{"id":"5658212aca9075936b24f41eef16e264fcc7ccb659a885fbaff51c2c8989c836","title":"arXiv cs.AI: Long-Term Memory Security in LLM Agents","argument":"The paper’s authors argue that writable, cross-session persistent memory gives LLM agents a different security problem from conventional input-centric concerns: memory can persist, change state, and propagate. Their Memory Lifecycle Framework organizes attacks, defenses, and dependencies across six phases—Write, Store, Retrieve, Execute, Share & Propagate, and Forget & Rollback—and four security objectives: Integrity, Confidentiality, Availability, and Governance. The authors’ central point is that security cannot be handled only where information enters an agent; protections and failures can carry across phases. They propose Verifiable Memory Governance (VMG), a framework of architectural primitives intended to specify and evaluate auditable, recoverable control over memory state within declared system and threat-model boundaries. They also argue for integrating provenance, versioning, and policy-aware retention with retrieval and execution defenses to support prevention, containment, and recovery across the lifecycle. For people designing or assessing agents with persistent memory, the framework offers a way to examine where controls apply and whether failures can be traced or reversed. The abstract presents a framework and motivation; it does not report how well the proposed controls perform in practice.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The supplied evidence is the paper’s abstract and publication-page text; it does not describe the five architectural primitives or report evaluation results. The abstract motivates integrating named controls but does not establish their effectiveness in deployed agents.","speaker":{"name":"Lin, Zehao, Hao, Xixuan, Fu, Renyu, Cui, Shaobo, Chen, Kai, Li, Chunyu, Li, Zhiyu, Xiong, Feiyu","roleAtSource":"Article author"},"source":{"title":"A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecycle","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2604.16548","publishedAt":"2026-04-17","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors characterize persistent memory in LLM agents as creating security concerns distinct from conventional input-centric security, due to persistence, statefulness, and propagation.","excerpt":"characterized by three properties: persistence, statefulness, and propagation.","url":"https://arxiv.org/abs/2604.16548","relationship":"Source-stated"},{"text":"The Memory Lifecycle Framework organizes attacks, defenses, and dependencies across six phases and four security objectives.","excerpt":"six lifecycle phases (Write, Store, Retrieve, Execute, Share & Propagate, Forget & Rollback) and four security objectives (Integrity, Confidentiality, Availability, Governance).","url":"https://arxiv.org/abs/2604.16548","relationship":"Source-stated"},{"text":"The authors propose Verifiable Memory Governance as a framework of architectural primitives for specifying and evaluating auditable, recoverable control over memory state within declared boundaries.","excerpt":"a framework of five architectural primitives for specifying and evaluating auditable, recoverable control over memory state within declared system and threat-model boundaries.","url":"https://arxiv.org/abs/2604.16548","relationship":"Source-stated"},{"text":"The authors argue that provenance, versioning, and policy-aware retention should be integrated with retrieval and execution defenses.","excerpt":"integrating provenance, versioning, and policy-aware retention with retrieval and execution defenses","url":"https://arxiv.org/abs/2604.16548","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2604.16548","checkedAt":"2026-11-11T04:28:06.897Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How does the paper evaluate whether Verifiable Memory Governance provides auditable, recoverable control within its declared system and threat-model boundaries?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI: Long-Term Memory Security in LLM Agents","summary":"The paper’s authors argue that writable, cross-session persistent memory gives LLM agents a different security problem from conventional input-centric concerns: memory can persist, change state, and propagate. Their Memory Lifecycle Framework organizes attacks, defenses, and dependencies across six phases—Write, Store, Retrieve, Execute, Share & Propagate, and Forget & Rollback—and four security objectives: Integrity, Confidentiality, Availability, and Governance. The authors’ central point is that security cannot be handled only where information enters an agent; protections and failures can carry across phases. They propose Verifiable Memory Governance (VMG), a framework of architectural primitives intended to specify and evaluate auditable, recoverable control over memory state within