Newest papers

Disclosure Begets Disclosure: A Self-Reinforcing Privacy Loop in LLM Agents with Persistent Memory

Masahiro Kaneko, Hiromi Arai, Timothy Baldwin · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.28315 · cited by 0 works (OpenAlex) · open-access PDF

German

Große Agent-Loch-Modell (LLM) -Agenten verwenden zunehmend persistentes Gedächtnis, um Antworten zu personalisieren, und persönliche Attribute in diesem Gedächtnis stellen ein Privatsphäre-Risiko dar, wenn sie ausgesetzt sind. Wir fragen, wie die Konsultation des Gedächtnisses während des Dialogs ändert, was die Benutzer sagen, und so was das Gedächtnis enthüllt. In Multi-Session-Simulationen spricht ein simulierter Benutzer mit 24 persönlichen Attributen mit einem Support-Agent, der das Gedächtnis tut oder nicht konsultiert, und in beiden Einstellungen werden die meisten nicht-adversarischen Attribute aus der vollen angesammelten Aufzeichnung abgeleitet. Über vier Support-Modelle trägt das Gedächtnis

Machine translation (Meta M2M100); the English original follows.

Abstract

Large language model (LLM) agents increasingly use persistent memory to personalize responses, and personal attributes in this memory pose a privacy risk if exposed. We ask how consulting memory during dialogue changes what users go on to say, and thus what the memory comes to reveal. In multi-session simulations, a simulated user with 24 personal attributes talks with a support agent that does or does not consult memory, and in both settings attributes are inferred from the full accumulated record. Across four support models, memory raises response quality but also empirical leakage, the share of attribute values correctly inferred from the record, by a margin that widens over sessions. The cause is a loop in ordinary, non-adversarial assistance. Memory-conditioned responses carry earlier values forward, often as presuppositions, and users affirm them or leave them uncorrected, so that cues and the agent's own guesses become recorded values. The loop reinforces itself, and removing the agent's mentions of an attribute lowers its later disclosure about twice as much as single-turn effects predict. Users cannot leave it on their own, since correcting a value discloses the attribute, declining to discuss it shifts later predictions toward sensitive values, and incorrect values left in place become entrenched. The loop is best weakened at the agent's response. Instructing the agent not to state or presuppose attributes brings leakage to about the no-memory level while keeping most of the quality gains, whereas filtering or anonymizing what users say or what is stored gives up much of them.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, Internet privacy, Quality (philosophy), Margin (machine learning), Computer security, Value (mathematics)

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange