arXiv cs.AI: Long-Term Memory Security in LLM Agents

arXiv cs.AI: Long-Term Memory Security in LLM Agents

The paper’s authors argue that writable, cross-session persistent memory gives LLM agents a different security problem from conventional input-centric concerns: memory can persist, change state, and propagate. Their Memory Lifecycle Framework organizes attacks, defenses, and dependencies across six phases—Write, Store, Retrieve, Execute, Share & Propagate, and Forget & Rollback—and four security objectives: Integrity, Confidentiality, Availability, and Governance. The authors’ central point is that security cannot be handled only where information enters an agent; protections and failures can carry across phases. They propose Verifiable Memory Governance (VMG), a framework of architectural primitives intended to specify and evaluate auditable, recoverable control over memory state within declared system and threat-model boundaries. They also argue for integrating provenance, versioning, and policy-aware retention with retrieval and execution defenses to support prevention, containment, and recovery across the lifecycle. For people designing or assessing agents with persistent memory, the framework offers a way to examine where controls apply and whether failures can be traced or reversed. The abstract presents a framework and motivation; it does not report how well the proposed controls perform in practice.

Publication: 161aeb14-f56b-45f7-8777-06aa99f5bb29

attribution — pass: The reading attributes the arguments and frameworks to the paper's authors. The 'arXiv cs.AI' label matches the publisher field, and the paper is cross-listed in cs.AI, although its primary category is cs.CR. The source's claims are kept as the authors' assertions.

Authors:Zehao Lin, Xixuan Hao, Renyu Fu, Shaobo Cui, Kai Chen, Chunyu Li, Zhiyu Li, Feiyu Xiong

summary — pass: The summary accurately conveys the threat-landscape claim, the six phases and four objectives, VMG, and the recommended integration of controls. 'Change state' is a loose rendering of 'statefulness'; using the exact term would be tighter, but this does not distort the meaning. 'Protections and failures can carry across phases' fairly reflects 'cross-phase dependencies'. The question follows from the abstract's evaluation claim. Terms such as LLM agent and provenance would benefit from tooltips, but the core idea is readable.

organizes attacks, defenses, and their cross-phase dependencies along two axes

date — pass: originalPublished 2026-04-17 matches the v1 submission date. It is neither the later v5 revision date (30 Oct 2026) nor the feed date.

[Submitted on 17 Apr 2026 (v1), last revised 30 Oct 2026 (this version, v5)]

support — pass: Each claim matches its quoted excerpt. The practical significance about tracing or reversing failures follows from 'auditable, recoverable control'. The stated limitations accurately note that the evidence gives no performance results and does not describe the primitives. No benefits or impacts are invented.

support auditable prevention, containment, and recovery across the lifecycle

media — pass: The selected media is the verified direct arXiv abstract page of the source itself, which is the most direct access point.