MemPrivacy - A Privacy Protection Framework Jointly Open-Sourced by MemTensor and Honor AI

What is MemPrivacy

MemPrivacy is an end-cloud collaborative Agent privacy protection framework jointly open-sourced by the MemTensor team, the Honor AI team, and Tongji University. Targeting the risk of privacy leakage in long-term memory scenarios of cloud-based Agents, it proposes a "local reversible pseudonymization" solution: the device side identifies sensitive information in user input and replaces it with placeholders carrying semantic types (such as <Email_1>、<Health_Info_1>), while the mapping of real values is stored in a local SQLite database; the cloud continues to perform reasoning, memory writing, and retrieval based on the placeholders; after being returned, the local side restores them to the real content.

Main Features of MemPrivacy

• Local Reversible Pseudonymization: The device side identifies privacy fragments in user input and replaces them with placeholders carrying semantic types (such as <Email_1>、<Health_Info_1>). The mapping between real values and placeholders is persistently stored in a local SQLite database. The cloud only sees placeholders, not plaintext, and after being returned, the local side restores them to the real content.
• Four-Level Privacy Classification System (PL1–PL4): Using identifiability, potential harmfulness, and exploitability as criteria, privacy is divided into Basic Profile Level (PL1), Identity Anchoring Level (PL2), High-Risk Sensitive Level (PL3), and Fatal Core Level (PL4), supporting users to freely configure desensitization thresholds and protection policies.
• Three Masking Modes：type_specific Typed placeholders (preserving semantic roles, with the best utility),generic Generic placeholders (stronger privacy but weaker semantics),complete Complete deletion of sensitive fragments (strongest privacy but lowest utility).
• End-Cloud-End Three-Stage Process: Uplink desensitization (local) → Cloud processing (reasoning/memory writing/tool invocation) → Downlink restoration (local), achieving architectural-level isolation, with cloud components never touching the original sensitive values.
• Multi-Spec On-Device Models: Open-source 0.6B, 1.7B, and 4B parameter versions (based on the Qwen3 series foundation), all providing SFT and RL training versions, adapting to different deployment needs from lightweight IoT to high-performance on-device.
• Self-Developed Evaluation Benchmark MemPrivacy-Bench: Covering 200 synthetic users, Chinese-English bilingual multi-turn dialogues, and over 155,000 privacy items, supporting end-to-end evaluation of privacy extraction accuracy and memory system utility loss.
• Out-of-the-Box Evaluation Suite: Built-in end-to-end evaluation scripts for the three mainstream memory systems Mem0, LangMem, and Memobase, allowing direct testing of the privacy-utility trade-off under different protection policies.
• Low-Latency Local Processing: Privacy detection and desensitization latency for a single message is less than 1 second, suitable for seamless on-device deployment without affecting the user's real-time interaction experience.
• Persistent Mapping Management: The local SQLite database stores placeholder ↔ real value mappings across sessions, supporting continuous privacy protection in long-term Agent memory scenarios.

How to Use MemPrivacy

• Clone the repository and install dependencies：git clone https://github.com/MemTensor/MemPrivacy.git, create a virtual environment and execute pip install -r requirements.txt。
• Configure Privacy Framework Parameters: Edit src/privacy_config.yaml, set the LLM API credentials, the local SQLite database path, and the masking level (such as PL3、PL4）。
• Configure Evaluation Suite Parameters(optional): Edit evaluation/eval_config.yaml, configure the OpenAI API, memory system database connections (Mem0 / Memobase), and the LLMs for each role.
• Run the Core Desensitization Process: Calls src/privacy_masking.py in mask_dialogue() for uplink anonymization, selecting mask mode (type_specific / generic / complete）。
• Cloud interaction: Sends the anonymized text to the cloud LLM / memory system, and the cloud completes reasoning and memory operations based on placeholders.
• Downlink restoration: Calls unmask_dialogue() to restore placeholders in the cloud response to real values using the local SQLite mapping table.
• Run memory system evaluation(optional): Executes python evaluation/eval_mem0.py / eval_langmem.py / eval_memobase.py for end-to-end benchmarking.