declared system and threat-model boundaries. They also argue for integrating provenance, versioning, and policy-aware retention with retrieval and execution defenses to support prevention, containment, and recovery across the lifecycle. For people designing or assessing agents with persistent memory, the framework offers a way to examine where controls apply and whether failures can be traced or reversed. The abstract presents a framework and motivation; it does not report how well the proposed controls perform in practice.","question":"How does the paper evaluate whether Verifiable Memory Governance provides auditable, recoverable control within its declared system and threat-model boundaries?","claims":[{"text":"The authors characterize persistent memory in LLM agents as creating security concerns distinct from conventional input-centric security, due to persistence, statefulness, and propagation.","excerpt":"characterized by three properties: persistence, statefulness, and propagation.","support":"source-stated"},{"text":"The Memory Lifecycle Framework organizes attacks, defenses, and dependencies across six phases and four security objectives.","excerpt":"six lifecycle phases (Write, Store, Retrieve, Execute, Share & Propagate, Forget & Rollback) and four security objectives (Integrity, Confidentiality, Availability, Governance).","support":"source-stated"},{"text":"The authors propose Verifiable Memory Governance as a framework of architectural primitives for specifying and evaluating auditable, recoverable control over memory state within declared boundaries.","excerpt":"a framework of five architectural primitives for specifying and evaluating auditable, recoverable control over memory state within declared system and threat-model boundaries.","support":"source-stated"},{"text":"The authors argue that provenance, versioning, and policy-aware retention should be integrated with retrieval and execution defenses.","excerpt":"integrating provenance, versioning, and policy-aware retention with retrieval and execution defenses","support":"source-stated"}],"limitations":["The supplied evidence is the paper’s abstract and publication-page text; it does not describe the five architectural primitives or report evaluation results.","The abstract motivates integrating named controls but does not establish their effectiveness in deployed agents."],"mediaId":"034fbc8e3ea24768eebd5a154d6894c5680c3970fa6aaa79cffd50eb54137449","correctionReason":null,"id":"5658212aca9075936b24f41eef16e264fcc7ccb659a885fbaff51c2c8989c836","publicationId":"161aeb14-f56b-45f7-8777-06aa99f5bb29","version":1,"sourceUrl":"https://arxiv.org/abs/2604.16548","sourceTitle":"A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecycle","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-04-17","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-02T05:03:15.094Z","createdAt":"2026-11-10T11:24:12.846Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"034fbc8e3ea24768eebd5a154d6894c5680c3970fa6aaa79cffd50eb54137449","kind":"article","url":"https://arxiv.org/abs/2604.16548","sourceUrl":"https://arxiv.org/abs/2604.16548","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-03T05:19:00.802Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2604.16548","checkedAt":"2026-11-11T04:28:06.897Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["useful_perspective"],"rubricVersion":"stream-admission-v5","mediaId":"034fbc8e3ea24768eebd5a154d6894c5680c3970fa6aaa79cffd50eb54137449","confidence":0.72,"provider":"typesafe","model":"jev-1.13.0","inputHash":"1b0d5f3efcc2bc1e0996bab098c51846d243baa046ae2308b2435eadd2c2bfe5","decidedAt":"2026-11-03T05:19:04.417Z","redecided":{"from":"stream-admission-v5","under":"stream-admission-v5+confidence-0.5"}},"provenance":{"textHash":"ac2d0ea1d087a7d16f7b1ae89560be202e7efcc3dd59857299839fc1c1696679","observationId":"5be4ff5c7478718f579aba5c2b042e0049a90e2e3572023780c9fd0c92539c81","retrievedAt":"2026-11-03T05:19:00.264Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"942c672b-4846-48b3-8a94-39222ff439b9"},"reviewer":{"model":"gpt-6-luna","runId":"38cd65c0-5b36-4c5c-8a50-436e33601204"}},"audit":{"status":"passed","reviewedAt":"2026-11-10T11:24:12.846Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Lin, Zehao","url":null,"kind":"unknown"},{"name":"Hao, Xixuan","url":null,"kind":"unknown"},{"name":"Fu, Renyu","url":null,"kind":"unknown"},{"name":"Cui, Shaobo","url":null,"kind":"unknown"},{"name":"Chen, Kai","url":null,"kind":"unknown"},{"name":"Li, Chunyu","url":null,"kind":"unknown"},{"name":"Li, Zhiyu","url":null,"kind":"unknown"},{"name":"Xiong, Feiyu","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Lin, Zehao","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Lin, Zehao","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2604.16548","locator":"head/meta[name=author|citation_author]"},"assertionId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T04:28:06.897Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3","sourceUrl":"https://arxiv.org/abs/2604.16548","contentSha256":"984cb47f0770ae7bb611132094616b6dce838a995ef48201187964f7c273e76b","textHash":"ac2d0ea1d087a7d16f7b1ae89560be202e7efcc3dd59857299839fc1c1696679","observedAt":"2026-11-11T04:28:06.897Z"}},{"actor":{"name":"Hao, Xixuan","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Hao, Xixuan","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2604.16548","locator":"head/meta[name=author|citation_author]"},"assertionId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T04:28:06.897Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3","sourceUrl":"https://arxiv.org/abs/2604.16548","contentSha256":"984cb47f0770ae7bb611132094616b6dce838a995ef48201187964f7c273e76b","textHash":"ac2d0ea1d087a7d16f7b1ae89560be202e7efcc3dd59857299839fc1c1696679","observedAt":"2026-11-11T04:28:06.897Z"}},{"actor":{"name":"Fu, Renyu","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Fu, Renyu","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2604.16548","locator":"head/meta[name=author|citation_author]"},"assertionId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T04:28:06.897Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3","sourceUrl":"https://arxiv.org/abs/2604.16548","contentSha256":"984cb47f0770ae7bb611132094616b6dce838a995ef48201187964f7c273e76b","textHash":"ac2d0ea1d087a7d16f7b1ae89560be202e7efcc3dd59857299839fc1c1696679","observedAt":"2026-11-11T04:28:06.897Z"}},{"actor":{"name":"Cui, Shaobo","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Cui, Shaobo","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2604.16548","locator":"head/meta[name=author|citation_author]"},"assertionId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T04:28:06.897Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3","sourceUrl":"https://arxiv.org/abs/2604.16548","contentSha256":"984cb47f0770ae7bb611132094616b6dce838a995ef48201187964f7c273e76b","textHash":"ac2d0ea1d087a7d16f7b1ae89560be202e7efcc3dd59857299839fc1c1696679","observedAt":"2026-11-11T04:28:06.897Z"}},{"actor":{"name":"Chen, Kai","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Chen, Kai","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2604.16548","locator":"head/meta[name=author|citation_author]"},"assertionId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3:participation:4","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T04:28:06.897Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3","sourceUrl":"https://arxiv.org/abs/2604.16548","contentSha256":"984cb47f0770ae7bb611132094616b6dce838a995ef48201187964f7c273e76b","textHash":"ac2d0ea1d087a7d16f7b1ae89560be202e7efcc3dd59857299839fc1c1696679","observedAt":"2026-11-11T04:28:06.897Z"}},{"actor":{"name":"Li, Chunyu","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Li, Chunyu","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2604.16548","locator":"head/meta[name=author|citation_author]"},"assertionId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3:participation:5","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T04:28:06.897Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3","sourceUrl":"https://arxiv.org/abs/2604.16548","contentSha256":"984cb47f0770ae7bb611132094616b6dce838a995ef48201187964f7c273e76b","textHash":"ac2d0ea1d087a7d16f7b1ae89560be202e7efcc3dd59857299839fc1c1696679","observedAt":"2026-11-11T04:28:06.897Z"}},{"actor":{"name":"Li, Zhiyu","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Li, Zhiyu","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2604.16548","locator":"head/meta[name=author|citation_author]"},"assertionId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3:participation:6","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T04:28:06.897Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3","sourceUrl":"https://arxiv.org/abs/2604.16548","contentSha256":"984cb47f0770ae7bb611132094616b6dce838a995ef48201187964f7c273e76b","textHash":"ac2d0ea1d087a7d16f7b1ae89560be202e7efcc3dd59857299839fc1c1696679","observedAt":"2026-11-11T04:28:06.897Z"}},{"actor":{"name":"Xiong, Feiyu","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Xiong, Feiyu","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2604.16548","locator":"head/meta[name=author|citation_author]"},"assertionId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3:participation:7","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T04:28:06.897Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3","sourceUrl":"https://arxiv.org/abs/2604.16548","contentSha256":"984cb47f0770ae7bb611132094616b6dce838a995ef48201187964f7c273e76b","textHash":"ac2d0ea1d087a7d16f7b1ae89560be202e7efcc3dd59857299839fc1c1696679","observedAt":"2026-11-11T04:28:06.897Z"}}],"participationCoverage":{"total":8,"returned":8,