Privacy-Aware Experience Memory

• Privacy-Aware Experience Memory is a framework of architectures and algorithms designed to securely store and share AI historical data while preventing raw data leakage and inference attacks.
• These systems employ techniques such as proxy distillation, token-level differential privacy, and zero-trust cryptographic controls to mitigate privacy risks in distributed and continual learning scenarios.
• Empirical studies demonstrate that such approaches can significantly reduce privacy leakage while maintaining system utility in applications like federated RL and persistent LLM personalization.

Privacy-aware experience memory refers to memory architectures and algorithms that enable AI systems to leverage or share historical experience, trajectories, or knowledge—while rigorously containing privacy risks stemming from raw data leakage, inference attacks, contextual exposures, or model memorization. These systems are fundamental in distributed reinforcement learning, continual learning, persistent LLM personalization, multi-agent collaboration, privacy-compliant lifelong learning, and retrieval-augmented grounded reasoning. Technical solutions range from proxy distillation, local differential privacy, token-adaptive DP, cryptographically secured zero-trust storage, proactive amnesia, and user-centric controls. Design and evaluation are grounded in the mutual information leakage, contextual integrity, precise regulatory requirements, and empirical trade-offs between utility and privacy.

1. Architectures for Privacy-Aware Experience Memory

Distributed RL and Proxy Memory

In federated reinforcement learning, conventional experience memory—collections of state transitions $(s_t^i, a_t^i, r_t^i, s_{t+1}^i)$—is highly privacy-sensitive, as sharing raw trajectories exposes both state visitation and agent policies. FRD (Cha et al., 2019) replaces raw memory exchange $D_i$ with "proxy experience memory": agents agree on a fixed proxy state set $\mathcal{S}_{\rm proxy}$ (via clustering or quantization), locally record time-averaged policy logits for mapped states, and exchange only these aggregated proxies. The completeness of the proxy set ($M$) and memory exchange frequency ($E$) parametrically trade off sample efficiency, communication overhead, and leakage; Laplace/Gaussian noise can be injected for $(\varepsilon,\delta)$-DP.

Multi-Agent RL with Local Differential Privacy

Decentralized MARL frameworks such as BRNES (Hossain et al., 2023) employ privacy-aware experience sharing wherein agents only disclose noisy, randomized advice (e.g., perturbed Q-tables), using Generalized Randomized Response (GRR) to achieve $\varepsilon$-LDP for every shared value. Dynamic neighbor-zone selection and weighted aggregation fortify learning against Byzantine attacks and adversarial inference, and empirical results confirm resilience (leakage < 20% under attack) with only minor learning cost.

Token-Level DP and Sculpted Memory in Continual Learning

PeCL (Zhan et al., 16 Sep 2025) advances privacy-aware experience memory in continual learning by assigning semantic sensitivity scores to each input token, allocating a differential privacy budget $\varepsilon_i$ per token (more sensitive tokens get stronger protection), and injecting Gaussian mechanism noise directly into token-level embeddings. Privacy-guided memory sculpting regularizes weights associated with non-sensitive data (preserving knowledge) while soft-forgetting those tied to sensitive tokens. This yields a fine-grained, dynamic privacy-utility ratio that outperforms uniform-DP baselines.

Privacy-Compliant Persistent Memory in LLMs

Persistent experience memory in LLMs, as evaluated by the CIMemories benchmark (Mireshghallah et al., 18 Nov 2025), is founded on contextual integrity: stored user attributes may only be disclosed if contextually appropriate under social norms. Each memory item is tagged with task-based acceptability labels, and retrieval engines, guardrail policies, and policy engines must filter responses to avoid attribute-level violations—which rise sharply with usage and sampling. History-conditional, CI-aware retrieval is essential for suppressing privacy violations without blunt utility loss.

Zero-Trust and Cryptographic Controls

MemTrust (Zhou et al., 11 Jan 2026) proposes a five-layer AI memory system (storage, extraction, learning, retrieval, governance), where all memory artifacts, parsing, and retrieval ranking are handled inside trusted execution environments (TEEs), eliminating plaintext leakage and enabling remote attestation. Retrieval is fortified with side-channel obfuscation—dummy/fake bucket sampling or ORAM. Inter-application context sharing proceeds only after attestation and policy approval, establishing platform-level cryptographic guarantees.

Hierarchical and Explicit User Controls

User-facing privacy-aware experience memory systems (MemoAnalyzer (Zhang et al., 2024), PrivacyReasoner (Tu et al., 14 Jan 2026), and user studies (Zhang et al., 11 Aug 2025)) formalize layered controls: memory segmentation (workspaces), explicit opt-in/out at memory generation, inline citations for traceability, dashboards for edit/delete, sensitivity visualization, and policy-driven retention/deletion. These approaches address both direct containment and inference-based privacy risks.

2. Privacy Risks and Leakage Channels

Direct Data Exposure and Inference

Experience memory leaks privacy via direct containment (raw PII/PHI in stored records), aggregation (linkage attacks combining fragments), and model memorization (parameter anchoring to sensitive sequences). In multi-agent systems, memory exchange can reveal state trajectories or internal policies (Cha et al., 2019, Hossain et al., 2023).

Membership Inference and Black-Box Extraction

LLM agents storing user interactions are vulnerable to MEXTRA attacks (Wang et al., 17 Feb 2025): adversarial prompts can request the agent to reveal in-context examples, systematically extracting raw queries. Key leakage factors include retrieval depth $k$, memory size $m$, similarity function, and attacker prompt diversity. Differential privacy, sanitization, and encrypted retrieval, if implemented, can statistically bound leakage rates.

Contextual Integrity and Social-Norm Alignment

Attribute-level privacy violation emerges when LLMs reveal facts in contexts contrary to social norms (CIMemories (Mireshghallah et al., 18 Nov 2025)). Models fail at fine-grained contextual reasoning, often sharing all or nothing. Violations accumulate with repeated queries or across multiple tasks, necessitating context-aware policy engines and compositional memory-object tagging.

Temporal Drift and Overexposure

Temporal drift in privacy recall (Guo et al., 21 Sep 2025) causes users to misremember original sharing settings; gist-based heuristics overestimate permissible audiences over time, introducing unintentional overexposure. Interfaces must restore audience provenance and recognition cues at reuse time.

3. Privacy-Preserving Methods and Algorithms

Proxy and Aggregated Memory Distillation

Proxy buffer distillation (FRD (Cha et al., 2019), BRNES (Hossain et al., 2023)) replaces raw memory exchange with per-state or per-action proxies: time-averaged policy vectors, stochastic noise, and representative data points, sharply reducing mutual information leakage.

Token-Level Dynamic Differential Privacy

Token-level sensitivity scoring (PeCL (Zhan et al., 16 Sep 2025)) modulates privacy budgets $\varepsilon_i$ adaptively and injects DP noise at the embedding layer. When storing or recalling, only privacy-perturbed representations are used, composing privacy guarantees across tasks.

Selective Forgetting and Memory Sculpting

Memory-aware retention schemas (MaRS (Alqithami, 14 Dec 2025)) and selective amnesia protocols (PPA (Kuo et al., 24 Feb 2025)) identify and directly "snip" anchors of sensitive memory traces, using gradient-ascent on unlearning loss functions and implant substituted fake memories to preserve functional fluency. Episodic rehearsal buffers (PALL (2505.10941)) enable precise unlearning via sparse subnetwork decomposition and buffer replay mechanisms, achieving exact regulatory compliance in lifelong learning.

Cryptographic and Zero-Trust Controls

System-wide memory encryption, Merkle root verification, side-channelhardened retrieval (MemTrust (Zhou et al., 11 Jan 2026)), and remote attestation confine all plaintext or sensitive data within trusted environments, binding access policies to hardware, and minimizing leakage across the stack.

Contextual Filtering and Policy Engines

Retrieval modules in LLM stacks must implement context-aware filters (PrivacyReasoner (Tu et al., 14 Jan 2026)), policy engines checking per-attribute and per-task acceptability (CIMemories (Mireshghallah et al., 18 Nov 2025)), and human-in-the-loop review for high-risk disclosures.