MemPrivacy project address

• GitHub repository：https://github.com/MemTensor/MemPrivacy
• HuggingFace model hub：https://huggingface.co/collections/IAAR-Shanghai/memprivacy
• arXiv technical paper：https://arxiv.org/pdf/2605.09530

Technical principles of MemPrivacy

• Locally reversible pseudonymization architecture: Adopts a three-stage "end-cloud-end" process, where the device side handles privacy detection and anonymization, local mapping storage, and downlink restoration, while the cloud only processes text with placeholders, achieving architectural-level isolation and ensuring that original sensitive values never enter the cloud
• Fine-grained privacy detection model: Trains a dedicated privacy extraction model based on the Qwen3 series backbone, learning privacy localization and replacement capabilities from 26K high-quality multi-turn dialogues through the SFT stage, then optimizing the balance between recall and precision under ambiguous boundaries through GRPO reinforcement learning
• Four-level privacy classification tree (PL1–PL4): Builds a privacy grading system based on the three-dimensional indicators of identifiability, potential harm, and exploitability. PL1 is low-sensitivity preference profiling, PL2 is identity-anchoring information, PL3 is high-risk sensitive data, and PL4 is fatal core credentials. It supports users dynamically triggering protection according to policy thresholds
• Semantics-preserving placeholder replacement mechanism: Replaces sensitive segments with typed placeholders (such as <Email_1>、<Health_Info_1>). Compared with traditional *** masking or generic <Mask_1>, it preserves semantic role information, enabling the cloud Agent to still understand context based on types and complete reasoning, memory retrieval, and tool invocation
• Local SQLite mapping persistence: Establishes an encrypted mapping database of placeholders ↔ original real values on the device side, persistently stored across sessions, supporting bidirectional conversion in long-term memory scenarios, and the mapping data resides only locally and is not uploaded
• Dynamic switching among three masking strategies：type_specific mode maximizes semantic preservation and system utility;generic mode reduces the surface of semantic exposure;complete mode directly deletes sensitive segments, and users can flexibly choose according to privacy level and scenario requirements

Core advantages of MemPrivacy

• Privacy extraction accuracy is far ahead: MemPrivacy-4B-RL achieves an F1 of 85.97% on MemPrivacy-Bench, while OpenAI privacy-filter achieves only 35.50%, leading by 50.47%; it still leads by nearly 9% on the cross-distribution dataset PersonaMem-v2.
• Extremely low system utility loss: When protecting PL2-PL4, memory system accuracy drops by only 0.71%~1.60%; when protecting only PL4, the drop is below 0.89%, whereas traditional irreversible masking causes a sharp drop of 16%~42%.
• Crushing general large models across tiers: Even against general models such as GPT-5.2, Gemini-3.1-Pro, and DeepSeek-V3.2-Think, MemPrivacy-4B and even the 0.6B mini version achieve crushing performance on privacy extraction tasks.
• Fine-grained semantic preservation: Typed placeholders allow cloud Agents to still understand semantic structure, avoiding "Agent amnesia" or breaks in task logic.
• Low-latency on-device deployment: Single-message processing latency is less than 1 second, suitable for seamless local deployment.
• Two-stage training strategy: First, master basic privacy localization and replacement through 26K high-quality multi-turn dialogue data SFT, then introduce GRPO reinforcement learning to optimize the balance between recall and precision under fuzzy boundaries.

Comparison of MemPrivacy with similar competitors

Application scenarios of MemPrivacy

• Privacy enhancement for on-device intelligent assistants: Provides a local privacy filtering layer for mobile AI assistants, ensuring that users' health and financial data are not uploaded to the cloud in plaintext.
• Compliant deployment of enterprise-level Agents: Meets data compliance requirements in customer service Agents and medical Agents involving customer PII.
• Long-term memory personal assistants: Protects long-term memory data such as users' schedules, preferences, and home addresses while retaining personalization capabilities.
• Privacy isolation for cross-border cloud services: Mainland China user data is desensitized locally before being uploaded to the cloud for processing, meeting data export compliance requirements.
• Privacy-preserving research benchmarking: Uses MemPrivacy-Bench to evaluate the privacy-utility trade-offs of different memory systems (Mem0, LangMem, Memobase).