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2604.16548","snapshotId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3","contentSha256":"984cb47f0770ae7bb611132094616b6dce838a995ef48201187964f7c273e76b","textHash":"ac2d0ea1d087a7d16f7b1ae89560be202e7efcc3dd59857299839fc1c1696679","observedAt":"2026-11-11T04:28:06.897Z","basis":"publisher-page-metadata","sourceLinks":53,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/5658212aca9075936b24f41eef16e264fcc7ccb659a885fbaff51c2c8989c836/source"}},"canonicalUrl":"https://escapemeridian.com/readings/arxiv-cs-ai-long-term-memory-security-in-llm-agents-5658212a","formats":{"html":"/readings/arxiv-cs-ai-long-term-memory-security-in-llm-agents-5658212a","markdown":"/readings/arxiv-cs-ai-long-term-memory-security-in-llm-agents-5658212a.md","json":"/readings/arxiv-cs-ai-long-term-memory-security-in-llm-agents-5658212a.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[{"id":"term-llm","name":"Large language model","explanation":"A language model with many learned numerical settings, used to process and generate language.","referenceUrl":"https://developers.google.com/machine-learning/glossary#large-language-model"}],"entities":[{"id":"arxiv","name":"arXiv","kind":"organization","context":"arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.","referenceUrls":["https://arxiv.org/","https://info.arxiv.org/help/api/index.html"],"path":"/entities/arxiv","json":"/entities/arxiv.json","markdown":"/entities/arxiv.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"5658212aca9075936b24f41eef16e264fcc7ccb659a885fbaff51c2c8989c836","revision":"161aeb14-f56b-45f7-8777-06aa99f5bb29","revisionKind":"publication-id","title":"arXiv cs.AI: Long-Term Memory Security in LLM Agents","url":"https://escapemeridian.com/readings/arxiv-cs-ai-long-term-memory-security-in-llm-agents-5658212a"},"source":{"type":"source","id":"https://arxiv.org/abs/2604.16548","revision":"ac2d0ea1d087a7d16f7b1ae89560be202e7efcc3dd59857299839fc1c1696679","revisionKind":"sha256-source-text","title":"A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecycle","url":"https://arxiv.org/abs/2604.16548"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"5658212aca9075936b24f41eef16e264fcc7ccb659a885fbaff51c2c8989c836","title":"arXiv cs.AI: Long-Term Memory Security in LLM Agents","argument":"The paper’s authors argue that writable, cross-session persistent memory gives LLM agents a different security problem from conventional input-centric concerns: memory can persist, change state, and propagate. Their Memory Lifecycle Framework organizes attacks, defenses, and dependencies across six phases—Write, Store, Retrieve, Execute, Share & Propagate, and Forget & Rollback—and four security objectives: Integrity, Confidentiality, Availability, and Governance. The authors’ central point is that security cannot be handled only where information enters an agent; protections and failures can carry across phases. They propose Verifiable Memory Governance (VMG), a framework of architectural primitives intended to specify and evaluate auditable, recoverable control over memory state within declared system and threat-model boundaries. They also argue for integrating provenance, versioning, and policy-aware retention with retrieval and execution defenses to support prevention, containment, and recovery across the lifecycle. For people designing or assessing agents with persistent memory, the framework offers a way to examine where controls apply and whether failures can be traced or reversed. The abstract presents a framework and motivation; it does not report how well the proposed controls perform in practice.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The supplied evidence is the paper’s abstract and publication-page text; it does not describe the five architectural primitives or report evaluation results. The abstract motivates integrating named controls but does not establish their effectiveness in deployed agents.","speaker":{"name":"Lin, Zehao, Hao, Xixuan, Fu, Renyu, Cui, Shaobo, Chen, Kai, Li, Chunyu, Li, Zhiyu, Xiong, Feiyu","roleAtSource":"Article author"},"source":{"title":"A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecycle","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2604.16548","publishedAt":"2026-04-17","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors characterize persistent memory in LLM agents as creating security concerns distinct from conventional input-centric security, due to persistence, statefulness, and propagation.","excerpt":"characterized by three properties: persistence, statefulness, and propagation.","url":"https://arxiv.org/abs/2604.16548","relationship":"Source-stated"},{"text":"The Memory Lifecycle Framework organizes attacks, defenses, and dependencies across six phases and four security objectives.","excerpt":"six lifecycle phases (Write, Store, Retrieve, Execute, Share & Propagate, Forget & Rollback) and four security objectives (Integrity, Confidentiality, Availability, Governance).","url":"https://arxiv.org/abs/2604.16548","relationship":"Source-stated"},{"text":"The authors propose Verifiable Memory Governance as a framework of architectural primitives for specifying and evaluating auditable, recoverable control over memory state within declared boundaries.","excerpt":"a framework of five architectural primitives for specifying and evaluating auditable, recoverable control over memory state within declared system and threat-model boundaries.","url":"https://arxiv.org/abs/2604.16548","relationship":"Source-stated"},{"text":"The authors argue that provenance, versioning, and policy-aware retention should be integrated with retrieval and execution defenses.","excerpt":"integrating provenance, versioning, and policy-aware retention with retrieval and execution defenses","url":"https://arxiv.org/abs/2604.16548","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2604.16548","checkedAt":"2026-11-11T04:28:06.897Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How does the paper evaluate whether Verifiable Memory Governance provides auditable, recoverable control within its declared system and threat-model boundaries?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI: Long-Term Memory Security in LLM Agents","summary":"The paper’s authors argue that writable, cross-session persistent memory gives LLM agents a different security problem from conventional input-centric concerns: memory can persist, change state, and propagate. Their Memory Lifecycle Framework organizes attacks, defenses, and dependencies across six phases—Write, Store, Retrieve, Execute, Share & Propagate, and Forget & Rollback—and four security objectives: Integrity, Confidentiality, Availability, and Governance. The authors’ central point is that security cannot be handled only where information enters an agent; protections and failures can carry across phases. They propose Verifiable Memory Governance (VMG), a framework of architectural primitives intended to specify and evaluate auditable, recoverable control over memory state within declared system and threat-model boundaries. They also argue for integrating provenance, versioning, and policy-aware retention with retrieval and execution defenses to support prevention, containment, and recovery across the lifecycle. For people designing or assessing agents with persistent memory, the framework offers a way to examine where controls apply and whether failures can be traced or reversed. The abstract presents a framework and motivation; it does not report how well the proposed controls perform in practice.","question":"How does the paper evaluate whether Verifiable Memory Governance provides auditable, recoverable control within its declared system and threat-model boundaries?","claims":[{"text":"The authors characterize persistent memory in LLM agents as creating security concerns distinct from conventional input-centric security, due to persistence, statefulness, and propagation.","excerpt":"characterized by three properties: persistence, statefulness, and propagation.","support":"source-stated"},{"text":"The Memory Lifecycle Framework organizes attacks, defenses, and dependencies across six phases and four security objectives.","excerpt":"six lifecycle phases (Write, Store, Retrieve, Execute, Share & Propagate, Forget & Rollback) and four security objectives (Integrity, Confidentiality, Availability, Governance).","support":"source-stated"},{"text":"The authors propose Verifiable Memory Governance as a framework of architectural primitives for specifying and evaluating auditable, recoverable control over memory state within declared boundaries.","excerpt":"a framework of five architectural primitives for specifying and evaluating auditable, recoverable control over memory state within declared system and threat-model boundaries.","support":"source-stated"},{"text":"The authors argue that provenance, versioning, and policy-aware retention should be integrated with retrieval and execution defenses.","excerpt":"integrating provenance, versioning, and policy-aware retention with retrieval and execution defenses","support":"source-stated"}],"limitations":["The supplied evidence is the paper’s abstract and publication-page text; it does not describe the five architectural primitives or report evaluation results.","The abstract motivates integrating named controls but does not establish their effectiveness in deployed