# A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecycle

arXiv:2604.16548v4 Announce Type: replace-cross Abstract: The emergence of writable, cross-session persistent memory in LLM agents introduces a qualitatively different threat landscape from conventional input-centric security concerns, characterized by three properties: persistence, statefulness, and propagation. To systematically characterize this landscape, we propose a Memory Lifecycle Framework that organizes attacks, defenses, and their cross-phase dependencies along two axes: six lifecycle phases (Write, Store, Retrieve, Execute, Share & Propagate, Forget & Rollback) and four security objectives (Integrity, Confidentiality, Availability, Governance). This analysis in turn exposes the need for explicit security requirements at the system level, motivating Verifiable Memory Governance (VMG), a framework of five architectural primitives for specifying and evaluating auditable, recoverable control over memory state within declared system and threat-model boundaries. Our analysis motivates integrating provenance, versioning, and policy-aware retention with retrieval and execution defenses to support auditable prevention, containment, and recovery across the lifecycle.

## Why It Matters

This survey characterizes the security of writable, cross-session persistent memory in LLM agents—a threat landscape defined by persistence, statefulness, and propagation—and organizes attacks, defenses, and cross-phase dependencies via a Memory Lifecycle Framework spanning six lifecycle phases (Write, Store, Retrieve, Execute, Share & Propagate, Forget & Rollback) and four security objectives (Integrity, Confidentiality, Availability, Governance). This matters because persistent agent memory introduces qualitatively new security risks beyond input-centric concerns, and a lifecycle taxonomy is needed to map defenses and governance. It connects to [agents and autonomy](../agents-autonomy.md), [AI safety](../ai-safety.md), [large language models](../large-language-models.md), and [power, surveillance, and control](../surveillance-power.md).

## Sources

- rss: https://arxiv.org/abs/2604.16548

*Back to [Recent News](../../news.md) · [Sub-article index](../index.md).*