CoChat
Sign Up
PreprintCited by 0Security and Verification in ComputingAdversarial Robustness in Machine LearningAccess Control and Trust

A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecycle

Open access
Lin, Zehao, Hao, Xixuan, Fu, Renyu, Cui, Shaobo, Chen, Kai, Li, Chunyu, Li, Zhiyu, Xiong, Feiyu·2026·arXiv
DOI 10.48550/arxiv.2604.16548arXiv 2604.16548
Open this paper in CoChat — free accountOpen PDF

Abstract

The emergence of writable, cross-session persistent memory in LLM agents introduces a qualitatively different threat landscape from conventional input-centric security concerns, characterized by three properties: persistence, statefulness, and propagation. To systematically characterize this landscape, we propose a Memory Lifecycle Framework that organizes attacks, defenses, and their cross-phase dependencies along two axes: six lifecycle phases (Write, Store, Retrieve, Execute, Share & Propagate, Forget & Rollback) and four security objectives (Integrity, Confidentiality, Availability, Governance). This analysis in turn exposes the need for explicit security requirements at the system level, motivating Verifiable Memory Governance (VMG), a framework of five architectural primitives for specifying and evaluating auditable, recoverable control over memory state within declared system and threat-model boundaries. Our analysis motivates integrating provenance, versioning, and policy-aware retention with retrieval and execution defenses to support auditable prevention, containment, and recovery across the lifecycle.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2604.16548

Cites

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

No citation lists for this paper

No citation lists for this paper yet — checked again daily.

Research works printed but not linked: 82

  1. Scott Barnett, Stefanus Kurniawan, Srikanth Thudumu, Zach Brannelly, and Mohamed Abdelrazek. 2024. Seven failure points when engineering a retrieval augmented generation system. In Proceedings of the IEEE/ACM 3rd International Conference on AI Engineering (CAIN '24) , pages 194-199. Association for Computing Machinery.
  2. Andreea-Elena Bodea, Stephen Meisenbacher, Alexandra Klymenko, and Florian Matthes. 2026. SoK: Privacy risks and mitigations in retrieval-augmented generation systems. In IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) .
  3. Lucas Bourtoule, Varun Chandrasekaran, Christopher A. Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. 2021. Machine unlearning. In 2021 IEEE Symposium on Security and Privacy (SP) , pages 141-159. IEEE.
  4. Nicholas Carlini, Florian Tramèr, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Úlfar Erlingsson, Alina Oprea, and Colin Raffel. 2021. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 21) , pages 2633-2650. USENIX Association.
  5. Harsh Chaudhari, Giorgio Severi, John Abascal, Anshuman Suri, Matthew Jagielski, Christopher A. Choquette-Choo, Milad Nasr, Cristina Nita-Rotaru, and Alina Oprea. 2024. Phantom: General backdoor attacks on retrieval augmented language generation. arXiv preprint arXiv:2405.20485 . · arXiv
  6. Qizhi Chen, Chao Qi, Yihong Huang, Muquan Li, Rongzheng Wang, Dongyang Zhang, Ke Qin, and Shuang Liang. 2026. KEPo: Knowledge evolution poison on graph-based retrieval-augmented generation. In Proceedings of the ACM Web Conference 2026 , pages 2308-2319. Association for Computing Machinery.
  7. Zhaorun Chen, Zhen Xiang, Chaowei Xiao, Dawn Song, and Bo Li. 2024. AgentPoison: Red-teaming LLM agents via poisoning memory or knowledge bases. In Advances in Neural Information Processing Systems , volume 37, pages 130185-130213. Curran Associates, Inc.
  8. Prateek Chhikara, Dev Khant, Saket Aryan, Taranjeet Singh, and Deshraj Yadav. 2025. Mem0: Building production-ready AI agents with scalable long-term memory. arXiv preprint arXiv:2504.19413 . · arXiv
  9. Stav Cohen, Ron Bitton, and Ben Nassi. 2025. Here comes the AI worm: Preventing the propagation of adversarial self-replicating prompts within GenAI ecosystems. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security , CCS '25, pages 3975-3989. ACM.
