Search papers, labs, and topics across Lattice.
This paper addresses the issue of adaptive transcript privacy in long-term memory for LLM agents, where repeated memory use can inadvertently disclose sensitive attributes. The authors introduce DP-MemView, a differentially private memory interface that selectively exposes public response-conditioning views while maintaining privacy guarantees for protected attributes. Evaluation results demonstrate that DP-MemView effectively preserves transcript distinguishability while ensuring high-quality personalized responses across various LLMs and benchmark tasks.
Adaptive transcript privacy can be safeguarded in LLMs without sacrificing personalization, thanks to a novel differentially private memory interface.
Long-term memory enables persistent personalization in LLM agents, but repeated memory-conditioned responses can cumulatively reveal protected attributes even when they are never stated explicitly. We formalize this threat as adaptive transcript privacy and introduce DP-MemView, a differentially private interface that privately selects public response-conditioning views and exposes those views---rather than raw memory---to the response LLM. Each private selection is charged to every protected attribute whose memory group intersects the read set. Per-attribute ledgers block any selection that would exceed its cap and return a fixed generic view instead. Under an explicit interface contract, we prove pure B_a-DP for the entire adaptive transcript. We also extend the result to stores that differ across multiple protected groups and bound how much observing the transcript can change an adversary's prior odds. We evaluate the online and preallocated modes with three response LLMs on a controlled adjacent-store benchmark and a public-corpus transfer track. Both modes keep transcript distinguishability near chance while preserving target-required personalization and overall response quality. Further diagnostics show that removing key safeguards causes mismatched output support, missing ledger charges, revealing side channels, or growing long-horizon leakage.
