MemLeak: Diagnosing Information Leaks in Multimodal Agent Memory

• URL: http://arxiv.org/abs/2606.29788v1
• Date: Mon, 29 Jun 2026 05:07:02 GMT
• Title: MemLeak: Diagnosing Information Leaks in Multimodal Agent Memory
• Abstract summary: When a multimodal AI agent is asked to forget a fact, current memory systems usually delete the text entry and report success.<n>We find that the fact can remain recoverable from retained user images, including images tagged to entirely different facts.<n>We introduce the Information Provenance Graph (IPG), a taxonomy that classifies memory representations by deletion affordance.
• Score: 12.853875632489114
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: When a multimodal AI agent is asked to forget a fact, current memory systems usually delete the text entry and report success. We find that the fact can remain recoverable from retained user images, including images tagged to entirely different facts, because VLMs use implicit visual cues at inference time. We introduce the Information Provenance Graph (IPG), a taxonomy that classifies memory representations by deletion affordance. The IPG reveals that deletion fails through multiple channels. Our benchmark, MemLeak, measures this across a deletion cascade: direct probing of deletion-capable systems yields <1%, but retained correlated text enables 18.3% recovery, and retained images enable 12.0% recovery (0.0% blind baseline, 0.3% FPR) -- with 47% of image leaks not text-recoverable. Content-aware semantic deletion reduces the image residual to 2.0%. The residual appears across multiple VLMs, a production memory system, and real Unsplash-licensed photographs. Dual-annotator human validation (kappa = 0.88) confirms judge reliability.

