PaperlayerView exact revision on arXiv

Source-linked AI summary

MemPrivacy: Privacy-Preserving Personalized Memory Management for Edge-Cloud Agents

Yining Chen, Jihao Zhao, Bo Tang, Haofen Wang, Yue Zhang, Fei Huang, Feiyu Xiong, Zhiyu Li

arXiv:2605.09530v3cs.CRcs.CL

TL;DR

Cloud-assisted personalized memory can expose sensitive user information, while coarse masking can remove semantics needed for useful personalization. MemPrivacy uses local reversible pseudonymization with typed placeholders and restoration, achieving strong extraction performance and negligible utility loss across memory systems.

  • Problem

    Cloud-assisted personalized memory exposes sensitive user information, while existing benchmarks inadequately represent four-level privacy and long-term memory-centric interactions.

  • Method

    MemPrivacy extracts private spans locally, replaces them with semantically meaningful typed placeholders for cloud processing, and restores original content locally.

  • Results

    Across multiple memory systems, MemPrivacy consistently outperforms irreversible redaction and untyped placeholders in privacy extraction quality and downstream memory utility.

  • Takeaways & Limitations

    MemPrivacy offers a practical path toward privacy-preserving long-term memory for cloud agents while preserving downstream memory utility.

  • Takeaways & Limitations

    The problem formulation considers privacy inference or memory extraction attacks represented by an arbitrary attacker A.

Abstract

from arXiv · show

As LLM-powered agents are increasingly deployed in edge-cloud environments, personalized memory has become a key enabler of long-term adaptation and user-centric interaction. However, cloud-assisted memory management exposes sensitive user information, while existing privacy protection methods typically rely on aggressive masking that removes task-relevant semantics and consequently degrades memory utility and personalization quality. To address this challenge, We propose MemPrivacy, which identifies privacy-sensitive spans on edge devices, replaces them with semantically structured type-aware placeholders for cloud-side memory processing, and restores the original values locally when needed. By decoupling privacy protection from semantic destruction, MemPrivacy minimizes sensitive data exposure while retaining the information required for effective memory formation and retrieval. We also construct MemPrivacy-Bench for systematic evaluation, a dataset covering 200 users and over 155k privacy instances, and introduce a four-level privacy taxonomy for configurable protection policies. Experiments show that MemPrivacy achieves strong performance in privacy information extraction, substantially surpassing strong general-purpose models such as GPT-5.2 and Gemini-3.1-Pro, while also reducing inference latency. Across multiple widely used memory systems, MemPrivacy limits utility loss to within 1.6%, outperforming baseline masking strategies. Overall, MemPrivacy offers an effective balance between privacy protection and personalized memory utility for edge-cloud agents, enabling secure, practical, and user-transparent deployment.

1 Introduction

MemPrivacy addresses the privacy–utility tension in cloud-assisted personalized memory by replacing sensitive spans with typed semantic placeholders and restoring originals locally. The introduction presents its privacy taxonomy, benchmark, on-device models, and evaluation evidence.

  • Personalized memory improves agent adaptation and interaction but expands exposure of sensitive user information during cloud-side storage and processing.
  • Full masking prevents direct exposure but removes semantic cues needed for memory formation, retrieval, and downstream reasoning.
  • MemPrivacy detects privacy-sensitive spans on edge devices, converts values into type-aware placeholders, and securely restores originals locally when needed.
  • A four-level privacy taxonomy standardizes privacy identification and supports differential protection strategies.
  • MemPrivacy-Bench covers 200 users and 155k+ privacy instances, while evaluations report state-of-the-art extraction performance and negligible utility loss versus baselines.

2 Related Work

Related work treats memory as a core component for extending LLM context and enabling continual adaptation, while privacy research spans training and deployment but remains misaligned with long-term memory dialogue systems. Recent studies therefore examine memory-specific exposure and agent information-flow controls.

