# arXiv cs.AI: Long-Term Memory Security in LLM Agents [Canonical reading](https://escapemeridian.com/readings/arxiv-cs-ai-long-term-memory-security-in-llm-agents-5658212a) The paper’s authors argue that writable, cross-session persistent memory gives LLM agents a different security problem from conventional input-centric concerns: memory can persist, change state, and propagate. Their Memory Lifecycle Framework organizes attacks, defenses, and dependencies across six phases—Write, Store, Retrieve, Execute, Share & Propagate, and Forget & Rollback—and four security objectives: Integrity, Confidentiality, Availability, and Governance. The authors’ central point is that security cannot be handled only where information enters an agent; protections and failures can carry across phases. They propose Verifiable Memory Governance (VMG), a framework of architectural primitives intended to specify and evaluate auditable, recoverable control over memory state within declared system and threat-model boundaries. They also argue for integrating provenance, versioning, and policy-aware retention with retrieval and execution defenses to support prevention, containment, and recovery across the lifecycle. For people designing or assessing agents with persistent memory, the framework offers a way to examine where controls apply and whether failures can be traced or reversed. The abstract presents a framework and motivation; it does not report how well the proposed controls perform in practice. Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims. ## Original source arXiv cs.AI · Article Original source date: Apr 17, 2026 (2026-04-17). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-10T11:24:12.846Z. First observed: 2026-11-02T05:03:15.094Z. Retrieved: 2026-11-03T05:19:00.264Z. - [A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecycle](https://arxiv.org/abs/2604.16548) ## Limits The supplied evidence is the paper’s abstract and publication-page text; it does not describe the five architectural primitives or report evaluation results. The abstract motivates integrating named controls but does not establish their effectiveness in deployed agents. ## Open question How does the paper evaluate whether Verifiable Memory Governance provides auditable, recoverable control within its declared system and threat-model boundaries? ## Source-stated The authors characterize persistent memory in LLM agents as creating security concerns distinct from conventional input-centric security, due to persistence, statefulness, and propagation. > characterized by three properties: persistence, statefulness, and propagation. - [Supporting source](https://arxiv.org/abs/2604.16548) ## Source-stated The Memory Lifecycle Framework organizes attacks, defenses, and dependencies across six phases and four security objectives. > six lifecycle phases (Write, Store, Retrieve, Execute, Share & Propagate, Forget & Rollback) and four security objectives (Integrity, Confidentiality, Availability, Governance). - [Supporting source](https://arxiv.org/abs/2604.16548) ## Source-stated The authors propose Verifiable Memory Governance as a framework of architectural primitives for specifying and evaluating auditable, recoverable control over memory state within declared boundaries. > a framework of five architectural primitives for specifying and evaluating auditable, recoverable control over memory state within declared system and threat-model boundaries. - [Supporting source](https://arxiv.org/abs/2604.16548) ## Source-stated The authors argue that provenance, versioning, and policy-aware retention should be integrated with retrieval and execution defenses. > integrating provenance, versioning, and policy-aware retention with retrieval and execution defenses - [Supporting source](https://arxiv.org/abs/2604.16548) ## Source and contributor context Lin, Zehao, Hao, Xixuan, Fu, Renyu, Cui, Shaobo, Chen, Kai, Li, Chunyu, Li, Zhiyu, Xiong, Feiyu · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Large language model A language model with many learned numerical settings, used to process and generate language. - [Definition reference](https://developers.google.com/machine-learning/glossary#large-language-model) ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: 161aeb14-f56b-45f7-8777-06aa99f5bb29. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: passed by anthropic/claude-opus-5.5 on 2026-11-10T11:24:12.846Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: useful\_perspective. Observation: 5be4ff5c7478718f579aba5c2b042e0049a90e2e3572023780c9fd0c92539c81. Source text hash: ac2d0ea1d087a7d16f7b1ae89560be202e7efcc3dd59857299839fc1c1696679. ## Revision and source-check history ### Version 1 — 2026-11-10T11:24:12.846Z The paper’s authors argue that writable, cross-session persistent memory gives LLM agents a different security problem from conventional input-centric concerns: memory can persist, change state, and propagate. Their Memory Lifecycle Framework organizes attacks, defenses, and dependencies across six phases—Write, Store, Retrieve, Execute, Share & Propagate, and Forget & Rollback—and four security objectives: Integrity, Confidentiality, Availability, and Governance. The authors’ central point is that security cannot be handled only where information enters an agent; protections and failures can carry across phases. They propose Verifiable Memory Governance (VMG), a framework of architectural primitives intended to specify and evaluate auditable, recoverable control over memory state within declared system and threat-model boundaries. They also argue for integrating provenance, versioning, and policy-aware retention with retrieval and execution defenses to support prevention, containment, and recovery across the lifecycle. For people designing or assessing agents with persistent memory, the framework offers a way to examine where controls apply and whether failures can be traced or reversed. The abstract presents a framework and motivation; it does not report how well the proposed controls perform in practice. ## Original source arXiv cs.AI · Article Original source date: Apr 17, 2026 (2026-04-17). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-10T11:24:12.846Z. First observed: 2026-11-02T05:03:15.094Z. Retrieved: 2026-11-03T05:19:00.264Z. - [A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecycle](https://arxiv.org/abs/2604.16548) ## Limits The supplied evidence is the paper’s abstract and publication-page text; it does not describe the five architectural primitives or report evaluation results. The abstract motivates integrating named controls but does not establish their effectiveness in deployed agents. ## Open question How does the paper evaluate whether Verifiable Memory Governance provides auditable, recoverable control within its declared system and threat-model boundaries? ## Source-stated The authors characterize persistent memory in LLM agents as creating security concerns distinct from conventional input-centric security, due to persistence, statefulness, and propagation. > characterized by three properties: persistence, statefulness, and propagation. - [Supporting source](https://arxiv.org/abs/2604.16548) ## Source-stated The Memory Lifecycle Framework organizes attacks, defenses, and dependencies across six phases and four security objectives. > six lifecycle phases (Write, Store, Retrieve, Execute, Share & Propagate, Forget & Rollback) and four security objectives (Integrity, Confidentiality, Availability, Governance). - [Supporting source](https://arxiv.org/abs/2604.16548) ## Source-stated The authors propose Verifiable Memory Governance as a framework of architectural primitives for specifying and evaluating auditable, recoverable control over memory state within declared boundaries. > a framework of five architectural primitives for specifying and evaluating auditable, recoverable control over memory state within declared system and threat-model boundaries. - [Supporting source](https://arxiv.org/abs/2604.16548) ## Source-stated The authors argue that provenance, versioning, and policy-aware retention should be integrated with retrieval and execution defenses. > integrating provenance, versioning, and policy-aware retention with retrieval and execution defenses - [Supporting source](https://arxiv.org/abs/2604.16548) ## Source and contributor context Lin, Zehao, Hao, Xixuan, Fu, Renyu, Cui, Shaobo, Chen, Kai, Li, Chunyu, Li, Zhiyu, Xiong, Feiyu · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Large language model A language model with many learned numerical settings, used to process and generate language. - [Definition reference](https://developers.google.com/machine-learning/glossary#large-language-model) ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: 161aeb14-f56b-45f7-8777-06aa99f5bb29. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: passed by anthropic/claude-opus-5.5 on 2026-11-10T11:24:12.846Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: useful\_perspective. Observation: 5be4ff5c7478718f579aba5c2b042e0049a90e2e3572023780c9fd0c92539c81. Source text hash: ac2d0ea1d087a7d16f7b1ae89560be202e7efcc3dd59857299839fc1c1696679. ### passed — 2026-11-10T11:24:12.846Z — anthropic/claude-opus-5.5 Publication: 161aeb14-f56b-45f7-8777-06aa99f5bb29 attribution — pass: The reading attributes the arguments and frameworks to the paper's authors. The 'arXiv cs.AI' label matches the publisher field, and the paper is cross-listed in cs.AI, although its primary category is cs.CR. The source's claims are kept as the authors' assertions. > Authors:Zehao Lin, Xixuan Hao, Renyu Fu, Shaobo Cui, Kai Chen, Chunyu Li, Zhiyu Li, Feiyu Xiong summary — pass: The summary accurately conveys the threat-landscape claim, the six phases and four objectives, VMG, and the recommended integration of controls. 'Change state' is a loose rendering of 'statefulness'; using the exact term would be tighter, but this does not distort the meaning. 'Protections and failures can carry across phases' fairly reflects 'cross-phase dependencies'. The question follows from the abstract's evaluation claim. Terms such as LLM agent and provenance would benefit from tooltips, but the core idea is readable. > organizes attacks, defenses, and their cross-phase dependencies along two axes date — pass: originalPublished 2026-04-17 matches the v1 submission date. It is neither the later v5 revision date (30 Oct 2026) nor the feed date. > \[Submitted on 17 Apr 2026 (v1), last revised 30 Oct 2026 (this version, v5)\] support — pass: Each claim matches its quoted excerpt. The practical significance about tracing or reversing failures follows from 'auditable, recoverable control'. The stated limitations accurately note that the evidence gives no performance results and does not describe the primitives. No benefits or impacts are invented. > support auditable prevention, containment, and recovery across the lifecycle media — pass: The selected media is the verified direct arXiv abstract page of the source itself, which is the most direct access point. ## Recorded references Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter. Some references could not be checked. Reload to try again. [Reference data (JSON)](/readings/5658212aca9075936b24f41eef16e264fcc7ccb659a885fbaff51c2c8989c836/references.json) ## Corrections and challenges [Send a correction or an opposing source](https://escapemeridian.com/corrections/) [JSON record](https://escapemeridian.com/readings/arxiv-cs-ai-long-term-memory-security-in-llm-agents-5658212a.json)