MemPrivacy - A privacy protection framework jointly developed by memory tensors and Honor AI.

What is MemPrivacy?

MemPrivacy is an open-source edge-cloud collaborative agent privacy protection framework jointly developed by the MemTensor team, the Honor AI team, and Tongji University. Addressing the privacy leakage risks in long-term cloud agent memory scenarios, it proposes a "local reversible pseudo-anonymization" scheme: the edge identifies sensitive information in user input and replaces it with semantically typed placeholders (such as...). <Email_1>,<Health_Info_1>The actual value mapping is stored in the local SQLite database; the cloud continues to perform inference, memory writing and retrieval based on placeholders; after being returned, it is restored to the actual content from the local database.

MemPrivacy's main functions

• Local reversible pseudo-anonymizationThe client-side identifies private fragments in user input and replaces them with semantically meaningful placeholders (such as...). <Email_1>,<Health_Info_1>The mapping between the real value and the placeholder is persistently stored in the local SQLite database. Only the placeholder is visible in the cloud, not the plaintext. After being sent back, the local database restores the real content.
• Four-level privacy classification system (PL1–PL4)Based on the criteria of identifiability, potential harm, and usability, privacy is divided into basic profile level (PL1), identity anchoring level (PL2), high-risk sensitive level (PL3), and critical core level (PL4), supporting users to freely configure desensitization thresholds and protection strategies.
• Three masking modes:type_specific Typed placeholders (preserve semantic roles, with optimal utility)generic Universal placeholders (more privacy-enhancing but less semantically meaningful)complete Completely delete sensitive segments (maximum privacy but lowest utility).
• Terminal-Cloud-Terminal Three-Stage ProcessUplink desensitization (local) → Cloud processing (inference/memory writing/tool call) → Downlink recovery (local), achieving architecture-level isolation, ensuring that cloud components never access the original sensitive values.
• Multi-specification end-side modelOpen source 0.6B, 1.7B, and 4B parameter versions (based on the Qwen3 series base), all providing SFT and RL training versions to adapt to different deployment needs from lightweight IoT to high-performance edge devices.
• MemPrivacy-Bench (Self-developed evaluation benchmark)It covers 200 synthetic users, bilingual (Chinese and English) multi-turn dialogues, and over 155,000 privacy items, supporting end-to-end evaluation of privacy extraction accuracy and memory system utility loss.
• Out-of-the-box evaluation kitIt has built-in end-to-end evaluation scripts for the three major memory systems: Mem0, LangMem, and Memobase, which can directly test the privacy-utility trade-off under different protection strategies.
• Low-latency local processingThe latency for privacy detection and de-identification of a single message is less than 1 second, making it suitable for seamless edge deployment without affecting the user's real-time interactive experience.
• Persistent mapping managementLocal SQLite database stores placeholder ↔ real value mappings across sessions, supporting continuous privacy protection in long-term agent memory scenarios.

How to use MemPrivacy

• Clone the repository and install dependencies:git clone https://github.com/MemTensor/MemPrivacy.gitCreate a virtual environment and execute pip install -r requirements.txt.
• Configure privacy framework parameters:edit src/privacy_config.yamlConfigure LLM API credentials, local SQLite database path, and mask level (e.g., ...). PL3,PL4).
• Configure evaluation kit parameters(Optional): Edit evaluation/eval_config.yamlConfigure the OpenAI API, memory system database connection (Mem0 / Memobase), and LLM for each role.
• Run the core desensitization process: call src/privacy_masking.py In mask_dialogue() Perform uplink desensitization, select mask mode (type_specific / generic / complete).
• Cloud InteractionThe anonymized text is sent to the cloud-based LLM/memory system, where the cloud performs inference and memory operations based on placeholders.
• Downward recovery: call unmask_dialogue() Use a local SQLite mapping table to restore the placeholders in the cloud response to their actual values.
• Runtime memory system evaluation(Optional): Execute python evaluation/eval_mem0.py / eval_langmem.py / eval_memobase.py Perform end-to-end benchmark testing.

