Cloud agents typically send user messages to remote LLMs and store conversation traces in memory systems (e.g., Mem0, LangMem, Memobase) for long-term personalization. This creates a large privacy attack surface: plaintext prompts and logs may contain PII, medical/financial data, credentials
cloud memory stores can leak via retrieval, prompt injection, inversion, or misconfiguration
naïve mitigation (e.g., *** masking) destroys task semantics, harming retrieval and personalization Goal: reduce privacy leakage without sacrificing utility.