MemPrivacy protects user privacy in edge-cloud memory agents through local reversible pseudonymization. Using a four-level privacy taxonomy and lightweight models (0.6B-4B), it achieves 85.97% F1 on privacy detection with only 0.71%-1.60% utility loss and sub-2-second processing.
论文原始摘要
As LLM-powered agents are increasingly deployed in edge-cloud environments, personalized memory has become a key enabler of long-term adaptation and user-centric interaction. However, cloud-assisted memory management exposes sensitive user information, while existing privacy protection methods typically rely on aggressive masking that removes task-relevant semantics and consequently degrades memory utility and personalization quality. To address this challenge, We propose MemPrivacy, which identifies privacy-sensitive spans on edge devices, replaces them with semantically structured type-aware placeholders for cloud-side memory processing, and restores the original values locally when needed. By decoupling privacy protection from semantic destruction, MemPrivacy minimizes sensitive data exposure while retaining the information required for effective memory formation and retrieval. We also construct MemPrivacy-Bench for systematic evaluation, a dataset covering 200 users and over 155k privacy instances, and introduce a four-level privacy taxonomy for configurable protection policies. Experiments show that MemPrivacy achieves strong performance in privacy information extraction, substantially surpassing strong general-purpose models such as GPT-5.2 and Gemini-3.1-Pro, while also reducing inference latency. Across multiple widely used memory systems, MemPrivacy limits utility loss to within 1.6%, outperforming baseline masking strategies. Overall, MemPrivacy offers an effective balance between privacy protection and personalized memory utility for edge-cloud agents, enabling secure, practical, and user-transparent deployment.
Paper Collector 中文速览
边缘云Agent隐私保护个性化记忆管理系统
方法概述
在边缘设备识别隐私敏感片段，用语义结构化类型感知占位符替换，云端处理记忆，本地恢复原始值。构建4级隐私分类体系和52k实例评测基准。
核心贡献
提出MemPrivacy框架，用语义结构化占位符替换敏感信息，实现隐私保护与记忆效用的平衡
原始来源与核验范围
核验仅覆盖论文正文中的主张、证据片段和参考文献关系。NGJOO 未独立运行作者代码、重做实验或验证真实部署效果；页面中的可复现性分数是文档完整度评估，不是复现实验结果。
核心问题
How can edge-cloud memory-augmented LLM agents protect user privacy from cloud-side exposure while preserving the semantic utility needed for personalized memory formation and retrieval?
核心方法
MemPrivacy performs local reversible pseudonymization using a three-stage lifecycle: Uplink Desensitization (privacy span detection and typed placeholder replacement), Cloud Processing, and Downlink Restoration. Models are trained via two-stage supervised fine-tuning followed by reinforcement learning with GRPO, and evaluated on MemPrivacy-Bench (200 users, 155K+ privacy instances) and PersonaMem-v2 across three memory systems (LangMem, Mem0, Memobase).
方法组件
- Two-stage training combines SFT stability with RL flexibility for privacy span extraction.
- SFT on 26K instances provides stable initialization and reduces instability during RL exploration.
- GRPO eliminates the need for a separately trained value function by using relative rewards within output groups.
- F1 score serves as the scalar reward, directly optimizing toward the evaluation criterion.
- KL regularization constrains the policy from drifting excessively from the SFT initialization.
- MemPrivacy shows only 0.71%-1.60% performance drop when protecting PL2-PL4 content.
- Typed placeholders preserve semantic information better than irreversible or untyped masking.
- Framework effectiveness critically depends on accurate privacy extraction by specialized models.
- MemPrivacy remains stable as privacy-related question proportion increases.
- Type-aware reversible protection better preserves lexical and semantic information for memory retrieval.
论点验证
Same as claim_2 - the four-level taxonomy is comprehensively defined with PL1 (exclusion class), PL2 (identifiable), PL3 (harm-based), and PL4 (immediately exploitable) levels, each with clear criteria and examples.
The structured output format (original span text, privacy level, privacy type) is specified in paragraph 31. Note that the claim mentions 'PL2-PL4 taxonomy' but PL1 is also part of the taxonomy as an exclusion class - this is a minor inconsistency.
The typed placeholder mechanism with examples like
The configurable masking threshold is mentioned in paragraph 31 and demonstrated experimentally in Table 4 (paragraph 64) where different protection levels (PL4 only, PL3-PL4, PL2-PL4) are evaluated with corresponding utility loss measurements.
The synthesis of 200 user profiles from PersonaHub seeds is stated in paragraph 41. The methodology is described but the paper relies on PersonaHub [11] as the seed source without providing the specific synthesis procedure details.
The four preference categories and average of 50 privacy types per profile are specified in paragraph 41. These are design specifications for the benchmark construction.
The 7 high-level scenario categories and 23 fine-grained subcategories are mentioned in paragraph 41. However, the paper does not enumerate or describe these categories in detail in the main text.
The hybrid LLM-assisted annotation pipeline is described in paragraphs 41-42, including dual-model label generation, two-stage refinement, and human verification. The 98.08% accuracy after human verification supports the quality claim.
The dual-model label generation with Gemini-3.1-Pro and GPT-5.2 is explicitly stated in paragraph 41. The two-stage refinement process (initial labeling and correction) is described.
The six human annotators and their qualifications (bachelor's degree minimum) are specified in paragraph 43. The verification protocol is described in paragraphs 43-45.
The 98.08% accuracy after human verification is explicitly stated in paragraph 46. This is a specific quantitative result from the annotation quality evaluation.
The two-stage training pipeline (SFT followed by RL with GRPO) is described in detail in paragraphs 47-54. The rationale and implementation details are provided.
The SFT on 26K training instances is explicitly stated in paragraph 48. The training objective and configuration are provided.
The RL phase on 1K training instances using GRPO is stated in paragraph 50. The GRPO formulation and hyperparameters are provided in paragraphs 50-54.
... 共 45 个论点
可复现性评估
较低可复现性 (0%)
缺失的复现细节
- 训练超参数缺失：学习率、批大小、训练轮数、PPO裁剪系数(ϵ)、KL正则化强度(β)、GRPO组大小(G)等关键超参数均未提供
- 随机种子未指定
- 代码不可用：论文提到代码仓库中有训练脚本，但实际未找到可用代码
- 数据不可用：MemPrivacy-Bench数据集、26K SFT训练数据、1K RL训练数据均未公开
- 补充材料不可访问：论文多次引用补充材料中的代码版本、实现来源、配置更改和提示模板，但这些内容无法获取
- 模型具体配置缺失：Table 5提到的模型变体细节未在提供的文本中展示
- 软件环境版本不完整：未指定Python、PyTorch、LLaMA-Factory、MS-Swift、DeepSpeed、vLLM的具体版本号
- 评估细节不完整：GPT-5.2作为评判模型的具体提示词未提供，类型标签嵌入的具体来源未说明
- PersonaMem-v2采样细节缺失：未说明具体选择了哪20个用户及其选择标准
局限与证据边界
现有分析产物未识别到作者明确写出的局限。这不等于论文没有局限；请结合原文、代码和独立复现实验判断。
本分析由 PDF 阅读助手 自动生成，仅供参考，不构成学术评审意见。验证结论和可复现性评估基于论文文本自动分析，可能存在偏差。原始论文请参阅 arXiv。
分析时间：2026-05-15T13:08:37+00:00 · 数据来源：Paper Collector