  10. Manuel Costa, Boris Köpf, Aashish Kolluri, Andrew Paverd, Mark Russinovich, Ahmed Salem, Shruti Tople, Lukas Wutschitz, and Santiago Zanella-Béguelin. 2025. Securing AI agents with information-flow control. arXiv preprint arXiv:2505.23643 . · arXiv
  11. Edoardo Debenedetti, Ilia Shumailov, Tianqi Fan, Jamie Hayes, Nicholas Carlini, Daniel Fabian, Christoph Kern, Chongyang Shi, Andreas Terzis, and Florian Tramèr. 2026. Defeating prompt injections by design. In IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) . Preprint: arXiv:2503.18813. · arXiv
  12. Edoardo Debenedetti, Jie Zhang, Mislav Balunovi´ c, Luca Beurer-Kellner, Marc Fischer, and Florian Tramèr. 2024. AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents. In Advances in Neural Information Processing Systems , volume 37, pages 82895-82920. Curran Associates, Inc. Datasets and Benchmarks Track.
  13. Darren Edge, Ha Trinh, Newman Cheng, Joshua Bradley, Alex Chao, Apurva Mody, Steven Truitt, Dasha Metropolitansky, Robert Osazuwa Ness, and Jonathan Larson. 2024. From local to global: A graph RAG approach to query-focused summarization. arXiv preprint arXiv:2404.16130 . · arXiv
  14. Faouzi El Yagoubi, Godwin Badu-Marfo, and Ranwa Al Mallah. 2026. AgentLeak: A benchmark for internal-channel privacy leakage in multi-agent LLM systems. IEEE Access , 14:94960-94978.
  15. Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. 2023. Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection. In Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security , AISec '23, pages 79-90. ACM.
  16. Xiangming Gu, Xiaosen Zheng, Tianyu Pang, Chao Du, Qian Liu, Ye Wang, Jing Jiang, and Min Lin. 2024. Agent Smith: A single image can jailbreak one million multimodal LLM agents exponentially fast. In Proceedings of the 41st International Conference on Machine Learning , volume 235 of Proceedings of Machine Learning Research , pages 16647-16672. PMLR.
  17. Jiahe Guo, Xiangran Guo, Yulin Hu, Zimo Long, Xingyu Sui, Xuda Zhi, Yongbo Huang, Hao He, Weixiang Zhao, Yanyan Zhao, and Bing Qin. 2026. When personalization legitimizes risks: Uncovering safety vulnerabilities in personalized dialogue agents. arXiv preprint arXiv:2601.17887 . · arXiv
  18. Xixuan Hao, Zeyu Zhang, Zehao Lin, Yihang Sun, Ziliang Guo, Xichong Zhang, Yuxuan Liang, Feiyu Xiong, and Zhiyu Li. 2026. MemOps: Benchmarking lifecycle memory operations in long-horizon conversations. arXiv preprint arXiv:2607.12893 . · arXiv
  19. Feng He, Tianqing Zhu, Dayong Ye, Bo Liu, Wanlei Zhou, and Philip S. Yu. 2025. The emerged security and privacy of LLM agent: A survey with case studies. ACM Computing Surveys , 58(6):1-36. Article 162.
  20. Yu He, Yifei Chen, Yiming Li, Shuo Shao, Leyi Qi, Boheng Li, Dacheng Tao, and Zhan Qin. 2026. External data extraction attacks against retrieval-augmented large language models. IEEE Transactions on Information Forensics and Security , 21:5864-5879.
  21. Yuanzhe Hu, Yu Wang, and Julian McAuley. 2026. Evaluating memory in LLM agents via incremental multi-turn interactions. In International Conference on Learning Representations (ICLR) . ArXiv:2507.05257. · arXiv
  22. Yuyang Hu, Shichun Liu, Yanwei Yue, Guibin Zhang, Boyang Liu, Fangyi Zhu, Jiahang Lin, Honglin Guo, Shihan Dou, Zhiheng Xi, Senjie Jin, Jiejun Tan, Yanbin Yin, Jiongnan Liu, Zeyu Zhang, Zhongxiang Sun, Yutao Zhu, Hao Sun, Boci Peng, and 28 others. 2025. Memory in the age of AI agents. arXiv preprint arXiv:2512.13564 . · arXiv
  23. Dennis Jacob, Emad Alghamdi, Zhanhao Hu, Basel Alomair, and David Wagner. 2025. Preventing prompt injection with type-directed privilege separation. arXiv preprint arXiv:2509.25926 . · arXiv
  24. Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, Sebastian Riedel, and Douwe Kiela. 2020. Retrieval-augmented generation for knowledgeintensive NLP tasks. In Advances in Neural Information Processing Systems , volume 33, pages 94599474. Curran Associates, Inc.
  25. Xinfeng Li, Dong Huang, Jie Li, Hongyi Cai, Zhenhong Zhou, Wei Dong, XiaoFeng Wang, and Yang Liu. 2025a. A vision for access control in LLM-based agent systems. arXiv preprint arXiv:2510.11108 . · arXiv
  26. Zhiyu Li, Chenyang Xi, Chunyu Li, Ding Chen, Boyu Chen, Shichao Song, Simin Niu, Hanyu Wang, Jiawei Yang, Chen Tang, Qingchen Yu, Jihao Zhao, Yezhaohui Wang, Peng Liu, Zehao Lin, Pengyuan Wang, Jiahao Huo, Tianyi Chen, Kai Chen, and 20 others. 2025b. MemOS: A memory OS for AI system. arXiv preprint arXiv:2507.03724 . · arXiv
  27. Jiacheng Liang, Yuhui Wang, Changjiang Li, Tanqiu Jiang, Rongyi Zhu, Neil Gong, and Ting Wang. 2026. GraphRAG under fire. In 2026 IEEE Symposium on Security and Privacy (SP) , pages 195-212. IEEE.
  28. Jiafeng Liang, Hao Li, Chang Li, Jiaqi Zhou, Shixin Jiang, Zekun Wang, Changkai Ji, Zhihao Zhu, Runxuan Liu, Tao Ren, Jinlan Fu, See-Kiong Ng, Xia Liang, Ming Liu, and Bing Qin. 2025. AI meets brain: Memory systems from cognitive neuroscience to autonomous agents. arXiv preprint arXiv:2512.23343 . · arXiv
  29. Yupei Liu, Yuqi Jia, Runpeng Geng, Jinyuan Jia, and Neil Zhenqiang Gong. 2024. Formalizing and benchmarking prompt injection attacks and defenses. In 33rd USENIX Security Symposium (USENIX Security 24) , pages 1831-1847, Philadelphia, PA. USENIX Association.
  30. Elizabeth F. Loftus. 2005. Planting misinformation in the human mind: A 30-year investigation of the malleability of memory. Learning & Memory , 12(4):361366.
  31. Jinghao Luo, Yuchen Tian, Chuxue Cao, Ziyang Luo, Hongzhan Lin, Kaixin Li, Chuyi Kong, Ruichao Yang, and Jing Ma. 2026. From storage to experience: A survey on the evolution of LLM agent memory mechanisms. In Findings of the Association for Computational Linguistics: ACL 2026 , pages 41622-41652, San Diego, California, United States. Association for Computational Linguistics.
  32. Adyasha Maharana, Dong-Ho Lee, Sergey Tulyakov, Mohit Bansal, Francesco Barbieri, and Yuwei Fang. 2024. Evaluating very long-term conversational memory of LLM agents. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages 1385113870, Bangkok, Thailand. Association for Computational Linguistics.
