Newest papers

Disclosure Begets Disclosure: A Self-Reinforcing Privacy Loop in LLM Agents with Persistent Memory

Masahiro Kaneko, Hiromi Arai, Timothy Baldwin · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.28315 · cited by 0 works (OpenAlex) · open-access PDF

Japanese

広範なエージェント・ルーケン言語モデル(LLM)エージェントは、ますます持続的なメモリを使用して応答をパーソナライズし、このメモリのインストラクター属性は、暴露された場合にプライバシーリスクを引き起こします。対話中のメモリの保守は、ユーザーが何を言っているかを変更し、したがってメモリが何を明らかにするかをどのように尋ねます。 複数のセッションシミュレーションでは、24の個人属性を持つシミュレートユーザーは、セッションを拡大するマージンで、メモリをサポートするエージェントと話します。 原因は、通常の、非反対的なサポートのルーケンであり、両方の設定で属性は、

Machine translation (Meta M2M100); the English original follows.

Abstract

Large language model (LLM) agents increasingly use persistent memory to personalize responses, and personal attributes in this memory pose a privacy risk if exposed. We ask how consulting memory during dialogue changes what users go on to say, and thus what the memory comes to reveal. In multi-session simulations, a simulated user with 24 personal attributes talks with a support agent that does or does not consult memory, and in both settings attributes are inferred from the full accumulated record. Across four support models, memory raises response quality but also empirical leakage, the share of attribute values correctly inferred from the record, by a margin that widens over sessions. The cause is a loop in ordinary, non-adversarial assistance. Memory-conditioned responses carry earlier values forward, often as presuppositions, and users affirm them or leave them uncorrected, so that cues and the agent's own guesses become recorded values. The loop reinforces itself, and removing the agent's mentions of an attribute lowers its later disclosure about twice as much as single-turn effects predict. Users cannot leave it on their own, since correcting a value discloses the attribute, declining to discuss it shifts later predictions toward sensitive values, and incorrect values left in place become entrenched. The loop is best weakened at the agent's response. Instructing the agent not to state or presuppose attributes brings leakage to about the no-memory level while keeping most of the quality gains, whereas filtering or anonymizing what users say or what is stored gives up much of them.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, Internet privacy, Quality (philosophy), Margin (machine learning), Computer security, Value (mathematics)

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange