Disclosure Begets Disclosure: A Self-Reinforcing Privacy Loop in LLM Agents with Persistent Memory

Key points

• We ask how consulting memory during dialogue changes what users go on to say, and thus what the memory comes to reveal.1
• In multi-session simulations, a simulated user with 24 personal attributes talks with a support agent that does or does not consult memory, and in both settings attributes are inferred from the full accumulated record.1
• Memory-conditioned responses carry earlier values forward, often as presuppositions, and users affirm them or leave them uncorrected, so that cues and the agent's own guesses become recorded values.1
• Instructing the agent not to state or presuppose attributes brings leakage to about the no-memory level while keeping most of the quality gains, whereas filtering or anonymizing what users say or what is stored gives up much of them.1

Sources (1)

• [1]Disclosure Begets Disclosure: A Self-Reinforcing Privacy Loop in LLM Agents with Persistent Memory
  arXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 20, 02:52 PM

  Large language model (LLM) agents increasingly use persistent memory to personalize responses, and personal attributes in this memory pose a privacy risk if exposed.

  We ask how consulting memory during dialogue changes what users go on to say, and thus what the memory comes to reveal.

Extractive summary: sentences quoted from the sources.