Source-linked AI summary
BIO-MEMART: Biometric-Aware KV Cache Memory for Multi-User LLM Agents
Yanhong Qian, Xuanying He, Qingguo Meng, Shihao Ding, Xingbo Dong, Zhe Jin
TL;DR
Shared multi-user LLM agents need an identity-aware access rule because semantic relevance alone can expose another user’s private KV memory. Bio-MemArt gates shared KV memory with biometric identity before native MemArt retrieval, retaining authorized QA performance and low-token operation across benchmark settings.
Problem
Shared KV-memory deployments lack an access rule determining whether a semantically relevant block is authorized for the current physical user.
Method
Bio-MemArt attaches biometric templates to KV blocks, filters them using the current user’s probe, and applies native MemArt retrieval and KV reuse within the authorized pool.
Results
Face benchmarks show 86.00%–100.00% owner acceptance and 0.00%–2.00% non-owner acceptance, while palmprint CasiaM_460 and CasiaM_700 reach 6.00% non-owner acceptance.
Takeaways & Limitations
Authorized users retain substantially better QA performance than unauthorized users while the identity gate preserves the low-token operating regime of KV-cache memory.
Takeaways & Limitations
The evaluation assumes biometric probes match the target memory’s owner in Owner trials and come from a different user in Non-owner trials.
Abstract
from arXiv · showhide
KV cache is evolving from a serving optimization into an external memory substrate for long-term LLM agents. In a shared multi-user deployment, however, reusable KV blocks introduce a missing access-control question: semantic relevance alone cannot determine whether a memory block is authorized for the current physical user. We propose Bio-MemArt, a biometric-aware KV-cache memory framework for multi-user LLM agents. Bio-MemArt attaches a normalized biometric template to each stored KV memory block, filters the shared memory pool with the current user's biometric probe, and then runs the original MemArt retrieval and KV reuse pipeline only inside the authorized candidate pool. This design preserves latent-space retrieval, direct cache reuse, and decoupled position encoding while adding physical-user access control to shared KV memory. We evaluate Bio-MemArt under Owner and Non-owner query conditions on long-term dialogue QA with face and palmprint benchmarks. Across face benchmarks, the average owner and non-owner biometric success rates are 95.71% and 0.86%; across palmprint benchmarks, they are 97.60% and 2.00%. In the efficiency study, average prefill tokens drop from 18,781.96 under full-context prompting to 28.57 with Bio-MemArt, showing that biometric gating preserves the low-token operating regime of KV-cache memory.
1 Introduction
Persistent LLM agents reuse KV states as long-term memory, but shared deployments require authorization in addition to semantic relevance. Bio-MemArt adds biometric identity filtering before native MemArt retrieval while preserving KV-memory reuse benefits.
- Shared KV retrieval can surface another user’s private memory when semantic relevance is used without physical-user authorization.
- Existing KV-cache systems and MemArt optimize storage, movement, reuse, or retrieval, but do not decide whether a block is accessible to the current physical user.
- Face and palmprint embeddings provide identity evidence for distinguishing the current physical user from account metadata alone.
- Bio-MemArt attaches biometric templates to KV blocks, filters the shared pool by cosine-similarity threshold, and then applies native MemArt retrieval within authorized candidates.
- Experiments evaluate whether biometric gating preserves Owner–Non-owner separation and the low-token advantage of KV-cache memory.
2 Related Work
KV-cache research improves serving and cross-context reuse, while MemArt treats reusable KV blocks as long-term agent memory. Bio-MemArt shifts the focus to authorization: deciding which persistent personal states a shared system may expose.
- Modern KV-cache systems target throughput, memory utilization, fragmentation, offloading, scheduling, and data movement in serving and multi-agent workloads.
- Cross-context and cross-agent methods enable KV sharing through prefix alignment, collective communication, and workflow-aware reuse.
- MemArt extends KV reuse into an external memory substrate for long-term LLM agents.
- When KV states preserve personal history, reuse determines which user-specific information can be surfaced in later interactions.
- Biometrics address physical-user changes that logical identifiers may not reliably distinguish across shared devices or active sessions.
- Bio-MemArt applies biometric verification to reusable KV memory while retaining the retrieval and reuse properties of shared KV blocks.
3 Method
Bio-MemArt augments MemArt blocks with biometric ownership templates and performs identity-first filtering. Native semantic retrieval and KV reuse then operate only within the authorized candidate pool.
