A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecycle
On this page
arXiv:2604.16548v4 Announce Type: replace-cross Abstract: The emergence of writable, cross-session persistent memory in LLM agents introduces a qualitatively different threat landscape from conventional input-centric security concerns, characterized by three properties: persistence, statefulness, and propagation. To systematically characterize this landscape, we propose a Memory Lifecycle Framework that organizes attacks, defenses, and their cross-phase dependencies along two axes: six lifecycle phases (Write, Store, Retrieve, Execute, Share & Propagate, Forget & Rollback) and four security objectives (Integrity, Confidentiality, Availability, Governance). This analysis in turn exposes the need for explicit security requirements at the system level, motivating Verifiable Memory Governance (VMG), a framework of five architectural primitives for specifying and evaluating auditable, recoverable control over memory state within declared system and threat-model boundaries. Our analysis motivates integrating provenance, versioning, and policy-aware retention with retrieval and execution defenses to support auditable prevention, containment, and recovery across the lifecycle.
Why It Matters
This survey characterizes the security of writable, cross-session persistent memory in LLM agents—a threat landscape defined by persistence, statefulness, and propagation—and organizes attacks, defenses, and cross-phase dependencies via a Memory Lifecycle Framework spanning six lifecycle phases (Write, Store, Retrieve, Execute, Share & Propagate, Forget & Rollback) and four security objectives (Integrity, Confidentiality, Availability, Governance). This matters because persistent agent memory introduces qualitatively new security risks beyond input-centric concerns, and a lifecycle taxonomy is needed to map defenses and governance. It connects to agents and autonomy, AI safety, large language models, and power, surveillance, and control.
Sources
Back to Recent News · Sub-article index.