  • LLM Memory Systems: Memory research addresses limited LLM context windows and long-horizon adaptation by introducing external memory banks and long-term conversational memory mechanisms.LongMem augments frozen language models with an external memory bank, while MemoryBank studies long-term conversational memory using human-forgetting-inspired mechanisms.
  • Privacy Protection for LLMs: Privacy-protection research spans training and deployment, including differential privacy, cryptographic mechanisms, retrieval augmentation, cloud-edge inference, and prompt tuning.These approaches target risks such as retrieval-corpus leakage and query exposure, but their formulations remain misaligned with long-term memory dialogue systems.
  • Memory-System Privacy: Recent work identifies the memory module as an independent privacy-exposure surface and proposes data minimization and multilayer information-flow boundaries for agent systems.MEXTRA highlights memory exposure, AirGapAgent constrains accessible context, and Firewalls limits information flow and cross-module propagation.

3 Problem Definition

MemPrivacy formulates edge-cloud privacy protection as constrained optimization: minimize privacy leakage while preserving personalized agent utility and user experience. It sanitizes inputs and cloud-visible memory locally, then restores responses on the user device while evaluating privacy risk and utility loss.

  • Problem formulation: The problem is to minimize privacy leakage while preserving agent capability and the user’s personalized experience in edge-cloud interactions.The paper explicitly frames privacy protection as a constrained optimization problem.
  • Problem formulation: The formal setting distinguishes raw input X, privacy information S, cloud agent C, and cloud memory or contextual state M.In the threat-free upper-bound setting, the cloud receives the full plaintext input and produces the ideal response.
  • Protection workflow: MemPrivacy applies local sanitization Xsafe = Fsan(X), performs cloud inference using Msafe, and restores the response locally before showing it to the user.The cloud computes an intermediate response from sanitized input and protected cloud-visible state.
  • Evaluation metrics: Privacy Leakage Risk Rpriv measures the probability that an attacker recovers any privacy element after observing Xsafe, Ysafe, and Msafe.The attack may be any privacy inference or memory extraction attack.
  • Evaluation metrics: Utility Loss Lutil measures the gap between the final restored response and the ideal response, capturing degradation in system utility and user experience.The metric is defined using an overall utility function U.
  • Optimization objective: The overall objective is to select local sanitization and restoration functions that minimize privacy leakage while keeping utility loss below a user-tolerable threshold.This objective seeks effective privacy protection without perceptibly degrading user experience.

4 The MemPrivacy Framework

MemPrivacy is a closed-loop, user-transparent framework that desensitizes inputs locally, processes typed placeholders in the cloud, and restores original values locally. It combines a four-level privacy taxonomy with MemPrivacy-Bench for privacy identification and memory-centric evaluation.

  • Framework Lifecycle: MemPrivacy uses three stages: local privacy-span detection and typed replacement, cloud processing with placeholders, and local restoration of original values.The framework is designed as a fully closed-loop and user-transparent lifecycle for edge-cloud agents.
  • Framework Lifecycle: The on-device model records each protected span’s text, privacy level, and privacy type, then replaces it with semantic placeholders such as <EMAIL_1>.The taxonomy used for this structured output covers privacy levels PL2–PL4.
  • Framework Lifecycle: Typed placeholders preserve semantic type information for cloud reasoning, while high-precision recognition retains non-sensitive personalized signals and user-authorized privacy levels.This design avoids the semantic damage associated with removing task-relevant information during cloud processing.
  • Privacy Taxonomy: The four-level taxonomy organizes privacy-relevant content by identifiability, expected harm, and operational exploitability for differential protection.PL1 is an exclusion class, PL2 covers identifiable or traceable information, PL3 centers on expected harm, and PL4 covers immediately exploitable artifacts.
  • MemPrivacy-Bench: 200 user profiles form MemPrivacy-Bench, whose privacy fields span all defined levels and average 50 privacy types per profile.The profiles are synthesized from PersonaHub seeds and include basic attributes, preferences, and privacy fields.
  • MemPrivacy-Bench: 98.08% annotation accuracy was achieved after human verification across the two evaluation sets, supporting the reliability of the data-construction pipeline.The result also supports using the training split for privacy-extraction model training and the verified evaluation sets for assessment.