Related papers

• Restore What Matters: Lessons from Joint Restoration and Recognition [72.91692240810536]
  Recognition pipelines typically adopt a restore-then-recognize workflow, yet decades of experience show that generating visually pleasing images seldom to improved recognition.<n>We propose a Joint Restoration-for-Recognition paradigm: restore only what downstream tasks truly require, with task signals dictating where, how much, and whether restoration is necessary.<n>We conclude that better-looking images are neither necessary nor sufficient; restoration modules must be task-driven, selective, and physically aware.
  arXiv  Detail & Related papers  (2026-09-12T08:08:08Z)
• Does Video Memory Use What It Retrieves? A Causal Audit of Memory Specificity [38.098764596232996]
  Video models increasingly use memory to preserve information over long sequences.<n>Standard memory ablations test whether memory helps, but not whether the retrieved content is responsible.<n>We test this directly with read-time memory substitution.
  arXiv  Detail & Related papers  (2026-09-10T18:16:32Z)
• Forgetting Without Restarting: Execution-State Unlearning for Stateful LLM Agents [12.985773309621964]
  Provenance-Guided Selective Replay attains bound as a cross-layer contract spanning prompt, compressed memory, and cache.<n>We audit with elicitation, cache, and string-free behavioral tests across three agent suites, nine baselines, and three model families.
  arXiv  Detail & Related papers  (2026-09-04T08:31:40Z)
• Do You Remember? Toward Memory-Centric Multimodal AI [0.0]
  We present DoYouRemember, a three-stage architecture introducing reconstructive memory into MLLMs.<n>On 1,000 3D facial skin texture maps and 99,000 unlabeled facial images, we find that LLM hidden states contain approximately zero recoverable visual information.<n>We unify these findings under an information-theoretic framework: memory is lossy compression, recall is decompression, and hallucination is an inherent property of lossy decompression rather than a defect.
  arXiv  Detail & Related papers  (2026-07-07T19:07:27Z)
• Deployment-Time Memorization in Foundation-Model Agents [18.40535884093806]
  We study agent memory as a privacy-utility frontier measured by Personalization Recall (PR) and Adrial Extraction Rate (AER)<n>Key-fact summarization reduces canary extraction by 76% on Gemma 3 12B and 64% on GPT-4o-mini while preserving nearly all personalization recall.<n>On LongMemEval, key-fact summarization reduces canary extraction by 76% on Gemma 3 12B and 64% on GPT-4o-mini while preserving nearly all personalization recall.
  arXiv  Detail & Related papers  (2026-06-08T18:38:41Z)
• MemMark: State-Evolution Attribution Watermarking for Agent Long-Term Memory Systems [13.133650395551507]
  Memory-backed agents need provenance that can survive leaked or migrated snapshots.<n>MemMark embeds an owner-controlled signal into latent memory-write decisions.<n>MemMark is feasible for long-term agent memory without surviving traces, trusted metadata, or utility-degrading.
  arXiv  Detail & Related papers  (2026-05-24T11:04:35Z)
• Before Forgetting, Learn to Remember: Revisiting Foundational Learning Failures in LVLM Unlearning Benchmarks [17.78493115982036]
  Large Vision-Language Models (LVLMs) pose privacy risks by unintentionally memorizing sensitive personal information.<n>We introduce ReMem, a Reliable Multi-hop and Multi-image Memorization Benchmark.<n>We show that ReMem provides a rigorous and trustworthy framework for diagnosing both learning and unlearning behaviors in LVLMs.
  arXiv  Detail & Related papers  (2026-05-05T13:42:31Z)
• Evoking User Memory: Personalizing LLM via Recollection-Familiarity Adaptive Retrieval [59.295767860331004]
  RF-Mem is a familiarity uncertainty-guided dual-path memory retriever.<n>It embeds human-like dual-process recognition into the retriever.<n>It consistently outperforms one-shot retrieval and full-context reasoning under fixed budget and latency constraints.
  arXiv  Detail & Related papers  (2026-03-10T06:31:44Z)
• The Illusion of Forgetting: Attack Unlearned Diffusion via Initial Latent Variable Optimization [51.835894707552946]
  Unlearning-based defenses claim to purge Not-Safe-For-Work concepts from diffusion models (DMs)<n>We show that unlearning partially disrupts the mapping between linguistic symbols and the underlying knowledge, which remains intact as dormant memories.<n>We propose IVO, a concise and powerful attack framework that reactivates these dormant memories by reconstructing the broken mappings.
  arXiv  Detail & Related papers  (2026-01-30T02:39:51Z)
• Agentic Learner with Grow-and-Refine Multimodal Semantic Memory [50.81667005063605]
  ViLoMem is a dual-stream memory framework that constructs compact, schema-based memory.<n>It encodes visual distraction patterns and logical reasoning errors, enabling MLLMs to learn from their successful and failed experiences.
  arXiv  Detail & Related papers  (2025-11-26T18:55:08Z)
• CIMemories: A Compositional Benchmark for Contextual Integrity of Persistent Memory in LLMs [62.116710797795314]
  Large Language Models (LLMs) increasingly use persistent memory from past interactions to enhance personalization and task performance.<n>We present CIMemories, a benchmark for evaluating whether LLMs appropriately control information flow from memory based on task context.
  arXiv  Detail & Related papers  (2025-11-18T21:51:23Z)
• Finding Dori: Memorization in Text-to-Image Diffusion Models Is Not Local [55.33447817350623]
  Recent mitigation efforts have focused on identifying and pruning weights responsible for triggering verbatim training data replication.<n>We challenge this assumption and demonstrate that, even after such pruning, small perturbations to the text embeddings of previously mitigated prompts can re-trigger data replication.<n>Our findings provide new insights into the nature of memorization in text-to-image DMs and inform the development of more reliable mitigations against DM memorization.
  arXiv  Detail & Related papers  (2025-07-22T15:02:38Z)
• Instruct-ReID: A Multi-purpose Person Re-identification Task with Instructions [62.86799046733196]
  We propose a new instruct-ReID task that requires the model to retrieve images according to the given image or language instructions.<n>Our instruct-ReID is a more general ReID setting, where existing 6 ReID tasks can be viewed as special cases by designing different instructions.<n> Experimental results show that the proposed multi-purpose ReID model, trained on our OmniReID benchmark without fine-tuning, can improve +0.5%, +0.6%, +7.7% mAP on Market1501, MSMT17, CUHK03 for traditional ReID, +6.4%, +7.1%, +11.2% mAP on PRCC,
  arXiv  Detail & Related papers  (2023-06-13T03:25:33Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.