  33. Pratyush Maini, Zhili Feng, Avi Schwarzschild, Zachary C Lipton, and J Zico Kolter. 2024. TOFU: A task of fictitious unlearning for LLMs. In Conference on Language Modeling (COLM) . ArXiv:2401.06121. · arXiv
  34. Tianyi Men, Pengfei Cao, Zhuoran Jin, Yubo Chen, Kang Liu, and Jun Zhao. 2025. A troublemaker with contagious jailbreak makes chaos in honest towns. In Proceedings of the 63rd Annual Meeting of the ACL (Volume 1: Long Papers) . ArXiv:2410.16155. · arXiv
  35. Rui Miao, Yixin Liu, Yili Wang, Xu Shen, Yue Tan, Yiwei Dai, Shirui Pan, and Xin Wang. 2026. BlindGuard: Safeguarding LLM-based multi-agent systems under unknown attacks. In Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages 39215-39234, San Diego, California, United States. Association for Computational Linguistics.
  36. Niloofar Mireshghallah, Neal Mangaokar, Narine Kokhlikyan, Arman Zharmagambetov, Manzil Zaheer, Saeed Mahloujifar, and Kamalika Chaudhuri. 2026. CIMemories: A compositional benchmark for contextual integrity in LLMs. In International Conference on Learning Representations , volume 2026, pages 95513-95532.
  37. Yanming Mu, Hao Hu, Feiyang Li, Qiao Yuan, Jiang Wu, Zichuan Liu, Pengcheng Liu, Mei Wang, Hongwei Zhou, and Yuling Liu. 2026. Towards secure retrieval-augmented generation: A comprehensive review of threats, defenses and benchmarks. arXiv preprint arXiv:2603.21654 . · arXiv
  38. Karim Nader, Glenn E Schafe, and Joseph E LeDoux. 2000. Fear memories require protein synthesis in the amygdala for reconsolidation after retrieval. Nature , 406(6797):722-726.
  39. Milad Nasr, Nicholas Carlini, Chawin Sitawarin, Sander V. Schulhoff, Jamie Hayes, Michael Ilie, Juliette Pluto, Shuang Song, Harsh Chaudhari, Ilia Shumailov, Abhradeep Guha Thakurta, Kai Yuanqing Xiao, Andreas Terzis, and Florian Tramèr. 2026. The attacker moves second: Stronger adaptive attacks bypass defenses against LLM jailbreaks and prompt injections. In 35th USENIX Security Symposium (USENIX Security 26) , pages 1467-1486, Baltimore, MD. USENIX Association.
  40. Thong Q Nguyen, Shubhang Desai, Raja Hasnain Anwar, Firoz Shaik, Vishwas Suryanarayanan, and Vishal Chowdhary. 2025. VerificAgent: Domainspecific memory verification for scalable oversight of aligned computer-use agents. arXiv preprint arXiv:2506.02539 . · arXiv
  41. Charles Packer, Sarah Wooders, Kevin Lin, Vivian Fang, Shishir G Patil, Ion Stoica, and Joseph E Gonzalez. 2023. MemGPT: Towards LLMs as operating systems. arXiv preprint arXiv:2310.08560 . · arXiv
  42. Nils Palumbo, Sarthak Choudhary, Jihye Choi, Guy Amir, Prasad Chalasani, and Somesh Jha. 2026. Formal policy enforcement for real-world agentic systems. Preprint , arXiv:2602.16708. · arXiv
  43. Henry L Roediger III, Michelle L Meade, and Erik T Bergman. 2001. Social contagion of memory. Psychonomic Bulletin & Review , 8(2):365-371.
  44. Mark Russinovich, Ahmed Salem, and Ronen Eldan. 2025. Great, now write an article about that: The Crescendo multi-turn LLM jailbreak attack. In USENIX Security Symposium .
  45. Daniel L. Schacter, Donna Rose Addis, and Randy L. Buckner. 2007. Remembering the past to imagine the future: The prospective brain. Nature Reviews Neuroscience , 8(9):657-661.
  46. Daniel L Schacter, Kenneth A Norman, and Wilma Koutstaal. 1998. The cognitive neuroscience of constructive memory. Annual Review of Psychology , 49:289-318.
