AuthorsYining Chen, Jihao Zhao, Bo Tang et al.
TL;DR
MemPrivacy uses local typed placeholders plus reversible restoration to reach 85.97 F1 on MemPrivacy-Bench, beating GPT-5.2 by 16.98 points while cutting latency.
Read our summary here, or open the publisher PDF on the next tab.
THE PROBLEM
Long-term cloud memory exposes PII across logs, vector stores, and reuse, with leakage attacks reaching 75% success and multi-turn attacks up to 69%.
This breaks personalized edge cloud agents, forcing users into self censorship or crude masking that destroys semantics and degrades long term personalization.
HOW IT WORKS
MemPrivacy centers on a Local MemPrivacy Model, Four-Level Privacy Taxonomy, Local Secure Mapping DB, and staged Uplink Desensitization and Downlink Restoration.
Think of MemPrivacy as a privacy RAM front end that rewrites secrets into typed handles before sending them to a cloud disk like a card catalog.
This KEY_MECHANISM lets MemPrivacy keep semantic roles for memory retrieval and reasoning that a plain context window with full masking would destroy.
DIAGRAM
This diagram shows how MemPrivacy processes an edge user request through uplink desensitization, cloud reasoning, and downlink restoration.
DIAGRAM
This diagram shows how MemPrivacy builds MemPrivacy Bench and trains MemPrivacy models with SFT and GRPO reinforcement learning.
PROCESS
Stage 1 Uplink Desensitization
MemPrivacy uses the Local MemPrivacy Model and Four-Level Privacy Taxonomy to detect privacy spans and replace them with typed placeholders before cloud upload.
Stage 2 Cloud Processing
MemPrivacy sends desensitized inputs so the cloud agent can perform reasoning and memory operations while only seeing semantic placeholders and non sensitive signals.
Stage 3 Downlink Restoration
MemPrivacy queries the Local Secure Mapping DB to restore original values, performing low latency placeholder lookup and replacement in the user facing reply.
MemPrivacy Bench Evaluation
MemPrivacy evaluates privacy extraction and memory utility on MemPrivacy Bench and PersonaMem v2 using its trained MemPrivacy models and configured masking levels.
KEY CONTRIBUTIONS
MemPrivacy framework for edge cloud agents
MemPrivacy introduces local reversible pseudonymization with typed placeholders, combining Uplink Desensitization, Downlink Restoration, and a Local Secure Mapping DB for 3 stage protection.
Four level privacy taxonomy PL1 PL4
MemPrivacy defines PL1 to PL4 levels, from preferences to credentials, enabling configurable masking policies and differential protection across 50 privacy types per user.
MemPrivacy Bench and trained models
MemPrivacy builds MemPrivacy Bench with 200 users and 155k+ privacy instances and trains 0.6B 4B MemPrivacy models that reach 85.97 F1 and sub 2.1s latency.
RESULTS
F1
85.97
+16.98 over GPT-5.2 on MemPrivacy-Bench
Precision
86.86
MemPrivacy-4B-RL vs 65.40 GPT-5.2 on MemPrivacy-Bench
Recall
87.15
MemPrivacy-4B-RL vs 78.13 GPT-5.2 on MemPrivacy-Bench
Time (s)
2.05
Latency per message for MemPrivacy-4B-RL vs 4.62 for GPT-5.2 on MemPrivacy-Bench
These numbers come from MemPrivacy-Bench, a privacy dense benchmark with 29,967 privacy instances, testing span extraction with levels and types. The MAIN_RESULT shows MemPrivacy achieves higher F1 and lower latency than GPT-5.2 and Gemini-3.1-Pro for privacy extraction in realistic dialogues.
BENCHMARK
These numbers come from MemPrivacy-Bench, a privacy dense benchmark with 29,967 privacy instances, testing span extraction with levels and types. The MAIN_RESULT shows MemPrivacy achieves higher F1 and lower latency than GPT-5.2 and Gemini-3.1-Pro for privacy extraction in realistic dialogues.
BENCHMARK
F1 on MemPrivacy-Bench for MemPrivacy and strong general LLM baselines.
KEY INSIGHT
MemPrivacy-0.6B-RL reaches 84.66 F1 on MemPrivacy-Bench, beating GPT-5.2 at 68.99 F1 while running in only 1.63 seconds.
This is surprising because a 0.6B edge scale MemPrivacy model surpasses frontier general LLMs, showing that specialized privacy training can trump raw parameter count.
WHY IT MATTERS
MemPrivacy unlocks privacy preserving long term memory where edge devices sanitize and restore user data without sacrificing personalization utility.
Builders can now deploy cloud assisted agents that remember preferences and sensitive facts across sessions while keeping raw secrets off the cloud and under user configurable policies.
Nikhil Verma
· 2026
Focus Agent adds start_focus, complete_focus, a persistent Knowledge block, and an optimized Persistent Bash plus String-Replace Editor scaffold to actively compress context during long software-engineering tasks. On five hard SWE-bench Lite instances against a Baseline ReAct agent, Focus Agent achieves 22.7% token reduction (14.9M → 11.5M) while matching 3/5 = 60% task success.
Xingyu Lyu, Jianfeng He et al.
· 2026
ADAM combines Anchor extraction, Distribution estimation, Anchor selection, and Query generation to adaptively probe agent memory via an auxiliary generator and entropy based selection. On the EHRAgent benchmark with Llama2-7b-chat, ADAM reaches EQ=77 and ASR=1.00, compared to MEXTRA’s EQ=44 and ASR=0.89.
Shannan Yan, Jingchen Ni et al.
· 2026
AdaMem organizes dialogue history into Working Memory, Episodic Memory, Persona Memory, and Graph Memory coordinated by a Memory Agent, Research Agent, and Working Agent. On LoCoMo with GPT-4.1-mini, AdaMem achieves 44.65 F1 overall, beating the best baseline LangMem at 41.76 F1 by +2.89.
Answers use this explainer on Memory Papers.
Checking…