A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecycle

arXiv:2604.16548 · cs.CR, cs.AI, cs.CL · Submitted 2026-04-17 · Read on arXiv

cs.CR, cs.AI, cs.CL

Submitted: 2026-04-17

Updated: 2026-09-22

Comments: 15 pages, 3 figures, 3 tables. Accepted to EMNLP 2026

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Provenance — 29× in this paper · explained in 5 episodes
• Long-Term Memory — 15× in this paper
• RAG — 11× in this paper · explained in 3 episodes
• Benchmark — 9× in this paper · explained in 2 episodes
• Verifiable Memory Governance — 8× in this paper
• Agent Memory — 5× in this paper
• Benchmarking — 5× in this paper · explained in 4 episodes
• Provenance Visibility — 5× in this paper
• Trace — 5× in this paper · explained in 2 episodes
• Verified Forgetting — 5× in this paper
• Write Authorization — 5× in this paper
• Machine Unlearning — 4× in this paper · explained in 3 episodes
• Principal-Scoped Retrieval — 4× in this paper
• AI Agents — 3× in this paper · explained in 2 episodes
• Verification — 3× in this paper · explained in 2 episodes
• Agentic System — 2× in this paper · explained in 2 episodes
• In International Conference on Learning Representations — 2× in this paper
• Indirect Prompt Injection — 2× in this paper · explained in 2 episodes
• Robustness — 2× in this paper · explained in 5 episodes
• Steering — 2× in this paper · explained in 2 episodes
• Adam — 1× in this paper · explained in 2 episodes
• Agent Interactions — 1× in this paper
• Agentic Workflows — 1× in this paper
• Aggregation — 1× in this paper
• Clustering — 1× in this paper · explained in 2 episodes
• Conference on Secure and Trustworthy Machine Learning — 1× in this paper
• Core — 1× in this paper · explained in 2 episodes
• Distillation — 1× in this paper · explained in 2 episodes
• Frustration — 1× in this paper · explained in 3 episodes
• Grounding — 1× in this paper · explained in 3 episodes
• Large Language Models (LLMs) — 1× in this paper · explained in 8 episodes
• Meeting of the Association for Computational Linguistics — 1× in this paper
• Papers — 1× in this paper · explained in 3 episodes
• Personalization — 1× in this paper · explained in 2 episodes
• Prompt Injection Attacks — 1× in this paper · explained in 2 episodes
• Retrieval-Augmented Generation (RAG) — 1× in this paper · explained in 18 episodes

Sources

• Phantom: General Backdoor Attacks on Retrieval Augmented Language Generation
• KEPo: Knowledge Evolution Poison on Graph-based Retrieval-Augmented Generation
• AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases
• Mem0: Building Production-Ready AI Agents with Scalable Long-Term Memory
• Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications
• Securing AI Agents with Information-Flow Control
• Defeating Prompt Injections by Design
• AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents
• Memory Injection Attacks on LLM Agents via Query-Only Interaction
• From Local to Global: A Graph RAG Approach to Query-Focused Summarization
• AgentLeak: A Benchmark for Internal-Channel Privacy Leakage in Multi-Agent LLM Systems
• When Personalization Legitimizes Risks: Uncovering Safety Vulnerabilities in Personalized Dialogue Agents
• The Emerged Security and Privacy of LLM Agent: A Survey with Case Studies
• External Data Extraction Attacks against Retrieval-Augmented Large Language Models
• Evaluating Memory in LLM Agents via Incremental Multi-Turn Interactions
• Memory in the Age of AI Agents
• Preventing Prompt Injection with Type-Directed Privilege Separation
• A Vision for Access Control in LLM-based Agent Systems
• MemOS: A Memory OS for AI System
• GraphRAG under Fire

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs