A Survey on the Security of Long-Term Memory in LLM Agents: Toward Mnemonic Sovereignty

• URL: http://arxiv.org/abs/2604.16548v1
• Date: Fri, 17 Apr 2026 06:28:22 GMT
• Title: A Survey on the Security of Long-Term Memory in LLM Agents: Toward Mnemonic Sovereignty
• Abstract summary: Drawing on cognitive neuroscience and the philosophy of memory, we characterize agent memory as malleable, rewritable, and socially propagating.<n>We develop a memory-lifecycle framework organized around six phases -- Write, Store, Retrieve, Execute, Share, Forget/Rollback.<n>Three findings stand out: the literature concentrates on write- and retrieve-time integrity attacks, while confidentiality, availability, store/forget, and benign-persistence failures remain sparsely studied.
• Score: 12.941302388928841
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Research on large language model (LLM) security is shifting from "will the model leak training data" to a more consequential question: can an agent with persistent, long-term memory be continuously shaped, cross-session poisoned, accessed without authorization, and propagated across shared organizational state? Recent surveys cover memory architectures and agent mechanisms, but fewer center the epistemic and governance properties of persistent, writable memory as the reason memory is an independent security problem. This survey addresses that gap. Drawing on cognitive neuroscience and the philosophy of memory, we characterize agent memory as malleable, rewritable, and socially propagating, and develop a memory-lifecycle framework organized around six phases -- Write, Store, Retrieve, Execute, Share, Forget/Rollback -- cross-tabulated against four security objectives: integrity, confidentiality, availability, governance. We organize the literature on memory poisoning, extraction, retrieval corruption, control-flow hijacking, cross-agent propagation, rollback, and governance, and situate representative architectures as determinants of which phases are explicitly governable. Three findings stand out: the literature concentrates on write- and retrieve-time integrity attacks, while confidentiality, availability, store/forget, and benign-persistence failures remain sparsely studied; no published architecture covers all nine governance primitives we identify; and using LLMs themselves for memory security remains sparse yet essential. We unify these under mnemonic sovereignty -- verifiable, recoverable governance over what may be written, who may read, when updates are authorized, and which states may be forgotten -- arguing future secure agents will be differentiated not only by recall capacity, but by memory governance quality.