  47. Tianneng Shi, Jingxuan He, Zhun Wang, Hongwei Li, Linyu Wu, Wenbo Guo, and Dawn Song. 2025. Progent: Securing AI agents with privilege control. arXiv preprint arXiv:2504.11703 . · arXiv
  48. Xiaonan Si, Meilin Zhu, Simeng Qin, Lijia Yu, Lijun Zhang, Shuaitong Liu, Xinfeng Li, Ranjie Duan, Yang Liu, and Xiaojun Jia. 2025. SeCon-RAG: A two-stage semantic filtering and conflict-free framework for trustworthy RAG. In Advances in Neural Information Processing Systems 38 , NeurIPS 2025, pages 78742-78771. Neural Information Processing Systems Foundation, Inc.
  49. Renan Souza, Amal Gueroudji, Stephen DeWitt, Daniel Rosendo, Tirthankar Ghosal, Robert Ross, Prasanna Balaprakash, and Rafael Ferreira da Silva. 2025. PROV-AGENT: Unified provenance for tracking AI agent interactions in agentic workflows. In 2025 IEEE International Conference on eScience (eScience) , pages 467-473. IEEE.
  50. Larry R Squire, Lisa Genzel, John T Wixted, and Richard G Morris. 2015. Memory consolidation. Cold Spring Harbor Perspectives in Biology , 7(8):a021766.
  51. Theodore R Sumers, Shunyu Yao, Karthik Narasimhan, and Thomas L Griffiths. 2024. Cognitive architectures for language agents (CoALA). Transactions on Machine Learning Research .
  52. Haoran Tan, Zeyu Zhang, Chen Ma, Xu Chen, Quanyu Dai, and Zhenhua Dong. 2025a. MemBench: Towards more comprehensive evaluation on the memory of LLM-based agents. In Findings of the Annual Meeting of the Association for Computational Linguistics (ACL) . ArXiv:2506.21605. · arXiv
  53. Xue Tan, Hao Luan, Mingyu Luo, Xiaoyan Sun, Ping Chen, and Jun Dai. 2025b. RevPRAG: Revealing poisoning attacks in retrieval-augmented generation through LLM activation analysis. In Findings of the Conference on Empirical Methods in Natural Language Processing (EMNLP) . ArXiv:2411.18948. · arXiv
  54. Hanling Tian, Gengyu Zhang, Zeyang Sha, Jingying Wang, Yuhang Liu, Zhehao Huang, Kun Yang, and Xiaolin Huang. 2026. InjecMEM: Memory injection attack on LLM agent memory systems. arXiv preprint arXiv:2608.23471 . Accepted at the 3rd Conference on Language Modeling (COLM 2026). · arXiv
  55. Bin Wang, Fan Wang, Pingping Wang, Jinyu Cong, Yang Yu, Yilong Yin, Zhongyi Han, and Benzheng Wei. 2026a. Agentic unlearning: When LLM agent meets machine unlearning. arXiv preprint arXiv:2602.17692 . · arXiv
  56. Bo Wang, Weiyi He, Shenglai Zeng, Zhen Xiang, Yue Xing, Jiliang Tang, and Pengfei He. 2025. Unveiling privacy risks in LLM agent memory. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (ACL) . ArXiv:2502.13172. · arXiv
  57. Haoyu Wang, Christopher M Poskitt, and Jun Sun. 2026b. AgentSpec: Customizable runtime enforcement for safe and reliable LLM agents. In Proceedings of the 48th IEEE/ACM International Conference on Software Engineering (ICSE '26) . ArXiv:2503.18666. · arXiv
  58. Lei Wang, Chen Ma, Xueyang Feng, Zeyu Zhang, Hao Yang, Jingsen Zhang, Zhiyuan Chen, Jiakai Tang, Xu Chen, Yankai Lin, Wayne Xin Zhao, Zhewei Wei, and Jirong Wen. 2024. A survey on large language model based autonomous agents. Frontiers of Computer Science , 18(6):186345.
  59. Shang Wang, Tianqing Zhu, Dayong Ye, and Wanlei Zhou. 2026c. When machine unlearning meets retrieval-augmented generation (RAG): Keep secret or forget knowledge? IEEE Transactions on Dependable and Secure Computing , 23(2):2030-2045.
  60. Qianshan Wei, Tengchao Yang, Yaochen Wang, Xinfeng Li, Lijun Li, Zhenfei Yin, Yi Zhan, Thorsten Holz, Zhiqiang Lin, and XiaoFeng Wang. 2025. A-MemGuard: A proactive defense framework for LLM-based agent memory. arXiv preprint arXiv:2510.02373 . · arXiv
  61. Yule Wen, Yanzhe Zhang, Jianxun Lian, Xiaoyuan Yi, Xing Xie, and Diyi Yang. 2026. Contextualized privacy defense for LLM agents. arXiv preprint arXiv:2603.02983 . · arXiv
  62. Di Wu, Hongwei Wang, Wenhao Yu, Yuwei Zhang, KaiWei Chang, and Dong Yu. 2025a. LongMemEval: Benchmarking chat assistants on long-term interactive memory. In International Conference on Learning Representations (ICLR) .
  63. Yaxiong Wu, Sheng Liang, Chen Zhang, Yichao Wang, Yongyue Zhang, Huifeng Guo, Ruiming Tang, and Yong Liu. 2025b. From human memory to AI memory: A survey on memory mechanisms in the era of LLMs. arXiv preprint arXiv:2504.15965 . · arXiv
  64. Yuhao Wu, Franziska Roesner, Tadayoshi Kohno, Ning Zhang, and Umar Iqbal. 2025c. IsolateGPT: An execution isolation architecture for LLM-based agentic systems. In Network and Distributed System Security Symposium (NDSS) . ArXiv:2403.04960. · arXiv
  65. Chong Xiang, Tong Wu, Zexuan Zhong, David Wagner, Danqi Chen, and Prateek Mittal. 2026. Certifiably robust RAG against retrieval corruption. In IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) . ArXiv:2405.15556. · arXiv
  66. Wujiang Xu, Zujie Liang, Kai Mei, Hang Gao, Juntao Tan, and Yongfeng Zhang. 2025. A-MEM: Agentic memory for LLM agents. arXiv preprint arXiv:2502.12110 . NeurIPS 2025. · arXiv
  67. Zhenlin Xu, Xiaogang Zhu, Yu Yao, Minhui Xue, and Yiliao Song. 2026. From storage to steering: Memory control flow attacks on LLM agents. arXiv preprint arXiv:2603.15125 . · arXiv
  68. Jiaqi Xue, Mengxin Zheng, Yebowen Hu, Fei Liu, Xun Chen, and Qian Lou. 2024. BadRAG: Identifying vulnerabilities in retrieval augmented generation of large language models. Preprint , arXiv:2406.00083. · arXiv
  69. Tiankai Yang, Jiate Li, Yi Nian, Shen Dong, Ruiyao Xu, Ryan Rossi, Kaize Ding, and Yue Zhao. 2026a. No attacker needed: Unintentional cross-user contamination in shared-state LLM agents. arXiv preprint arXiv:2604.01350 . · arXiv
  70. Xianglin Yang, Yufei He, Shuo Ji, Bryan Hooi, and Jin Song Dong. 2026b. Zombie agents: Persistent control of self-evolving llm agents via self-reinforcing injections. arXiv preprint arXiv:2602.15654 . · arXiv
  71. Sangyeon Yoon, Sunkyoung Kim, Hyesoo Hong, Wonje Jeung, Yongil Kim, Wooseok Seo, Heuiyeen Yeen, and Albert No. 2026. BenchPreS: A benchmark for context-aware personalized preference selectivity of persistent-memory LLMs. arXiv preprint arXiv:2603.16557 . · arXiv
  72. Qiusi Zhan, Zhixiang Liang, Zifan Ying, and Daniel Kang. 2024. InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents. In Findings of the Association for Computational Linguistics (ACL) . ArXiv:2403.02691. · arXiv
  73. Baolei Zhang, Haoran Xin, Minghong Fang, Zhuqing Liu, Biao Yi, Tong Li, and Zheli Liu. 2025a. Traceback of poisoning attacks to retrieval-augmented generation. In Proceedings of The Web Conference (WWW) . ArXiv:2504.21668. · arXiv
  74. Baolei Zhang, Haoran Xin, Jiatong Li, Dongzhe Zhang, Minghong Fang, Zhuqing Liu, Lihai Nie, and Zheli Liu. 2025b. Benchmarking poisoning attacks against retrieval-augmented generation. arXiv preprint arXiv:2505.18543 . · arXiv
  75. Hanrong Zhang, Jingyuan Huang, Kai Mei, Yifei Yao, Zhenting Wang, Chenlu Zhan, Hongwei Wang, and Yongfeng Zhang. 2025c. Agent security bench (ASB): Formalizing and benchmarking attacks and defenses in LLM-based agents. In International Conference on Learning Representations (ICLR) . ArXiv:2410.02644. · arXiv
  76. Shuning Zhang, Lyumanshan Ye, Xin Yi, Jingyu Tang, Bo Shui, Haobin Xing, Pengfei Liu, and Hewu Li. 2024. 'Ghost of the past': identifying and resolving privacy leakage from LLM's memory through proactive user interaction. Preprint , arXiv:2410.14931. · arXiv
  77. Zeyu Zhang, Quanyu Dai, Xiaohe Bo, Chen Ma, Rui Li, Xu Chen, Jieming Zhu, Zhenhua Dong, and Ji-Rong Wen. 2025d. A survey on the memory mechanism of large language model-based agents. ACM Trans. Inf. Syst. , 43(6).
  78. Zeyu Zhang, Ziliang Guo, Yihang Sun, Xichong Zhang, Xixuan Hao, Zehao Lin, Yang Zhang, Xiaoyan Zhao, Tong Shen, Bo Tang, Zhi-Qin John Xu, Junchi Yan, Haofen Wang, Xu Chen, Feiyu Xiong, Zhiyu Li, and Tat-Seng Chua. 2026. Metis: Memory foundation model. arXiv preprint arXiv:2607.26760 . · arXiv
  79. Wanjun Zhong, Lianghong Guo, Qiqi Gao, He Ye, and Yanlin Wang. 2024. MemoryBank: Enhancing large language models with long-term memory. In Proceedings of the AAAI Conference on Artificial Intelligence .
  80. Huichi Zhou, Kin-Hei Lee, Zhonghao Zhan, Zhenhao Li, Yue Chen, Huaxiu Yao, Hamed Haddadi, and Emine Yilmaz. 2026. TrustRAG: Enhancing robustness and trustworthiness in retrieval-augmented generation. In AAAI 2026 Workshop on Trust and Control in Agentic AI (TrustAgent) , Singapore.
  81. Wei Zou, Mingwen Dong, Miguel Romero Calvo, Shuaichen Chang, Jiang Guo, Dongkyu Lee, Xing Niu, Xiaofei Ma, Yanjun Qi, and Jiarong Jiang. 2026. Poison once, exploit forever: Environment-injected memory poisoning attacks on web agents. arXiv preprint arXiv:2604.02623 . · arXiv
  82. Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia. 2025. PoisonedRAG: Knowledge corruption attacks to retrieval-augmented generation of large language models. In USENIX Security Symposium . ArXiv:2402.07867. · arXiv

Authors
Lin, Z., Hao, X., Fu, R., Cui, S., Chen, K., Li, C., Li, Z., & Xiong, F.
Affiliations
  • The Hong Kong University of Science and Technology (Guangzhou) (CN)
  • Shanghai Jiao Tong University (CN)
ORCID
Venue
arXiv
Publisher
arXiv
Published
2026
Pages
52221-52235
DOI
10.48550/arxiv.2604.16548
arXiv
2604.16548
OpenAlex
W7155049992
Cited by
0
References
0
FWCI
0.00
Type
conference paper
Language
en
Open access
Licence
arxiv.org/licenses/nonexclusive-distrib/1.0/
Locations
  • Conference on Empirical Methods in Natural Language Processing (EMNLP) (publishedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Social Sciences › Sociology and Political Science › Access Control and Trust
Keywords
LLM agents, persistent memory, memory governance, memory integrity, memory availability, memory attacks

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review