5 Experiments

MemPrivacy is evaluated for privacy extraction and memory utility across benchmark datasets, privacy models, and representative memory systems. It outperforms general-purpose and masking baselines while substantially preserving utility under privacy protection.

  • Privacy extraction: 85.97% and 94.48% are the best MemPrivacy F1 scores on the two datasets, exceeding general-model highs of 78.41% and 92.18%.The comparison covers 11 general LLMs, one specialized privacy-filtering model, and six MemPrivacy models across MemPrivacy-Bench and PersonaMem-v2.
  • Privacy extraction: From 59.34% to 85.97%, Qwen3-4B’s MemPrivacy-Bench F1 score improves after SFT and RL training.SFT alone performs strongly, while RL further improves overall performance and generalization across MemPrivacy variants.
  • Evaluation setting: Over 29.9k versus 2.3k+ privacy instances, MemPrivacy-Bench is a denser stress test than PersonaMem-v2, causing all models to perform worse on it.PersonaMem-v2 more closely reflects real-world user–assistant privacy density and practical deployment conditions.
  • Memory utility: 0.71%–1.60%, the performance drop when protecting all PL2–PL4 content, remains small across memory systems; protecting only PL4 keeps it below 0.89%.MemPrivacy preserves memory-system utility better than the baselines, with further reductions in loss under more selective protection.
  • Memory utility: 67.89% versus 37.58% and 32.21%, Mem0 accuracy on MemPrivacy-Bench is higher with MemPrivacy than with DeepSeek-V3.2-Think or GPT-5.2.The corresponding ROUGE-L scores are 23.78% with MemPrivacy, compared with 18.46% and 16.56% for the two general models.
  • Robustness: As privacy-related questions increase from 0% to 100%, MemPrivacy remains more stable across all three memory systems and increasingly separates from baselines.Typed placeholders preserve semantic type information for memory writing, retrieval, and answer generation; untyped and irreversible masking degrade more clearly.

6 Conclusion

MemPrivacy enables privacy-preserving personalized memory for edge-cloud agents by replacing locally extracted sensitive spans with typed placeholders for cloud processing and local restoration. Its four-level taxonomy and MemPrivacy-Bench support evaluation, while experiments show stronger privacy extraction and memory utility than baseline approaches.

  • Framework: MemPrivacy extracts privacy-sensitive spans locally, replaces them with semantically meaningful typed placeholders for cloud-side memory operations, and restores original content locally.This avoids exposing raw private values while preserving information for cloud reasoning and memory management.
  • Evaluation resources: The framework formalizes a four-level privacy taxonomy and introduces MemPrivacy-Bench, covering 200 users and more than 155k+ privacy instances.The benchmark is designed for privacy-aware cloud-memory evaluation.
  • Results: Experiments across multiple memory systems show that MemPrivacy outperforms irreversible redaction and untyped-placeholder baselines in privacy extraction quality and downstream memory utility.The results indicate a practical path toward privacy-preserving long-term memory for cloud agents.

Appendices · A Supplementary Details of Dataset

The appendix details MemPrivacy-Bench’s balanced, privacy-rich dataset design, realistic dialogue scenarios, and structured test evaluation. It also documents the annotation procedure shared with PersonaMem-v2.

  • A Supplementary Details of Dataset: MemPrivacy-Bench training and test dialogues are balanced equally between Chinese and English.Each language accounts for 50% of the dialogues.
  • A Supplementary Details of Dataset: Each complete user profile contains basic attributes, four preference categories, and privacy information spanning an average of 50 types.Preferences cover diet, arts and entertainment, lifestyle and hobbies, and aesthetics.
  • A Supplementary Details of Dataset: Some privacy entries include multiple fine-grained details, enriching the privacy content available for dialogue generation.These details provide richer sources of privacy content.
  • A Supplementary Details of Dataset: The dataset covers 7 high-level scenario categories and 23 fine-grained conversation subcategories to diversify realistic user–assistant interactions.Categories include drafting, financial analysis, consultation, technical support, emotional and social interaction, contextual inference, and preference change.
  • A Supplementary Details of Dataset: For each user, the construction process randomly samples 6 to 10 subcategories and generates corresponding multi-turn dialogues.This sampling strategy varies interaction settings across users.
  • A Supplementary Details of Dataset: The test split adds memory question-answer pairs across six categories, covering basic, temporal, adversarial, dynamic, implicit, and aggregation-based memory tasks.Question generation balances coverage of users’ basic attributes, preferences, and privacy information.
  • A Supplementary Details of Dataset: Privacy information in MemPrivacy-Bench’s test set and PersonaMem-v2’s evaluation set uses the same annotation strategy.Gemini-3.1-Pro and GPT-5.2 perform initial labeling, followed by human final annotation and verification.

