How can attackers poison the agent's memory?
Temporal knowledge graphs for agent memory are built by dynamically integrating data from ongoing conversations and business systems [1]. This means that any input to the agent—whether from a user, an API, or a compromised data source—can become part of the graph. An attacker could inject false or misleading facts that the agent later uses for reasoning, effectively poisoning its memory. The risk is heightened because these systems are designed to remember long-term context, so a single injected fact could influence decisions across many future sessions.
Research on temporal knowledge graph reasoning shows that models can be misled by noisy or invalid historical facts [2]. In fact, the authors of a dynamic memory enhancement model explicitly note that using all historical facts introduces noise and invalid facts during reasoning [2]. This suggests that if an attacker can insert plausible but false facts, the agent may incorporate them into its predictions, leading to incorrect actions or answers. The same paper proposes a memory pool with capacity limits and repetition stimulation to filter useful facts, but such mechanisms are not foolproof and could be bypassed by carefully crafted injections.
Can attackers exploit time-based reasoning to hide or fabricate events?
Temporal knowledge graphs reason about events across time, and they often prioritize recent facts while also using earlier ones for context [3]. An attacker could exploit this by timing their injections—for example, inserting a false fact at a timestamp that the model treats as recent, or burying a true fact under a flood of recent noise. The model's reliance on recent history (as noted in [3]) means that a burst of fake events could overshadow legitimate ones, causing the agent to act on fabricated information.
Additionally, the dynamic memory enhancement approach in [2] uses a memory pool that forgets or reinforces facts based on repetition and recency. An attacker could repeatedly inject a false fact to make it 'stick' in memory, or cause a true fact to be forgotten by not repeating it. This temporal manipulation is a subtle but serious misuse scenario, because the agent's decisions are based on a curated, time-weighted view of history that the attacker can influence.
What are the privacy and fairness risks?
Because these graphs store detailed, time-stamped records of conversations and business data [1], they become a rich target for data extraction. An attacker who gains read access to the graph—or who crafts queries that cause the agent to reveal stored information—could extract sensitive personal or corporate data. The long-term retention of context, which is a key feature of these systems, also means that data persists longer, increasing the window for exposure.
Bias amplification is another concern. Temporal knowledge graphs learn from historical patterns, and if those patterns contain biases (e.g., gender or racial stereotypes), the agent may perpetuate or even strengthen them. The memory enhancement model in [2] is designed to remember 'potentially useful historical facts,' but what is deemed useful may reflect biased historical data. Similarly, the memory-triggered approach in [3] uses earlier facts to establish initial representations, which could bake in outdated or biased assumptions. Neither paper addresses fairness, but the mechanism suggests that bias in the source data will be amplified over time.
About These Sources
This answer is built on 3 studies (2 peer-reviewed, 1 preprint) — published from 2023 to 2025, 2 from 2024 or later, 1 in Q1 journals — selected as the most relevant from 3 studies that passed quality screening, drawn from 38 papers retrieved from a database of over 500 million.
Sources used in this answer
Zep: A Temporal Knowledge Graph Architecture for Agent Memory
Zep, a temporal knowledge graph architecture for agent memory, outperforms MemGPT on the Deep Memory Retrieval benchmark (94.8% vs 93.4%) and improves accuracy by up to 18.5% on the LongMemEval benchmark, while reducing latency by 90%, but its dynamic integration of conversational and business data introduces new attack surfaces for memory poisoning and privacy leaks.
Temporal Knowledge Graph Reasoning With Dynamic Memory Enhancement
The DyMemR model for temporal knowledge graph reasoning introduces a human-like memory pool with capacity, loss, and repetition stimulation to filter useful historical facts, explicitly noting that using all historical facts introduces noise and invalid facts, which attackers could exploit to inject misleading information.
Temporal knowledge graph reasoning triggered by memories
The MTDM network for temporal knowledge graph reasoning uses earlier historical facts to establish initial node representations and updates with recent facts, but its focus on recent history and parallel updates could be exploited by attackers who time their injections to dominate recent memory.