DP-MemView: A Memory Interface for Attribute-Level Transcript Privacy in Long-Term LLM Agents

2026-08-04

AI Summary

This work addresses the risk that long-term LLM agents, while leveraging memory for personalized responses, may inadvertently leak protected attributes not explicitly mentioned due to accumulated dialogue history. To mitigate this, the paper introduces DP-MemView—the first differentially private memory interface that formally captures the threat of “adaptive dialogue history privacy.” DP-MemView ensures strict pure ε-differential privacy by selecting private memory views conditioned on the response, allocating privacy budgets per attribute, and incorporating a generic fallback mechanism. Empirical evaluations across multiple LLMs and benchmarks demonstrate that DP-MemView reduces the distinguishability of dialogue histories to random guessing levels, while ablation studies confirm the necessity of each component in preserving both privacy and personalization quality.

Abstract

Long-term memory enables persistent personalization in LLM agents, but repeated memory-conditioned responses can cumulatively reveal protected attributes even when they are never stated explicitly. We formalize this threat as adaptive transcript privacy and introduce DP-MemView, a differentially private interface that privately selects public response-conditioning views and exposes those views---rather than raw memory---to the response LLM. Each private selection is charged to every protected attribute whose memory group intersects the read set. Per-attribute ledgers block any selection that would exceed its cap and return a fixed generic view instead. Under an explicit interface contract, we prove pure B_a-DP for the entire adaptive transcript. We also extend the result to stores that differ across multiple protected groups and bound how much observing the transcript can change an adversary's prior odds. We evaluate the online and preallocated modes with three response LLMs on a controlled adjacent-store benchmark and a public-corpus transfer track. Both modes keep transcript distinguishability near chance while preserving target-required personalization and overall response quality. Further diagnostics show that removing key safeguards causes mismatched output support, missing ledger charges, revealing side channels, or growing long-horizon leakage.

Problem

• transcript privacy
• protected attributes
• long-term LLM agents
• memory leakage
• adaptive privacy

Innovation

• differential privacy
• long-term LLM agents
• adaptive transcript privacy
• memory interface
• privacy ledger