Related papers

• Harness the Memory: A Holistic Evaluation of Memory Substrates in Memory Agents [97.19033877543522]
  We present a controlled harness evaluation of memory substrates for memory-augmented agents.<n>We instrument 26 performance and efficiency metrics under a unified harness.<n>These findings motivate substrate routing as a necessary component of adaptive agent memory systems.
  arXiv  Detail & Related papers  (2026-08-15T03:29:48Z)
• GateMem: Benchmarking Memory Governance in Multi-Principal Shared-Memory Agents [61.50171793000712]
  GateMem is a benchmark for multi-principal shared-memory agents.<n>It spans medical, office, education, and household domains.<n>No method simultaneously achieves strong utility, robust access control, and reliable forgetting.
  arXiv  Detail & Related papers  (2026-06-17T09:06:15Z)
• Beyond Similarity: Trustworthy Memory Search for Personal AI Agents [25.265839311088516]
  We study memory search as a trust boundary in personal AI agents.<n>MemGate is a lightweight and deployable memory plug-in for trustworthy memory search.
  arXiv  Detail & Related papers  (2026-06-04T11:54:29Z)
• From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents [3.3489120273076876]
  Memory is a core component of AI agents, enabling them to accumulate knowledge across interactions and improve performance.<n>We present a systematic study of memory poisoning in LLM-based agents.<n>We identify four memory write channels and nine structural vulnerabilities in model capabilities, system prompt design, and agent system architecture.
  arXiv  Detail & Related papers  (2026-06-03T01:04:13Z)
• WorldMemArena: Evaluating Multimodal Agent Memory Through Action-World Interaction [72.1620416874118]
  Multimodal large language models are increasingly deployed as long-horizon agents.<n>Existing benchmarks measure recall over static dialogue, collapse memory into a single end-of-task accuracy, and reduce visual observations to captions.<n>We formulate multimodal agent memory as an Action-World Interaction Loop with an observable four-stage lifecycle.
  arXiv  Detail & Related papers  (2026-05-28T04:27:20Z)
• Remembering More, Risking More: Longitudinal Safety Risks in Memory-Equipped LLM Agents [18.83666486835137]
  In deployment, a single agent serves many independent tasks over a long horizon, and memory accumulated during earlier tasks can affect behavior on later, unrelated ones.<n>We introduce a trigger-probe protocol that evaluates a fixed probe set against read-only memory snapshots at varying prefix lengths.<n>We apply this protocol across three deployment scenarios spanning records, memos, forms, and email correspondence and eight memory architectures.
  arXiv  Detail & Related papers  (2026-05-18T04:06:34Z)
• MemEvoBench: Benchmarking Memory MisEvolution in LLM Agents [78.95081012334116]
  Large Language Models (LLMs) with persistent memory enhances interaction continuity and personalization but introduces new safety risks.<n> contaminated or biased memory accumulation can trigger abnormal agent behaviors.<n>MemeEvoBench is the first benchmark evaluating memory safety in LLM agents against adversarial memory injection, noisy tool outputs, and biased feedback.
  arXiv  Detail & Related papers  (2026-04-17T07:29:52Z)
• Memory poisoning and secure multi-agent systems [5.987250983212102]
  Memory poisoning attacks for Agentic AI and multi-agent systems (MAS) have recently caught attention.<n>We first present the main types of memory systems, we then discuss the feasibility of memory poisoning attacks in these different types of memory systems, and we propose mitigation strategies.<n>We propose to implement local inference based on private knowledge retrieval as an example of mitigation strategy for memory poisoning for semantic memory.
  arXiv  Detail & Related papers  (2026-03-20T14:27:46Z)
• Governing Evolving Memory in LLM Agents: Risks, Mechanisms, and the Stability and Safety Governed Memory (SSGM) Framework [18.46738022193615]
  Long-term memory has emerged as a foundational component of autonomous Large Language Model (LLM) agents.<n>critical concerns regarding memory governance, semantic drift, and privacy vulnerabilities have surfaced.<n>We propose the Stability and Safety-Governed Memory (SSGM) framework, a conceptual governance architecture.
  arXiv  Detail & Related papers  (2026-03-12T10:16:52Z)
• Memory for Autonomous LLM Agents:Mechanisms, Evaluation, and Emerging Frontiers [0.42061757959666934]
  Large language model (LLM) agents increasingly operate in settings where a single context window is too small to capture what has happened.<n>Memory is what turns a stateless text generator into a genuinely adaptive agent.<n>This survey offers a structured account of how memory is designed, implemented, and evaluated in modern LLM-based agents.
  arXiv  Detail & Related papers  (2026-03-08T15:08:01Z)
• ActMem: Bridging the Gap Between Memory Retrieval and Reasoning in LLM Agents [14.695250837875454]
  We propose a novel actionable memory framework called ActMem.<n>ActMem transforms unstructured dialogue history into a structured causal and semantic graph.<n>It enables agents to deduce implicit constraints and resolve potential conflicts between past states and current intentions.
  arXiv  Detail & Related papers  (2026-02-04T00:54:53Z)
• Beyond Heuristics: A Decision-Theoretic Framework for Agent Memory Management [49.71055327567513]
  We argue that memory management should be viewed as a sequential decision-making problem under uncertainty.<n>Our contribution is not a new algorithm, but a principled reframing that clarifies the limitations of approaches.
  arXiv  Detail & Related papers  (2025-12-25T08:23:03Z)
• Memory in the Age of AI Agents [217.9368190980982]
  This work aims to provide an up-to-date landscape of current agent memory research.<n>We identify three dominant realizations of agent memory, namely token-level, parametric, and latent memory.<n>To support practical development, we compile a comprehensive summary of memory benchmarks and open-source frameworks.
  arXiv  Detail & Related papers  (2025-12-15T17:22:34Z)
• MemOS: A Memory OS for AI System [116.87568350346537]
  Large Language Models (LLMs) have become an essential infrastructure for Artificial General Intelligence (AGI)<n>Existing models mainly rely on static parameters and short-lived contextual states, limiting their ability to track user preferences or update knowledge over extended periods.<n>MemOS is a memory operating system that treats memory as a manageable system resource.
  arXiv  Detail & Related papers  (2025-07-04T17:21:46Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.