Source-linked AI summary
A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecycle
Zehao Lin, Xixuan Hao, Renyu Fu, Shaobo Cui, Kai Chen, Chunyu Li, Zhiyu Li, Feiyu Xiong
TL;DR
Persistent long-term memory creates security risks that extend beyond conventional input-centric and single-turn defenses because memories can persist, influence evolving state, and propagate across boundaries. The paper surveys these risks with a six-phase Memory Lifecycle Framework and introduces Verifiable Memory Governance as a formal account of auditable memory control. It concludes that effective protection must address the lifecycle from storage-time provenance and versioning through retention and recovery, rather than relying only on retrieval- or execution-time defenses.
Problem
Writable, cross-session memory creates persistence, statefulness, and propagation risks that conventional input-centric security frameworks and single-session mitigations do not fully address.
Method
The survey organizes attacks, defenses, and dependencies across six lifecycle phases and four security objectives, then formalizes governance through five verifiable primitives.
Results
The analysis finds sparse defenses at Store, Share, and Forget, no benchmark covering the full lifecycle, and a need to anchor security in storage-time provenance, versioning, auditability, and policy-aware retention.
Takeaways & Limitations
Robust LTM security requires lifecycle-wide controls and auditable, recoverable governance rather than a retrofit limited to retrieval or execution.
Takeaways & Limitations
The survey may not fully capture rapidly emerging or unpublished systems, attacks, and benchmarks, especially in industrial memory systems whose designs are not public.
Abstract
from arXiv · showhide
The emergence of writable, cross-session persistent memory in LLM agents introduces a qualitatively different threat landscape from conventional input-centric security concerns, characterized by three properties: persistence, statefulness, and propagation. To systematically characterize this landscape, we propose a Memory Lifecycle Framework that organizes attacks, defenses, and their cross-phase dependencies along two axes: six lifecycle phases (Write, Store, Retrieve, Execute, Share & Propagate, Forget & Rollback) and four security objectives (Integrity, Confidentiality, Availability, Governance). This analysis in turn exposes the need for formal security guarantees at the system level, motivating Verifiable Memory Governance(VMG), a framework of five architectural primitives that specifies what verifiable mechanisms a long-term-memory system must provide to maintain auditable, recoverable control over its memory state. Our analysis indicates that robust Long-Term Memory (LTM) security cannot be retrofitted at retrieval or execution time alone, but must be anchored in storage-time provenance, versioning, and policy-aware retention from the outset.
1 Introduction
Writable, cross-session memory shifts LLM-agent security from transient inputs toward persistent, stateful, and propagating memory risks. The survey organizes these risks through a six-phase lifecycle framework and formalizes auditable governance requirements.
- Persistent long-term memory changes security concerns from immediate outputs to how agents remember, retrieve, plan, and act across future interactions.
- Existing prompt-injection and RAG-corruption mitigations largely operate within single sessions or retrieval episodes and do not fully address persistent cross-session memory.
- Persistence, statefulness, and propagation make poisoned memories durable, behaviorally cumulative, and capable of crossing session, role, and user boundaries.
- The Memory Lifecycle Framework spans Write, Store, Retrieve, Execute, Share & Propagate, and Forget & Rollback, exposing cross-phase attack chains.
- The survey maps attacks and defenses across the lifecycle, finding stronger coverage at Write and Retrieve than at Store, Share, and Forget, with no benchmark spanning all phases.
- Verifiable Memory Governance formalizes five primitives with predicates and evaluation metrics, converting governance into auditable system properties.
2 Memory Lifecycle Framework
The framework treats memory security as a cross-stage process rather than a set of isolated operations. It traces how content is written, transformed, retrieved, executed, and propagated across the lifecycle.
- The lifecycle framework connects attacks and defenses across stages, showing how Write-stage poisoning can activate during Retrieve and be exploited during Execute.
- Write: Write commits content through user instructions, dialogue summarization, observations, or sharing, making source authentication and authorization central security questions.
- Store: Store indexes, compresses, merges, decays, and evicts content, determining whether poisoned memory persists, remains traceable, or gains apparent authority.
3 Attack Patterns Across the Lifecycle
The lifecycle view traces attacks from low-privilege write pathways through storage, retrieval, execution, propagation, and incomplete forgetting. These phases form cross-session attack chains that single-turn detection cannot fully observe.
- Write: Write-path attacks span corpus access, query-only interaction, and environment-only influence, while persistence and scope expand and effectiveness remains high.AgentPoison reports under 0.1% poisoning and over 80% attack success; MINJA permanently alters memory through queries, while eTAMP uses manipulated web pages.
- Store: Storage controls indexing, compression, retention, eviction, versioning, and audit, determining whether entries remain activatable and whether breaches can be traced or rolled back.Automatic expiration, user deletion, provenance, write logs, snapshots, and diff-auditable histories support privacy protection and post-breach recovery.
- Retrieve and Execute: Retrieval reconnects old writes with present behavior, enabling salient or procedural poisoned memories to override instructions, steer tools, or replace task-solving behavior.The retrieval-to-execution path allows memories written weeks earlier to influence current actions.
- Cross-phase chain: A manipulated web observation can be summarized, stored, retrieved days or weeks later, and silently steer tool invocation after the poisoning window has closed.Because single-turn detection cannot observe both ends of this chain, the attack spans WRITE, STORE, RETRIEVE, and EXECUTE.