B Human Annotation Protocol

MemPrivacy-Bench annotations were finalized through trained human verification of LLM-generated labels, with annotators checking span text, privacy level, and privacy type against dialogue context. The resulting evaluation annotations achieved 98.08% accuracy, supporting the reliability of the construction pipeline and taxonomy.

  • Annotation Staffing: Six qualified annotators performed final verification and correction after initial labeling by Gemini-3.1-Pro and GPT-5.2.All annotators held at least a bachelor’s degree and were compensated according to local wage standards.
  • Annotation Procedure: Annotators studied the privacy taxonomy and extraction guidelines beforehand to align decision criteria and reduce subjective inconsistency.The protocol was defined with reference to Sec. 2.1.
  • Annotation Procedure: Each privacy item was judged on span text, privacy level, and privacy type, with incorrect items revised using user profiles and dialogue context when necessary.An item was correct only when all three fields were accurate.
  • Verification Results: 98.08% accuracy was achieved on the two evaluation sets after human verification.This supports the reliability of the construction pipeline and taxonomy, while indicating that training data can support model training without exhaustive human annotation.

C MemPrivacy Model Variants and Training Recipes

This section defines MemPrivacy model variants by backbone scale and training recipe. The experiments use Qwen3 backbones with supervised fine-tuning, plus an SFT+RL variant for the instruction-tuned 4B model.

  • Model variants and recipes: MemPrivacy variants use Qwen3 backbones at different scales and are trained with supervised fine-tuning (SFT).Table 5 summarizes the corresponding base models and training recipes.
  • Model variants and recipes: The instruction-tuned 4B backbone additionally has a variant trained with SFT followed by reinforcement learning (SFT+RL).This variant is reported alongside the SFT-trained models.
  • Model naming: Model names follow the MemPrivacy-{size}-{recipe} convention, with Ins denoting instruction-tuned backbones.The naming scheme encodes model size and training recipe.

D Detailed Experimental Configurations · D.1 Prompt Engineering Details

The supplementary experimental configuration documents the prompt templates, privacy-policy examples, hierarchical privacy levels, and annotation principles used to support MemPrivacy-Bench and evaluation. These materials improve reproducibility and clarify the benchmark’s prompting and policy-grounding setup.

  • D.1 Prompt Engineering Details: Prompt templates for MemPrivacy-Bench short-answer questions and PersonaMem-v2 multiple-choice questions are provided in Figures 4–5.The templates document question-answering prompts used at different benchmark stages.
  • D.1 Prompt Engineering Details: The GPT-5.2 evaluation prompt for memory-system performance on short-answer questions is provided in Figures 6–7.This specifies how memory-system performance was evaluated.
  • D.1 Prompt Engineering Details: The supplementary materials document prompts used at different stages of the benchmark pipeline to facilitate reproducibility and closer inspection.The prompt templates collectively describe the evaluation protocol across benchmark stages.
  • D.1 Prompt Engineering Details: Illustrative examples of detailed privacy-policy provisions are included in Table 6.These examples make the policy provisions used in benchmark construction more concrete.
  • D.1 Prompt Engineering Details: Table 7 defines hierarchical privacy levels and their associated default handling policies.The table links privacy-level definitions to default policy behavior.
  • D.1 Prompt Engineering Details: Together, the supplementary tables clarify the policy grounding and annotation principles supporting benchmark construction and evaluation.The tables complement the prompt templates by documenting policy and annotation setup.

D.2 Response Generation Quality Metrics. · D.3 Memory Agent Testbeds and Deployment Configurations

Response quality is evaluated with four complementary automatic metrics capturing lexical overlap, alignment, fragmentation, and sequence preservation. The study tests privacy-preserving memory mechanisms across LangMem, Mem0, and Memobase, which represent distinct memory-system paradigms and deployment designs.

  • D.2 Response Generation Quality Metrics.: D.2 evaluates generated answers against references using BLEU-1, BLEU-2, METEOR, and ROUGE-L under consistent tokenization.Scores are averaged over the evaluation set and reported as percentages.
  • D.2 Response Generation Quality Metrics.: BLEU-1 measures unigram lexical overlap, whereas BLEU-2 additionally captures local word-order consistency through bigram overlap.BLEU also applies a brevity penalty to discourage overly short generations.
  • D.2 Response Generation Quality Metrics.: METEOR combines unigram precision and recall while penalizing fragmented alignments, assessing preservation of reference content despite surface variation.When no unigram match exists, the METEOR score is set to zero.
  • D.2 Response Generation Quality Metrics.: ROUGE-L measures longest-common-subsequence overlap and, with β = 1, evaluates preservation of the reference’s global token sequence.Unlike fixed-order n-gram metrics, it captures in-sequence overlap without requiring consecutive token matches.
  • D.3 Memory Agent Testbeds and Deployment Configurations: D.3 selects LangMem, Mem0, and Memobase as representative long-term memory systems spanning distinct memory-modeling and system-integration paradigms.LangMem emphasizes agent-framework coupling and memory typology, while Mem0 is designed as a general-purpose memory layer independent of a specific agent framework.
  • D.3 Memory Agent Testbeds and Deployment Configurations: LangMem unifies salient-information extraction for long-term memory with system-prompt optimization from interaction trajectories.It supports semantic and episodic memory modeling and both hot-path and background-reflection memory formation.
  • D.3 Memory Agent Testbeds and Deployment Configurations: Mem0 provides persistent context across multi-turn and multi-session applications through memory writing, retrieval, reuse, filtering, top_k and threshold controls, and optional reranking.Its design does not require long-term memory capabilities to be bound to a particular agent framework.
  • D.3 Memory Agent Testbeds and Deployment Configurations: Memobase builds evolving structured user profiles with topic and subtopic organization, time-aware events, and buffered asynchronous flushing into long-term memory.Its context API can package profiles with recent events into textual context for insertion into downstream interactions.

D.4 Training Pipeline and Optimization Strategy

MemPrivacy uses a two-stage, full-parameter training pipeline that combines supervised fine-tuning with GRPO-based reinforcement learning. Its optimization and systems configuration target stable adaptation, efficient rollouts, and operation under limited GPU memory.

  • Training Pipeline: The pipeline performs full-parameter SFT followed by reinforcement learning from reward feedback using GRPO.Both stages optimize the entire model rather than parameter-efficient adapters, consistently adapting the base model to instruction-following and policy-optimization objectives.
  • SFT Optimization: SFT uses DeepSpeed ZeRO-3, bf16, a per-device batch size of 1, 16-step gradient accumulation, 1 epoch, and a 1.0 × 10−5 learning rate with cosine decay and 0.1 warmup.The stage also uses the qwen3_nothink template, disables thinking mode, and supports sequences up to 4096 tokens.
  • Reinforcement Learning: GRPO further optimizes the SFT model in swift rlhf with full-parameter bfloat16 training and vLLM-backed generation for rollout efficiency.Dataset and dataloader shuffling are disabled, while left-side truncation preserves the most recent context when samples exceed the context window.
  • Optimization Strategy: The overall strategy combines supervised initialization, reward-driven policy improvement, long-context training, conservative RL learning rates, mixed precision, memory optimization, and vLLM serving.These choices are intended to balance adaptation quality, training stability, and system efficiency under limited GPU memory.
Loading 2605.09530v3…