{"id":"b9b6e1f4-2510-4081-9e7d-6fff4a737ccd","arxiv_id":"2608.03130","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A memory interface that privately selects public response-conditioning views instead of raw memories, proving pure differential privacy for the full adaptive transcript in long-term LLM agents.","lead":"DP-MemView is a privacy layer between an LLM agent's long-term memory and the application reading its responses, releasing only budget-limited, public 'views' instead of raw memories. It proves a formal differential-privacy guarantee covering the entire conversation, and tests show it blocks attribute inference while keeping responses personalized.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Content-dependent retrieval is outside the theorem, so real semantic memory access falls outside the B_a-DP guarantee.","rationale":"I read the paper in good faith and the conditional theorem is internally sound: under Definition 1, the proof of Theorem 1 correctly composes the per-slot EM releases, handles the generic fallback, and extends to ordinary transcripts by post-processing. The ablations in RQ2 and Appendix B.5 honestly identify which invariant violations break the guarantee. The concern that carries the most weight is not a mathematical error but the scope of C4. The paper's own text disclaims content-dependent retrieval, and no mechanism is provided to make semantic retrieval private or adjacency-invariant. Since real long-term-memory agents retrieve by content, the central privacy guarantee does not apply to the system's motivating use case. The complete-grouping assumption is a related, equally important caveat: the guarantee is conditional on I_a containing all positions that may imply a, and the paper does not validate this on real memories. The reader's weakest-assumption pick (content-dependent retrieval) captures the same structural gap, so I agree with the CONDITIONAL verdict. The theoretical contribution remains a valid conditional result, and the empirical claims are consistent with the theorem's scope; the paper should not be rejected, but accepted only with the scope limitation made explicit.","tokens_in":22090,"tokens_out":16724,"duration_ms":227604,"concrete_test":"Modify only the read policy in Algorithm 1 to be content-dependent: R_t,g = top-k memory positions in slot g by cosine similarity between the query embedding and memory-item embeddings (e.g., k=2), keeping view vocabularies, scorer, ledgers, caps, and all other components fixed. Run the existing PairedMem benchmark at T=16, B_a=2, K=3 for the three response models. Check (1) whether R_t,g is identical for each adjacent M/M' pair (C4); (2) transcript AUC and TPR@5 against the fixed-read DP-MemView rows in Table 2; (3) the reconstructed cumulative per-attribute charge as in Table 4. If AUC rises toward RawReadSet/TaskMin or the reconstructed charge exceeds B_a, the excluded retrieval case breaks the practical guarantee; if AUC stays near chance despite differing read sets, the concern is mitigated. An analytical companion: exhibit an adjacent pair where semantic top-k returns disjoint read","verdict_should_be":"UNCHANGED","load_bearing_attack":"Theorem 1 and Algorithm 1 depend on Condition (C4): the read set R_t,g, charge set, local privacy parameter, and sensitivity bound must be identical across adjacent stores given the same released prefix, and the read policy in Algorithm 1 line 6 uses only q_t, g, and h_t,j. The paper explicitly states: 'Content-dependent retrieval is not covered by the transcript-privacy theorem; it would need to be adjacency-invariant or separately private, with any retrieval cost charged to every affected attribute,' and it supplies no such private-retrieval mechanism. Long-term LLM-agent memory is normally content-addressed (semantic top-k retrieval over stored facts), so in the intended deployment the read set itself varies with M. Once R_t,g differs between adjacent stores, the proof in Appendix B.2 no longer applies: the score vector and released-view distribution can differ without an accounting charge, and the B_a-DP certificate does not hold. The experiments never exercise this regime: PairedMem and the corpus transfer track use fixed slot-level read sets (e.g., R_t,food={2,3}), so the empirical near-chance distinguishability does not validate the theorem's practical reach for content-based memory systems. This is a scope gap rather than an internal inconsistency, but it is the main load-bearing assumption separating the conditional theorem from a usable long-term-memory interface.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes DP-MemView, a trusted memory-interface layer for long-term LLM agents. Instead of passing raw memory to a response LLM, the interface privately selects slot-level views from public vocabularies using the exponential mechanism, charges every protected attribute whose memory group intersects the read set, and enforces per-attribute pure-DP caps with a fixed generic fallback. The central formal contribution is Theorem 1: under six interface invariants (C1--C6), every adaptive transcript satisfies pure B_a-DP with respect to group-replacement adjacency. Corollary 1 extends this to stores differing in multiple protected groups via a minimum-cover cost, and Appendix B.4 derives a prior-independent posterior-odds bound. The paper also reports controlled experiments on paired synthetic stores (PairedMem) and a public-corpus transfer track with three response LLMs, showing that both online and preallocated budget modes keep distinguishability close to chance while preserving response quality, plus ablations that isolate the role of each invariant.","tokens_in":22422,"tokens_out":7540,"duration_ms":106088,"significance":"If Theorem 1 stands, the paper is a useful step toward composable, attribute-level privacy for LLM-agent memory. Its strengths are the explicit interface contract, the self-contained composition proof in Appendix B.2, and the isolating failure-mode constructions in Appendix B.5, which correctly show that common support, complete charging, downstream channel isolation, and pathwise caps are each necessary. The PairedMem benchmark is a well-controlled construction (same scaffold, fixed trajectories, matched stores), and the ablation table cleanly demonstrates that private view selection alone is insufficient. The paper is also admirably honest about the limits of its theorem, most notably that content-dependent retrieval is outside the guarantee. However, that same honesty exposes a load-bearing scope gap: the intended deployment of long-term LLM agents normally uses content-addressed semantic retrieval, and the empirical evaluation never exercises that regime. The empirical claim that distinguishability is 'near chance' is also under-supported because no error bars or significance tests are reported, and the transfer-track auditor may lose power from domain shift. The formal result","major_comments":[{"comment":"The theorem depends critically on a content-independent read policy: C4 requires the read set R_{t,g} to be identical across adjacent stores given the same released prefix, and Algorithm 1 line 6 computes R_{t,g} only from the public query, fixed layout, and history. The paper explicitly states, 'Content-dependent retrieval is not covered by the transcript-privacy theorem; it would need to be adjacency-invariant or separately private, with any retrieval cost charged to every affected attribute.' This is a major limitation because real long-term LLM memory is normally content-addressed (e.g., semantic top-k retrieval over stored facts), so the read set itself varies with M. Once R_{t,g} differs between adjacent stores, the score vector u_{t,g}(M) can differ without any ledger charge, the proof in Appendix B.2 no longer applies, and the B_a-DP certificate does not hold. The experiments nev","section":"DP-MemView / Definition 1, condition (C4); Algorithm 1 line 6"},{"comment":"No confidence intervals, standard errors, or significance tests are reported for any privacy or utility metric. This is especially important for the 'near chance' claim on the public-corpus transfer track, where the numbers are not obviously at chance: e.g., DP-MemView (on) gives AUC 0.562 (Qwen), 0.563 (Llama), 0.535 (Gemma) and TPR@5 values of 0.113, 0.100, and 0.100 versus the chance value of 0.05; TPR@5 is more than double chance. The PairedMem results are closer to 0.5, but transfer-track values hover around 0.53--0.56, which may or may not be 'near chance' depending on the variance over the 80 pairs. Stochastic methods are averaged over only three EM seeds, and no per-seed spread is given. I am not claiming the results are fabricated, but as reported the empirical support for the abstract's 'near chance' statement is not statistically grounded. Please provide confidence intervals o","section":"RQ1 / Table 2 and Table 3"},{"comment":"The privacy auditor is a logistic-regression classifier trained on PairedMem training transcripts and then applied, without refitting or recalibration, to the corpus-sourced transfer track. Low transfer-track AUC could therefore reflect domain shift (different memory wording, corpus topics, and sentence styles) rather than a genuinely small privacy loss. The paper lists a second 'Pairwise privacy auditor' (Mistral-Small-24B) in Table 9 but never reports its results or explains why it is absent from the tables. Since the auditing method itself is the only empirical measure of transcript distinguishability, I would like to see either (i) results from a stronger, transferable auditor, (ii) a calibration/domain-transfer check for the logistic-regression auditor, or (iii) an