agents."],"mediaId":"034fbc8e3ea24768eebd5a154d6894c5680c3970fa6aaa79cffd50eb54137449","correctionReason":null,"id":"5658212aca9075936b24f41eef16e264fcc7ccb659a885fbaff51c2c8989c836","publicationId":"161aeb14-f56b-45f7-8777-06aa99f5bb29","version":1,"sourceUrl":"https://arxiv.org/abs/2604.16548","sourceTitle":"A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecycle","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-04-17","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-02T05:03:15.094Z","createdAt":"2026-11-10T11:24:12.846Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"034fbc8e3ea24768eebd5a154d6894c5680c3970fa6aaa79cffd50eb54137449","kind":"article","url":"https://arxiv.org/abs/2604.16548","sourceUrl":"https://arxiv.org/abs/2604.16548","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-03T05:19:00.802Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2604.16548","checkedAt":"2026-11-11T04:28:06.897Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["useful_perspective"],"rubricVersion":"stream-admission-v5","mediaId":"034fbc8e3ea24768eebd5a154d6894c5680c3970fa6aaa79cffd50eb54137449","confidence":0.72,"provider":"typesafe","model":"jev-1.13.0","inputHash":"1b0d5f3efcc2bc1e0996bab098c51846d243baa046ae2308b2435eadd2c2bfe5","decidedAt":"2026-11-03T05:19:04.417Z","redecided":{"from":"stream-admission-v5","under":"stream-admission-v5+confidence-0.5"}},"provenance":{"textHash":"ac2d0ea1d087a7d16f7b1ae89560be202e7efcc3dd59857299839fc1c1696679","observationId":"5be4ff5c7478718f579aba5c2b042e0049a90e2e3572023780c9fd0c92539c81","retrievedAt":"2026-11-03T05:19:00.264Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"942c672b-4846-48b3-8a94-39222ff439b9"},"reviewer":{"model":"gpt-6-luna","runId":"38cd65c0-5b36-4c5c-8a50-436e33601204"}},"audit":{"status":"passed","reviewedAt":"2026-11-10T11:24:12.846Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Lin, Zehao","url":null,"kind":"unknown"},{"name":"Hao, Xixuan","url":null,"kind":"unknown"},{"name":"Fu, Renyu","url":null,"kind":"unknown"},{"name":"Cui, Shaobo","url":null,"kind":"unknown"},{"name":"Chen, Kai","url":null,"kind":"unknown"},{"name":"Li, Chunyu","url":null,"kind":"unknown"},{"name":"Li, Zhiyu","url":null,"kind":"unknown"},{"name":"Xiong, Feiyu","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Lin, Zehao","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Lin, Zehao","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2604.16548","locator":"head/meta[name=author|citation_author]"},"assertionId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T04:28:06.897Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3","sourceUrl":"https://arxiv.org/abs/2604.16548","contentSha256":"984cb47f0770ae7bb611132094616b6dce838a995ef48201187964f7c273e76b","textHash":"ac2d0ea1d087a7d16f7b1ae89560be202e7efcc3dd59857299839fc1c1696679","observedAt":"2026-11-11T04:28:06.897Z"}},{"actor":{"name":"Hao, Xixuan","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Hao, Xixuan","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2604.16548","locator":"head/meta[name=author|citation_author]"},"assertionId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T04:28:06.897Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3","sourceUrl":"https://arxiv.org/abs/2604.16548","contentSha256":"984cb47f0770ae7bb611132094616b6dce838a995ef48201187964f7c273e76b","textHash":"ac2d0ea1d087a7d16f7b1ae89560be202e7efcc3dd59857299839fc1c1696679","observedAt":"2026-11-11T04:28:06.897Z"}},{"actor":{"name":"Fu, Renyu","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Fu, Renyu","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2604.16548","locator":"head/meta[name=author|citation_author]"},"assertionId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T04:28:06.897Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3","sourceUrl":"https://arxiv.org/abs/2604.16548","contentSha256":"984cb47f0770ae7bb611132094616b6dce838a995ef48201187964f7c273e76b","textHash":"ac2d0ea1d087a7d16f7b1ae89560be202e7efcc3dd59857299839fc1c1696679","observedAt":"2026-11-11T04:28:06.897Z"}},{"actor":{"name":"Cui, Shaobo","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Cui, Shaobo","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2604.16548","locator":"head/meta[name=author|citation_author]"},"assertionId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T04:28:06.897Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3","sourceUrl":"https://arxiv.org/abs/2604.16548","contentSha256":"984cb47f0770ae7bb611132094616b6dce838a995ef48201187964f7c273e76b","textHash":"ac2d0ea1d087a7d16f7b1ae89560be202e7efcc3dd59857299839fc1c1696679","observedAt":"2026-11-11T04:28:06.897Z"}},{"actor":{"name":"Chen, Kai","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Chen, Kai","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2604.16548","locator":"head/meta[name=author|citation_author]"},"assertionId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3:participation:4","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T04:28:06.897Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3","sourceUrl":"https://arxiv.org/abs/2604.16548","contentSha256":"984cb47f0770ae7bb611132094616b6dce838a995ef48201187964f7c273e76b","textHash":"ac2d0ea1d087