MemPrivacy – Open Edge-Cloud Agent Privacy Framework by MemTensor and Honor AI

1. What Is MemPrivacy

MemPrivacy is an open edge-cloud Agent privacy framework co-developed by MemTensor, Honor AI, and Tongji University. For cloud Agents with long-term memory, it introduces locally reversible pseudo-anonymization: the device detects private spans in user input, replaces them with typed placeholders (e.g., <Email_1>, <Health_Info_1>), and stores real-value↔placeholder mappings in local SQLite; the cloud reasons and writes memory using placeholders only; the device restores real content on return. Cloud semantic capability is preserved with architectural privacy isolation.

Technical positioning and domain: AI × privacy computing for edge-cloud Agent memory. Reversible anonymization in Agent memory balances privacy and utility vs. irreversible masking or never uploading.

Research background: MemTensor (AI memory systems), Honor AI (on-device deployment), Tongji University (research). Motivation: health, identity, and financial data in cloud memory faces leakage; blunt blocking or coarse masking hurts personalization.

Core value: Resolves privacy vs. utility—typed placeholders keep semantic roles for cloud understanding; local reversible mapping means "cloud never sees plaintext, device controls restore"; four-level privacy tiers (PL1–PL4) for configurable policy.

Technical characteristics: Qwen3-based privacy extraction models at 0.6B, 1.7B, 4B with SFT + GRPO—privacy extraction accuracy beats general models like GPT-5.2; MemPrivacy-Bench with 200 synthetic users, bilingual multi-turn dialogues, 155K+ privacy items for end-to-end evaluation.

2. Key Features

• Local reversible pseudo-anonymization: Real-time detection and typed placeholder replacement; mappings in local SQLite; cloud sees placeholders only; restore on response—architectural isolation.

• Four-tier privacy taxonomy (PL1–PL4): Based on identifiability, harm, and exploitability—basic profile (PL1), identity anchor (PL2), high-risk sensitive (PL3), critical core (PL4). