Keeping AI Agents’ Knowledge Private—and Harder to Poison

When an agent’s memory becomes a target

An AI agent that uses software tools or cooperates with other agents needs information to guide its choices. Some of that information may be retained as memory. If another party can secretly alter a knowledge store, the agent might rely on false facts or rules and behave in unintended ways. The authors call this kind of attack semantic-memory poisoning: changing an agent’s longer-term factual or domain knowledge, rather than simply trying to mislead it with a prompt.

The paper asks how an agent can use such knowledge without making it easy for an attacker to tamper with the store or learn what the agent is consulting. The authors focus on symbolic knowledge—facts and rules represented in a form a computer can reason over—not protections for every kind of AI memory or language-model system.

Reason locally, retrieve privately

The prototype represents knowledge as Horn clauses, a rule-based format used in Prolog-style systems. A rule might state that if something meets one condition, it also meets another. A Python inference engine runs inside the agent and tries to answer queries using local knowledge. When it needs more information, a client retrieves relevant clauses from an external knowledge base.

The external records include provenance information and digital signatures. The client checks a signature before accepting retrieved material, making unauthorized changes detectable if the signing keys and verification process are properly managed. The design also aims to hide which knowledge item the agent requests. That matters because a query can reveal something about an agent’s task or the information it holds.

The authors implement three retrieval options with different privacy and cost trade-offs. In the two-server, information-theoretic private information retrieval approach, the agent sends specially constructed queries to two copies of the database, assumed not to communicate with one another. Neither server should learn which item was requested from its own query; the client combines their responses to recover the item. The other options use one server: k-anonymity requests the desired item alongside decoys, while a bucket method retrieves a group of items and selects the needed one locally. These lighter approaches offer weaker or parameter-dependent privacy, not the same guarantee as the two-server scheme.

What the tests show—and do not show

The researchers evaluated a Python prototype on a single laptop, simulating the client and external servers as separate software components. Their knowledge base contained 99 facts and rules organized under 46 predicate-name-and-arity keys, and they tested 18 queries. They report execution times for different retrieval options, including runs with and without cached knowledge. In the reported uncached timing table, the two-server approach took longer than the baseline; caching reduced the need for repeated external requests.

These results show that the prototype can run the retrieval and inference workflow on a small example. They do not establish how it performs with large knowledge bases or many simultaneous agents. The security properties also depend on assumptions. If the two PIR servers share their query information, the privacy protection can fail. Signatures help detect unauthorized edits, but do not prove that signed knowledge is true, complete or up to date. The authors identify secure communication and logs as desirable protections, but say these are not implemented in the prototype. Their setup also runs on one machine and does not support agents operating in parallel.

The implementation retrieves clauses by predicate name and arity, rather than by the specific arguments in a query. The authors identify more selective retrieval and caching inference results as possible improvements. This is a rule-based proof of concept, not evidence that a general-purpose language-model agent is protected against all memory attacks. The timing experiments also do not test whether an attacker can successfully poison a deployed system.

A design proposal, not a security verdict

The paper’s contribution is an architecture that separates a local reasoning engine from an external, signed knowledge store and uses private retrieval to reduce what the store can learn about requests. It presents several implementation choices rather than one universal solution: stronger retrieval privacy has different infrastructure and computational demands from the lighter alternatives.

The paper text says the work was accepted to the DPM 2026 workshop at ESORICS, with publication planned in an LNCS volume. This account is based on the supplied paper text and abstract. Extracted text can lose details of tables or equations, and the paper’s reported prototype results are not independent confirmation of security in practice. Larger-scale tests, adversarial evaluation and deployments with realistic server and agent behavior would be needed to assess how well the design works beyond this example.