arXiv cs.CL· Masahiro Kaneko, Hiromi Arai, Timothy Baldwin·· 12 小时前AI 评分48
持久记忆 LLM 智能体的隐私循环：披露引发更多披露
Disclosure Begets Disclosure: A Self-Reinforcing Privacy Loop in LLM Agents with Persistent Memory
AI 导读
多轮对话模拟显示，LLM 智能体使用持久记忆虽提升回复质量，却会推高个人属性的经验泄漏率，且随会话轮次扩大。原因是记忆条件下的回复常以预设方式带出旧属性值，用户确认或不纠正后这些线索被记入记忆，形成自我强化的披露循环。在智能体回复端禁止陈述或预设属性，可将泄漏降至接近无记忆水平，同时保留大部分质量收益。
正文 · 原文
Abstract:Large language model (LLM) agents increasingly use persistent memory to personalize responses, and personal attributes in this memory pose a privacy risk if exposed. We ask how consulting memory during dialogue changes what users go on to say, and thus what the memory comes to reveal. In multi-session simulations, a simulated user with 24 personal attributes talks with a support agent that does or does not consult memory, and in both settings attributes are inferred from the full accumulated record. Across four support models, memory raises response quality but also empirical leakage, the share of attribute values correctly inferred from the record, by a margin that widens over sessions. The cause is a loop in ordinary, non-adversarial assistance. Memory-conditioned responses carry earlier values forward, often as presuppositions, and users affirm them or leave them uncorrected, so that cues and the agent's own guesses become recorded values. The loop reinforces itself, and removing the agent's mentions of an attribute lowers its later disclosure about twice as much as single-turn effects predict. Users cannot leave it on their own, since correcting a value discloses the attribute, declining to discuss it shifts later predictions toward sensitive values, and incorrect values left in place become entrenched. The loop is best weakened at the agent's response. Instructing the agent not to state or presuppose attributes brings leakage to about the no-memory level while keeping most of the quality gains, whereas filtering or anonymizing what users say or what is stored gives up much of them.
| Subjects: | Cryptography and Security (cs.CR); Computation and Language (cs.CL); Machine Learning (cs.LG) |
| Cite as: | arXiv:2610.28315 [cs.CR] |
| (or arXiv:2610.28315v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.28315 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Masahiro Kaneko [view email]
[v1]
Tue, 20 Oct 2026 14:52:57 UTC (1,259 KB)
来源：arXiv cs.CL · arxiv.org