Newest papers

Disclosure Begets Disclosure: A Self-Reinforcing Privacy Loop in LLM Agents with Persistent Memory

Masahiro Kaneko, Hiromi Arai, Timothy Baldwin · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.28315 · cited by 0 works (OpenAlex) · open-access PDF

Korean

대형 에이전트 루프 모델 (LLM) 에이전트는 점점 더 반복적 인 메모리를 사용하여 응답을 개인화하고,이 메모리에있는 개인 지침 특성은 노출 된 경우 개인 정보 보호 위험을 제기합니다. 대화 중에 메모리 컨설팅이 사용자가 말하는 것을 변경하는 방법을 묻습니다. 멀티 세션 시뮬레이션에서, 24 개의 개인 특성을 가진 시뮬레이션 사용자는 메모리를 사용하거나 상담하지 않는 지원 에이전트와 이야기합니다. 두 설정에서 대부분의 비 반복적 인 지원 특성은 전체 축적 된 레코드에서 추론됩니다. 4 개의 지원 모델을 통해 메모리는 응답 품질을 향상시킵니다. 메모리는 메모리 레코드에서 정확하게 추론 된 특성의 비율을 나타냅니다.

Machine translation (Meta M2M100); the English original follows.

Abstract

Large language model (LLM) agents increasingly use persistent memory to personalize responses, and personal attributes in this memory pose a privacy risk if exposed. We ask how consulting memory during dialogue changes what users go on to say, and thus what the memory comes to reveal. In multi-session simulations, a simulated user with 24 personal attributes talks with a support agent that does or does not consult memory, and in both settings attributes are inferred from the full accumulated record. Across four support models, memory raises response quality but also empirical leakage, the share of attribute values correctly inferred from the record, by a margin that widens over sessions. The cause is a loop in ordinary, non-adversarial assistance. Memory-conditioned responses carry earlier values forward, often as presuppositions, and users affirm them or leave them uncorrected, so that cues and the agent's own guesses become recorded values. The loop reinforces itself, and removing the agent's mentions of an attribute lowers its later disclosure about twice as much as single-turn effects predict. Users cannot leave it on their own, since correcting a value discloses the attribute, declining to discuss it shifts later predictions toward sensitive values, and incorrect values left in place become entrenched. The loop is best weakened at the agent's response. Instructing the agent not to state or presuppose attributes brings leakage to about the no-memory level while keeping most of the quality gains, whereas filtering or anonymizing what users say or what is stored gives up much of them.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, Internet privacy, Quality (philosophy), Margin (machine learning), Computer security, Value (mathematics)

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange