The emergence of writable, cross-session persistent memory in LLM agents introduces a qualitatively different threat landscape from conventional input-centric security concerns, characterized by three properties: persistence, statefulness, and propagation. To systematically characterize this landscape, we propose a Memory Lifecycle Framework that organizes attacks, defenses, and their cross-phase dependencies along two axes: six lifecycle phases (Write, Store, Retrieve, Execute, Share & Propagate, Forget & Rollback) and four security objectives (Integrity, Confidentiality, Availability, Governance). This analysis in turn exposes the need for formal security guarantees at the system level, motivating Verifiable Memory Governance(VMG), a framework of five architectural primitives that specifies what verifiable mechanisms a long-term-memory system must provide to maintain auditable, recoverable control over its memory state. Our analysis indicates that robust Long-Term Memory (LTM) security cannot be retrofitted at retrieval or execution time alone, but must be anchored in storage-time provenance, versioning, and policy-aware retention from the outset.

翻译：可写入、跨会话持久性记忆在LLM智能体中的出现，引入了一种本质上不同于传统以输入为中心的安全威胁格局，其以三个特性为特征：持久性、状态性和传播性。为系统刻画这一格局，我们提出记忆生命周期框架，该框架沿两个维度组织攻击、防御及其跨阶段依赖关系：六个生命周期阶段（写入、存储、检索、执行、共享与传播、遗忘与回滚）以及四个安全目标（完整性、保密性、可用性、治理）。这一分析进而揭示了系统层面形式化安全保证的必要性，催生了可验证记忆治理（VMG）框架——一套由五种架构原语组成的体系，规定了长期记忆系统必须提供哪些可验证机制，以维持对其记忆状态的可审计、可恢复控制。我们的分析表明，稳健的长期记忆（LTM）安全无法仅在检索或执行阶段事后修补，而必须从一开始就锚定于存储时溯源、版本化及策略感知保留机制。