Persistent memory in LLM agents widens privacy leakage over sessions
Original title: Disclosure Begets Disclosure: A Self-Reinforcing Privacy Loop in LLM Agents with Persistent Memory
Instructing the agent not to state or presuppose attributes cut leakage near the no-memory level while keeping most quality gains.
In multi-session simulations, a user with 24 personal attributes spoke with a support agent that either consulted persistent memory or did not. Across four models, memory improved reply quality but raised the share of attribute values inferred from the full record, and the gap widened over sessions. Replies carry earlier values forward, often as presuppositions, and users confirm them or leave them uncorrected. The authors say limiting what the agent states works better than filtering user text or stored memory.
Unconfirmed: Results are from simulations with a simulated user, not observed production agents.
- Dropping the agent's mentions of an attribute cut later disclosure about twice single-turn predictions.
- Correcting a stored value itself discloses that attribute.
- Refusing to discuss a topic can shift later predictions toward sensitive values.
- Wrong values left uncorrected become entrenched in the record.
From the original article
1 min read at arxiv.orgLarge language model (LLM) agents increasingly use persistent memory to personalize responses, and personal attributes in this memory pose a privacy risk if exposed. We ask how consulting memory during dialogue changes what users go on to say, and thus what the memory comes to reveal.
By Masahiro Kaneko · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.