poisoning instances, and only lowers the residual attack success rate to 4.7% while maintaining a benign task utility of 94.2%. Based on the results of the ablation analysis, it can be said that the three are complementary protection: (1) provenance, (2) memory consistency, (3) quarantine, and (4) action authorization. This study proposes a model to enforce agent security throughout the information lifecycle, not just on the boundary of the prompt.