MemPrivacy's project address

• GitHub repository: https://github.com/MemTensor/MemPrivacy
• HuggingFace model libraryhttps://huggingface.co/collections/IAAR-Shanghai/memprivacy
• arXiv technical paper: https://arxiv.org/pdf/2605.09530

MemPrivacy's technical principles

• Locally reversible pseudo-anonymization architectureThe system employs a three-stage process: "end-cloud-end". The end device is responsible for privacy detection and de-identification, local mapping and storage, and downlink recovery. The cloud only processes text with placeholders, achieving architectural-level isolation and ensuring that the original sensitive values never enter the cloud.
• Fine-grained privacy detection modelThis study trains a dedicated privacy extraction model based on the Qwen3 series platform. It learns privacy-preserving localization and substitution capabilities in 26K high-quality multi-turn dialogues through the SFT stage, and then optimizes the balance between recall and precision under fuzzy boundaries using GRPO reinforcement learning.
• Four-level privacy classification tree (PL1–PL4)A privacy grading system is constructed based on three dimensions: identifiability, potential harm, and usability. PL1 represents low-sensitivity preference profiles, PL2 represents identity anchoring information, PL3 represents high-risk sensitive data, and PL4 represents critical core credentials. This system supports users dynamically triggering protection based on policy thresholds.
• Semantic-preserving placeholder replacement mechanismReplace sensitive segments with typed placeholders (e.g., ...). <Email_1>,<Health_Info_1>Compared to traditional *** Mask or general <Mask_1>This preserves semantic role information, enabling the cloud-based agent to still understand the context based on type and perform reasoning, memory retrieval, and tool invocation.
• Local SQLite mapping persistenceEstablish an encrypted mapping database of placeholders and original real values on the client side, persistently store it across sessions, support bidirectional conversion in long-term memory scenarios, and the mapped data only resides locally and is not uploaded.
• Dynamic switching between three masking strategies:type_specific Patterns maximize semantic preservation and system utility;generic Patterns reduce the semantic exposure surface;complete The mode directly deletes sensitive segments, and users can flexibly choose according to their privacy level and scenario needs.

MemPrivacy's core advantages

• Privacy extraction accuracy significantly outpacedMemPrivacy-4B-RL achieves an F1 score of 85.97% on MemPrivacy-Bench, compared to only 35.50% for OpenAI privacy-filter, a lead of 50.47%; it also leads by nearly 9% on the cross-distribution dataset PersonaMem-v2.
• The system utility loss is extremely low.When protecting PL2-PL4, the accuracy of the memory system only decreases by 0.71%~1.60%; when protecting only PL4, the decrease is less than 0.89%, while traditional irreversible masks can cause a sharp drop of 16%~42%.
• Overpowering general-purpose large modelsEven when facing general models such as GPT-5.2, Gemini-3.1-Pro, and DeepSeek-V3.2-Think, MemPrivacy-4B and even the 0.6B micro version completely outperform the privacy extraction task.
• Fine-grained semantic preservationTyped placeholders allow the cloud agent to still understand the semantic structure, avoiding "agent amnesia" or task logic breaks.
• Low-latency edge deploymentThe single message processing latency is less than 1 second, making it suitable for seamless local deployment.
• Two-stage training strategyFirst, we master basic privacy-preserving localization and replacement through 26K high-quality multi-turn dialogue data (SFT). Then, we introduce GRPO reinforcement learning to optimize the balance between recall and precision under fuzzy boundaries.

Comparison of MemPrivacy's similar products

Application scenarios of MemPrivacy

• Enhanced privacy for edge-side smart assistantsProvides a local privacy filtering layer for mobile AI assistants, ensuring that user health and financial data are not transmitted in plaintext to the cloud.
• Enterprise-level Agent Compliance Deployment: Meet data compliance requirements in customer service agents and medical agents that involve customer PII.
• Long-term memory personal assistantProtect users' long-term memory data such as schedules, preferences, and home addresses, while retaining personalization capabilities.
• Privacy isolation for cross-border cloud servicesData from users in mainland China is anonymized locally before being processed in the cloud to meet compliance requirements for data export.
• Privacy protection research benchmarks: Use MemPrivacy-Bench to evaluate the privacy-utility trade-offs of different memory systems (Mem0, LangMem, Memobase).