4. Evaluation Metrics, Benchmarks, and Trade-Offs

Leakage, Utility, and Fidelity Metrics

Core evaluation metrics include:

• Attribute-level violation rate (fraction of inappropriate facts revealed per response)
• Completeness/utility (fraction of necessary attributes correctly shared)
• Privacy–utility trade-off curves (utility vs. leakage as privacy budget varies)
• Episodic buffer effectiveness (PALL (2505.10941): accuracy over retained/unlearned tasks, buffer size vs. performance)
• Composite performance in generative agents (FiFA (Alqithami, 14 Dec 2025): narrative coherence, goal completion rate, social recall accuracy, privacy preservation, cost efficiency)
• LLM agent leakage rates under adversarial extraction (MEXTRA (Wang et al., 17 Feb 2025)): fraction of memory records revealed by black-box attacks

Empirical Outcomes

• Proxy-sharing in FRD (Cha et al., 2019) enables 10×–100× communication/data reduction at negligible performance cost.
• Token-level DP in PeCL (Zhan et al., 16 Sep 2025) lifts accuracy over baseline ER+DPSGD by 10 percentage points (mean $\varepsilon\approx3.2$).
• Zero-trust MemTrust (Zhou et al., 11 Jan 2026) elicits cryptographic confidentiality and integrity for all memory operations, with practical retrieval complexity ($O(\log n)$–$O(k\log n)$ under bucket sampling).
• PPA (Kuo et al., 24 Feb 2025) achieves 100% phone number risk reduction, 9.8–87.6% address risk reduction at marginal LLM utility cost (perplexity +0.2, email score drop ≤0.2).
• User studies show 22.3% more privacy protection, superior user satisfaction, and transparent control in interactive PAEM systems (Zhang et al., 2024, Zhang et al., 11 Aug 2025).

5. Practical Guidelines and System Design

Memory Generation and Control

• Segment memories into workspaces; separate personal, project, and ephemeral data (Zhang et al., 11 Aug 2025).
• Opt-in/-out controls at capture; "review and commit" interfaces for transparency.
• Inline memory citations, audit logs, and inference visibility panels enhance traceability.
• Time/condition-based retention policies automate data lifecycle management.

Retrieval and Privacy Filtering

• Enforce per-context, per-attribute acceptability via policy-engine filtering (Mireshghallah et al., 18 Nov 2025).
• DP-compliant retrieval: add Laplace/Gaussian noise to similarity scores, calibrate $\varepsilon$ for trade-off curve.
• Pre-processing de-identification and redaction before storage.
• Output filters block illicit retrievals (e.g., agent refusing "tell me all prior queries").

Memory Maintenance and Unlearning

• Episodic buffers (PALL) serve for selective repair after unlearning (2505.10941).
• Hybrid retention policies maintain utility under memory pressure (MaRS (Alqithami, 14 Dec 2025)).
• Proactive privacy amnesia protocols (PPA (Kuo et al., 24 Feb 2025)) and substitute memory implanting restore generalization post-unlearning.

Cryptographic Infrastructure

• TEE-backed multi-layer architecture secures all memory operations (MemTrust (Zhou et al., 11 Jan 2026)).
• Cross-tool sharing protocol implements attestation and policy-constrained access.

User-Centric Design

• Sensitivity/confidence visualizations guide edits and deletions (Zhang et al., 2024).
• Provenance-forward badges and risk-aware prompts mitigate temporal drift and overexposure (Guo et al., 21 Sep 2025).
• Modular management dashboards, inference transparency, and explainability APIs increase trust.

6. Limitations, Open Problems, and Future Directions

Empirical studies reveal persistent privacy-utility tension, granularity failures in LLMs (all-or-nothing sharing), accumulating violations with repeated usage, and user confusion regarding memory scope and deletion. Further research is needed on contextually-sensitive retrieval/disclosure, dynamic adaptation to user preferences, memory sounding for inference-induced risk, and scalable privacy-compliant architectures. The fusion of theory-grounded filtering, cryptographic guarantees, DP-compliant algorithms, and human-centered design is central for trustworthy privacy-aware experience memory.