explicit graph showing that the auditor can still detect leakage on the transfer track when an interface with known lea","section":"Appendix C.5 / Evaluation protocol; Table 9"}],"minor_comments":[{"comment":"Figure 2 is dense: the slot-level view names, ledger updates, and the fallback path are hard to read at print size. A zoom-in or a step-by-step caption would help.","section":"Figure 2"},{"comment":"The adjacency symbol M∼a M′ is introduced informally in the text and then used in equations; it would be cleaner to define it as a named relation (e.g., 'a-adjacency') where it first appears.","section":"Notation, Section 'Problem Definition'"},{"comment":"The '†' footnote states that GenericOnly and TypedMask yield chance-level distinguishability by construction; this is correct, but the † marker should perhaps also appear in the transfer-track rows for consistency.","section":"Table 2"},{"comment":"In the C2 counterexample, the value of N is required to satisfy N > 2Ba/ε0, and the construction later states Nε0 ≤ Bb; these conditions are compatible (choose N sufficiently large and Bb accordingly), but the text could make the order of choices explicit to avoid an apparent tension.","section":"Appendix B.5"},{"comment":"The conclusion says 'both DP-MemView modes kept transcript distinguishability near chance' without repeating the transfer-track caveat; consider adding a one-sentence reminder that this is for fixed, content-independent read policies.","section":"Conclusion"}],"recommendation":"major_revision","confidential_remarks":"The formal result is sound and the paper is unusually transparent about its assumptions. My main concern is that the practical scope is narrower than the framing suggests: the theorem excludes content-dependent retrieval, which is the norm in long-term memory agents, and the experiments use fixed read sets. Add a private retrieval mechanism or visibly narrow the claims. The empirical work also needs error bars and a better auditor for the transfer track. I do not suspect any intent to mislead, but the current presentation invites readers to infer stronger practical privacy than the interface can deliver."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague — the paper is worth your time, but read it as a conditional construction, not a deployed-privacy solution. DP-MemView proves pure B_a-DP for the full adaptive transcript under the interface contract C1–C6. The proof is careful and I believe correct; the failure-mode analysis in B.5 is a real strength, and the paper is admirably explicit about its own limits. That is the good news.\n\nThe novel part is the formalization of adaptive transcript privacy at the memory-interface boundary and the composition machinery: per-attribute ledgers, charging every overlapping attribute, generic fallback, and post-processing of views. Nothing here breaks new ground in DP theory, and the paper says so. The contribution is a clean, enforceable interface contract, which is a legitimate systems contribution.\n\nThe soft spot is exactly the stress-test: Condition C4 requires the read set, charge set, and local budget branch to be identical across adjacent stores given the same released prefix. The authors state, in plain text, that content-dependent retrieval is not covered. But content-dependent retrieval is the normal mode for long-term LLM-agent memory — semantic top-k over stored facts. In that regime, the read set itself changes with M, and the proven bound does not apply. The paper offers no private-retrieval mechanism for that case. So the practical reach of Theorem 1 is narrower than the title and framing suggest. The experiments never enter this regime: read sets are fixed by slot, which is why the distinguishability numbers look good. Calling the transfer-track AUCs (~0.56 and TPR@5 around 0.10–0.11) 'near chance' is also a bit generous; they are closer to chance than the baselines, but not chance.\n\nTwo more small things: no error bars on the empirical tables, and no code or data shipped. The utility metric relies on an LLM judge, which is fine as a proxy but should be reported with variance.\n\nThat said, the paper is honest about these limitations, the math is not circular, and the ablations actually demonstrate why each invariant matters. It deserves a serious referee. I would cite it for the interface contract and the clean composition argument.","headline":"A correct and honest conditional DP guarantee for the memory interface, but the main clause — content-independent retrieval — is exactly what real semantic memory does not provide, and the experiments never leave that clause.","tokens_in":22870,"tokens_out":2132,"would_cite":true,"duration_ms":27689,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A memory-interface contract composes every repeated LLM-agent release into one pure differential-privacy bound per protected attribute.","keywords":["long-term memory","LLM agents","adaptive transcript privacy","differential privacy","exponential mechanism","attribute-level privacy","memory-view interface","personalization"],"falsifier":"For the theorem itself: on a small store where the full transcript distribution can be enumerated exactly, test every event $O$ for $\\Pr[\\tau_T \\in O \\mid M] \\leq e^{B_a} \\Pr[\\tau_T \\in O \\mid M']$; a single violating event would refute Theorem 1's composition claim. For the premise: implement a variant with content-dependent retrieval (for example, semantic-similarity search over private memory contents) while otherwise following the contract, and measure transcript distinguishability over a longer horizon—growing leakage with turn count would confirm the paper's explicit statement that such","tokens_in":22024,"feed_emoji":"🔒","tokens_out":12477,"duration_ms":123252,"temperature":0.7,"pith_summary":"Long-term memory lets LLM agents personalize across sessions, but it also lets a semi-trusted application infer protected attributes—such as a health condition or debt—by watching many ordinary, memory-conditioned responses that never state the fact outright. This paper tries to establish that this cumulative leakage can be closed at the memory interface: instead of handing raw memories to the response model, the interface privately selects public \"views\" (response-conditioning instructions, such as blood-sugar-conscious advice) with the exponential mechanism, and charges every selection to each protected attribute whose memory group was read. The paper proves that if the interface honors six stated invariants—common view support, complete per-attribute charging, no memory-dependent side channels, store-independent routing and ordering, pathwise budget caps with a generic fallback, and downstream post-processing—the entire adaptive transcript of queries, signals, and responses satisfies pure $B_a$-differential privacy for each protected attribute, even against an adversary who chooses every query from the observed history. A sympathetic reader would care because this converts a diffuse \"it might leak over time\" worry into a composable, prior-independent bound on how much a conversation can shift an adversary's beliefs, and the experiments indicate that personalization and response quality survive. The guarantee's reach is explicitly conditional: content-dependent retrieval is outside the theorem, protection depends on each attribute group being completely specified, and the multi-slot ordering subcase of the contract is argued by proof and counterexample rather than isolated empirically.","feed_headline":"LLM-agent memory leaks get a provable privacy cap","feed_subtitle":"Per-attribute budget ledgers bound a whole adaptive conversation, not just single replies—while keeping personalization.","key_machinery":"The load-bearing object is the DP-MemView interface contract of Definition 1, enforced by per-attribute privacy ledgers at the trusted memory-interface boundary. Raw memory never reaches the response model: for each active slot, the interface samples a \"view\" from a public vocabulary shared across adjacent stores—a fixed generic view (the store-independent fallback) plus response-conditioning modes such as blood-sugar-conscious advice—using the exponential mechanism with a policy-fixed sensitivity bound $\\Delta u_{t,g}$ on the internal score vector. Every read is charged to all attributes whose protected group intersects the read set ($\\Gamma^\\star \\subseteq \\Gamma_{t,g}$); a selection is ad","core_discovery":"The paper's central claim is Theorem 1: if a memory interface satisfies the six invariants (C1)–(C6) of its Definition 1, then for every protected attribute $a$, every adjacent pair of memory stores $M \\sim_a M'$ (identical outside the positions that may imply $a$), and every adaptive query strategy, the augmented transcript $\\tilde{\\tau}_T$—queries, privately selected views, observable control signals, and responses—satisfies pure $B_a$-DP; the application-facing transcript $\\tau_T$, which hides the views, inherits the same bound by post-processing. The practical reading: no matter how the application adapts its queries, observing the whole conversation can multiply an adversary's prior odd","pith_inferences":["The paper explicitly leaves content-dependent retrieval out of the theorem; a natural extension is to make retrieval itself private (an adjacency-invariant or differentially private index) and charge its cost to the same attribute ledgers, which would close that gap.","Because the contract treats any observable release conditioned on public state as post-processing, the same ledger accounting should transfer to non-text channels—tool calls, action trajectories, API payloads—making the interface a template for agent privacy beyond response text.","The proof's ledger induction implies that generic-fallback events are identical across adjacent stores conditioned on the same released prefix, so an observable \"budget exhausted\" indicator would carry no additional privacy loss under the contract.","A sharper evaluation would audit the likelihood-ratio bound directly—enumerating transcript events on small stores or using confidence-rated adversarial queries—rather than relying on classifier AUC as the privacy measure."],"forward_implications":["With cap $B_a$, any finite sequence of memory-conditioned interactions leaks at most a factor $e^{B_a}$ in likelihood ratio about attribute $a$, regardless of how the application adapts its queries.","Observing any transcript event can change the prior odds for a protected attribute by at most $e^{B_a}$ in either direction, for any prior.","For stores differing across several protected groups, the transcript guarantee holds with total budget equal to the minimum-cost cover of the differing positions by protected groups.","On both evaluation tracks, the two budget modes keep attribute distinguishability near chance (AUC near 0.5) across three response LLMs while matching or exceeding raw-memory baselines on overall response quality and recovering target-required personalization.","Ablations show that private selection alone is insufficient: omitting complete charging, the randomized selection rule, or the cumulative cap each breaks the $B_a$-DP certificate and raises transcript distinguishability."],"supporting_citations":[{"why":"Supplies the exponential mechanism used as the local view-selection primitive in Eq. (7).","marker":"McSherry and Talwar 2007"},{"why":"Defines pure differential privacy and the post-processing property by which the ordinary transcript inherits the augmented transcript's bound.","marker":"Dwork and Roth 2014"},{"why":"Provides the composition view for combining per-selection privacy losses into a transcript-level guarantee.","marker":"Kairouz, Oh, and Viswanath 2015"},{"why":"Privacy odometers and filters motivate the per-attribute ledgers and the pathwise cap that stops releases once the budget is exhausted.","marker":"Rogers et al. 2016"},{"why":"Black-box memory-extraction attack that motivates the adaptive-query threat model the interface must resist.","marker":"Wang et al. 2025a"},{"why":"AirGapAgent, the app-facing defense adapted as the TaskMin baseline the experiments compare against.","marker":"Bagdasarian et al. 2024"},{"why":"MemPrivacy masking defense adapted as the TypedMask baseline, representing value-masking alternatives.","marker":"Chen et al. 2026"}],"fun_headline_variants":["Per-attribute ledger caps memory leaks in LLM agents","DP-MemView: privacy for whole LLM-agent conversations","Provable privacy for adaptive memory-conditioned responses","Capping attribute leaks across long-term LLM memory"],"cache_read_input_tokens":2816,"weakest_assumption_plain":"The load-bearing premise is that the read policy is content-independent—the memory positions consulted for a query are fixed by the public query, the memory layout, and the released history, never by what the stored memories say—because the paper states that content-dependent retrieval is not covered by the transcript-privacy theorem; the guarantee is additionally conditional on every position that may imply a protected attribute being included in that attribute's group.","fun_headline_variants_meta":{"raw":{"variants":["Per-attribute ledger caps memory leaks in LLM agents","DP-MemView: privacy for whole LLM-agent conversations","Provable privacy for adaptive memory-conditioned responses","Capping attribute leaks across long-term LLM memory"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000179,"raw_usage":{"total_tokens":1144,"prompt_tokens":757,"completion_tokens":387,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":501,"completion_tokens_details":{"reasoning_tokens":331}},"tokens_in":501,"tokens_out":387,"duration_ms":4848,"temperature":1.0,"reasoning_tokens":331,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T01:04:10.275914+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"For the theorem itself: on a small store where the full transcript distribution can be enumerated exactly, test every event $O$ for $\\Pr[\\tau_T \\in O \\mid M] \\leq e^{B_a} \\Pr[\\tau_T \\in O \\mid M']$; a single violating event would refute Theorem 1's composition claim. For the premise: implement a variant with content-dependent retrieval (for example, semantic-similarity search over private memory contents) while otherwise following the contract, and measure transcript distinguishability over a longer horizon—growing leakage with turn count would confirm the paper's explicit statement that such","supporting_citations":[],"review_version":1}