🤖 AI Summary
This study addresses critical security risks—such as memory tampering, unauthorized access, and cross-session poisoning—that threaten the long-term memory of large language model (LLM) agents, an area insufficiently explored in existing research with regard to governability. Integrating insights from cognitive neuroscience and philosophy of memory, the work proposes a comprehensive memory lifecycle framework encompassing writing, storage, retrieval, execution, sharing, and forgetting. Aligning this framework with four core security objectives—integrity, confidentiality, availability, and governability—it conceptualizes memory as an independent security dimension and introduces the notion of “memory sovereignty,” identifying nine governance primitives. Through interdisciplinary analysis, the paper systematically categorizes threats including memory poisoning, extraction attacks, and control-flow hijacking, exposes gaps in current architectures concerning governance coverage and LLMs’ reflexive security capabilities, and highlights the untapped potential of leveraging LLMs themselves to enforce memory security.
📝 Abstract
Research on large language model (LLM) security is shifting from "will the model leak training data" to a more consequential question: can an agent with persistent, long-term memory be continuously shaped, cross-session poisoned, accessed without authorization, and propagated across shared organizational state? Recent surveys cover memory architectures and agent mechanisms, but fewer center the epistemic and governance properties of persistent, writable memory as the reason memory is an independent security problem.
This survey addresses that gap. Drawing on cognitive neuroscience and the philosophy of memory, we characterize agent memory as malleable, rewritable, and socially propagating, and develop a memory-lifecycle framework organized around six phases -- Write, Store, Retrieve, Execute, Share, Forget/Rollback -- cross-tabulated against four security objectives: integrity, confidentiality, availability, governance. We organize the literature on memory poisoning, extraction, retrieval corruption, control-flow hijacking, cross-agent propagation, rollback, and governance, and situate representative architectures as determinants of which phases are explicitly governable.
Three findings stand out: the literature concentrates on write- and retrieve-time integrity attacks, while confidentiality, availability, store/forget, and benign-persistence failures remain sparsely studied; no published architecture covers all nine governance primitives we identify; and using LLMs themselves for memory security remains sparse yet essential.
We unify these under mnemonic sovereignty -- verifiable, recoverable governance over what may be written, who may read, when updates are authorized, and which states may be forgotten -- arguing future secure agents will be differentiated not only by recall capacity, but by memory governance quality.