- 3.1 Problem Setting: The problem setting pairs a natural-language query with a biometric probe and distinguishes Owner from Non-owner memory access conditions.
- 3.2 Biometric-Aware KV Memory: Each memory block preserves KV tensors, compressed indexing keys, timestamps, auxiliary metadata, and the owner’s biometric template embedding.
- 3.2 Biometric-Aware KV Memory: All KV blocks from one user share a stored biometric template, keeping the identity field lightweight without modifying KV tensor structure.
- 3.3 Threshold Estimation: Bio-MemArt estimates a benchmark-specific threshold from matched and mismatched verification distributions and fixes it for downstream retrieval trials.
- 3.3 Threshold Estimation: Biometric verification activates an authorized owner pool before compressed-key top-K retrieval, memory merging, and decoder KV-cache reuse.
- 3.3 Threshold Estimation: Unmatched probes remove target blocks, while authorized probes retain owner blocks for generation.
- 3.3 Threshold Estimation: The authorization gate preserves the low-prefill-cost rationale for using KV cache memory.
4 Experiments
The experiments test biometric authorization alongside long-term dialogue QA under controlled Owner and Non-owner conditions. Face and palmprint benchmarks vary the biometric operating point while the downstream questions and stored histories remain fixed.
- 4.1 Datasets: LoCoMo supplies long multi-session conversations and memory-intensive Multi-Hop, Temporal, and Single-Hop questions.
- 4.1 Datasets: Seven face benchmarks cover age, frontal-view, and pose variation, while ten palmprint protocols span wavelength-specific, contactless, and contact-based acquisition settings.
- 4.2 Evaluation Protocol: Owner and Non-owner trials use the same shared memory contents, dialogue questions, and downstream QA task; only the biometric probe changes.
- 4.3 Baselines: Full-context inference is the upper-cost reference, while native MemArt without biometric filtering is the primary downstream QA and runtime baseline.
- 4.2 Evaluation Protocol: Memory accuracy uses unigram F1 and BLEU-1, identity isolation uses biometric success rate and Owner–Non-owner gaps, and efficiency uses prefill and runtime indicators.
- 4.4 Implementation: Thresholds are calibrated from positive and negative verification pairs and fixed across LoCoMo trials for each benchmark.
5 Results and Analysis
Bio-MemArt separates authorized owner access from non-owner access while preserving memory-grounded QA and low-token KV-cache operation. Results vary across biometric benchmarks primarily because authentication changes which memories survive the gate.
- Reading Benchmark Differences: Identical QA rows can reflect different biometric benchmarks when datasets induce the same owner-acceptance and non-owner-rejection pattern.The fixed LoCoMo questions make authentication outcomes, rather than dialogue content, the main source of benchmark variation.
- Matched biometric probes preserve higher memory-grounded QA than mismatched probes across face and palmprint modalities.
- Dataset-Specific Authentication Summary: Face benchmarks mainly differ in owner retention: CPLFW reaches 86.00% owner acceptance, while CFP-FF, CFP-FP, and LFW reach 100.00%.Face non-owner acceptance remains between 0.00% and 2.00%.
- Dataset-Specific Authentication Summary: Palmprint CasiaM_460 and CasiaM_700 reach 6.00% non-owner acceptance, weakening isolation relative to MS_Blue, PolyU, and Tongji.Higher false acceptance narrows the owner/non-owner gap under the same downstream questions.
- Runtime: 18,781.96 average prefill tokens under full-context prompting fall to 28.57 with Bio-MemArt, while MemArt uses 35.42 tokens.Biometric filtering removes non-matching blocks before retrieval, and response times remain close to native KV memory.
- Owner versus Non-owner: Matched probes recover personalized restaurant memory, whereas mismatched probes produce a generic non-leaking response.Across question categories, denied access especially reduces performance when answers require coherent user-specific event sequences.
6 Conclusion
Bio-MemArt adds biometric authorization to shared KV-cache memory by filtering memory blocks before native MemArt retrieval and reuse. Experiments show stronger QA for authorized users, benchmark-dependent acceptance rates, and preserved low-token operation.
- Bio-MemArt attaches biometric templates to KV blocks, filters the shared pool with the current user’s probe, and performs MemArt retrieval only among authorized candidates.
- Authorized users retain substantially better QA performance than unauthorized users across the evaluated settings.
- Different biometric benchmarks produce different operating points and acceptance rates.
- The identity gate preserves the low-token operating regime of KV-cache memory.