a7d16f7b1ae89560be202e7efcc3dd59857299839fc1c1696679","observedAt":"2026-11-11T04:28:06.897Z"}},{"actor":{"name":"Li, Chunyu","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Li, Chunyu","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2604.16548","locator":"head/meta[name=author|citation_author]"},"assertionId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3:participation:5","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T04:28:06.897Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3","sourceUrl":"https://arxiv.org/abs/2604.16548","contentSha256":"984cb47f0770ae7bb611132094616b6dce838a995ef48201187964f7c273e76b","textHash":"ac2d0ea1d087a7d16f7b1ae89560be202e7efcc3dd59857299839fc1c1696679","observedAt":"2026-11-11T04:28:06.897Z"}},{"actor":{"name":"Li, Zhiyu","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Li, Zhiyu","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2604.16548","locator":"head/meta[name=author|citation_author]"},"assertionId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3:participation:6","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T04:28:06.897Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3","sourceUrl":"https://arxiv.org/abs/2604.16548","contentSha256":"984cb47f0770ae7bb611132094616b6dce838a995ef48201187964f7c273e76b","textHash":"ac2d0ea1d087a7d16f7b1ae89560be202e7efcc3dd59857299839fc1c1696679","observedAt":"2026-11-11T04:28:06.897Z"}},{"actor":{"name":"Xiong, Feiyu","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Xiong, Feiyu","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2604.16548","locator":"head/meta[name=author|citation_author]"},"assertionId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3:participation:7","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T04:28:06.897Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3","sourceUrl":"https://arxiv.org/abs/2604.16548","contentSha256":"984cb47f0770ae7bb611132094616b6dce838a995ef48201187964f7c273e76b","textHash":"ac2d0ea1d087a7d16f7b1ae89560be202e7efcc3dd59857299839fc1c1696679","observedAt":"2026-11-11T04:28:06.897Z"}}],"participationCoverage":{"total":8,"returned":8,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2604.16548","snapshotId":"ccc25b3cd96c9cc7e3279fba33ae3d74a970a90fb6fdb74914dd6851df2ae7c3","contentSha256":"984cb47f0770ae7bb611132094616b6dce838a995ef48201187964f7c273e76b","textHash":"ac2d0ea1d087a7d16f7b1ae89560be202e7efcc3dd59857299839fc1c1696679","observedAt":"2026-11-11T04:28:06.897Z","basis":"publisher-page-metadata","sourceLinks":53,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/5658212aca9075936b24f41eef16e264fcc7ccb659a885fbaff51c2c8989c836/source"}}}],"audits":[{"publicationId":"161aeb14-f56b-45f7-8777-06aa99f5bb29","verdict":"passed","findings":[{"dimension":"attribution","status":"pass","explanation":"The reading attributes the arguments and frameworks to the paper's authors. The 'arXiv cs.AI' label matches the publisher field, and the paper is cross-listed in cs.AI, although its primary category is cs.CR. The source's claims are kept as the authors' assertions.","excerpt":"Authors:Zehao Lin, Xixuan Hao, Renyu Fu, Shaobo Cui, Kai Chen, Chunyu Li, Zhiyu Li, Feiyu Xiong"},{"dimension":"summary","status":"pass","explanation":"The summary accurately conveys the threat-landscape claim, the six phases and four objectives, VMG, and the recommended integration of controls. 'Change state' is a loose rendering of 'statefulness'; using the exact term would be tighter, but this does not distort the meaning. 'Protections and failures can carry across phases' fairly reflects 'cross-phase dependencies'. The question follows from the abstract's evaluation claim. Terms such as LLM agent and provenance would benefit from tooltips, but the core idea is readable.","excerpt":"organizes attacks, defenses, and their cross-phase dependencies along two axes"},{"dimension":"date","status":"pass","explanation":"originalPublished 2026-04-17 matches the v1 submission date. It is neither the later v5 revision date (30 Oct 2026) nor the feed date.","excerpt":"[Submitted on 17 Apr 2026 (v1), last revised 30 Oct 2026 (this version, v5)]"},{"dimension":"support","status":"pass","explanation":"Each claim matches its quoted excerpt. The practical significance about tracing or reversing failures follows from 'auditable, recoverable control'. The stated limitations accurately note that the evidence gives no performance results and does not describe the primitives. No benefits or impacts are invented.","excerpt":"support auditable prevention, containment, and recovery across the lifecycle"},{"dimension":"media","status":"pass","explanation":"The selected media is the verified direct arXiv abstract page of the source itself, which is the most direct access point.","excerpt":null}],"createdAt":"2026-11-10T11:24:12.846Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}