- Share & Propagate: Shared stores, inter-agent messages, and tool-mediated flows can propagate poisoned content across agents and boundaries, reaching approximately one million multimodal agents in one reported case.Propagation occurs through shared artifacts and external-tool arguments.
- Forget & Rollback: Deleting a visible memory entry may leave retrievable residues in logs, summaries, indexes, lessons, shared stores, or audit records, allowing contamination to reappear after cleanup.Incomplete forgetting is therefore a residual-state problem rather than a new-payload problem.
4 Defenses: Prevention, Containment, and Recovery
The paper presents defenses as distributed across the memory lifecycle, combining write-time prevention, retrieval and execution containment, share-time access modeling, and recovery mechanisms. Recovery for dynamically updated memories remains comparatively underdeveloped.
- Prevention: Write-time defenses prevent untrusted content from becoming persistent through human-verified freezing or metadata recording for provenance, version, sensitivity, and time.These records support later audit, access control, and rollback.
- Containment: Retrieval defenses reduce poisoning impact through isolate-then-aggregate generation, trust-aware methods, and disagreement-based anomaly detection with attack lessons for future hardening.These mechanisms target corruption when memories are selected for active context.
- Containment: Execution defenses separate data from control and restrict untrusted influence through information-flow control, fine-grained tool policies, isolation, and typed privilege boundaries.The objective is to reduce the blast radius of retrieved content during action.
- Share & Propagate: Share-time defenses model principal-aware access and interaction, while graph-level anomaly detection targets previously unseen multi-agent contagion patterns.These mechanisms shift attention from content inspection to relationships among principals and resources.
- Recovery: Forget-and-rollback defenses remain comparatively sparse, with limited end-to-end evaluation for deletion verification, reliable rollback, and forensic traceback in dynamically updated memories.Static-corpus traceback and industry reference primitives demonstrate feasibility but do not establish dynamic-memory coverage.
5 Verifiable Memory Governance: An Operational Framework
Verifiable Memory Governance (VMG) formalizes trustworthy control of long-term memory through five auditable primitives and predicate-based evaluation. Their dependency structure shows that provenance and recovery guarantees require lifecycle foundations established at write and storage time.
- Five governance primitives: VMG defines five primitives—Write Authorization, Provenance Visibility, Principal-Scoped Retrieval, Rollbackability, and Verified Forgetting—as verifiable system properties.Each primitive has a predicate definition and proposed evaluation metric.
- Five governance primitives: Write Authorization requires every memory entry to have an authenticated source and pass an explicit authorization check before consolidation.This prevents untrusted external content from entering memory as user-endorsed content.
- Five governance primitives: Provenance Visibility preserves queryable lineage from each memory entry to its originating write event through summarization and merging.The provenance record supports post-breach attribution and forensic analysis.
- Five governance primitives: Principal-Scoped Retrieval restricts each query response to entries whose authorized scope includes the requesting principal.This is the primitive that directly addresses cross-user or cross-agent memory leakage.
- Recovery and deletion: Rollbackability uses versioned snapshots and write logs to restore memory to a known-safe prior state, while Verified Forgetting tests whether deleted content remains recoverable.Verified Forgetting bounds post-deletion re-exposure probability by ε across probing queries; the five predicates must hold simultaneously for ε-VMG.
- Dependency structure: The dependency tower places Write Authorization as the foundation, with Provenance Visibility supporting Rollbackability and Verified Forgetting, making VMG a lifecycle property rather than a post hoc layer.The paper identifies provenance infrastructure as a near-term priority because higher-level primitives depend on it and remain less deployed.
6 Conclusion and Future Work
The survey frames persistent long-term memory as a security problem extending beyond conventional input-centric defenses. It organizes this landscape across the memory lifecycle and proposes Verifiable Memory Governance while identifying incomplete benchmark coverage.
- Long-term memory threats extend beyond conventional input-centric or single-turn security because poisoned content can persist, propagate, and resist cleanup.
- The Memory Lifecycle Framework organizes attacks and defenses across six phases and four security objectives, exposing cross-phase memory threat chains.
- Verifiable Memory Governance specifies five primitives for auditable and recoverable control over long-term memory.
- Existing benchmarks only partially cover cross-session contamination, share-time propagation, and forget-time recovery.
Limitations
The survey’s taxonomy may omit emerging or unpublished systems and attacks, while its lifecycle phases are an organizational scaffold rather than strict operational boundaries.
- The taxonomy may not fully capture recent or unpublished developments, especially industrial memory systems whose internal designs are not publicly documented.
- Lifecycle phases can blur because retrieval, execution, storage, summarization, sharing, tool calls, logs, and external artifacts may overlap.
A Architectural Governance Primitives.
The governance primitives connect memory control to recovery and deletion, with Table 3 specifying threats, defense directions, and evaluation metrics for each primitive.
- Rollbackability together with verified forgetting determines whether corrupted or sensitive traces can be removed after spreading.
- Table 3 specifies each VMG primitive’s representative threat, corresponding defense direction, and proposed evaluation metric.
B Human-Memory Bridge / Conceptual Grounding
The paper uses a limited human-memory analogy to ground its lifecycle view and explain corresponding governance failures in LLM agents.
- Human memory is described as reconstructive and reconsolidatable, with experiences encoded, consolidated, reactivated, and sometimes rewritten as context and goals evolve.
- Human-memory failures such as source-monitoring failure, confidence inflation, reconsolidation, and social contagion correspond to agent-level provenance failure, read-time rewriting, and cross-agent contamination.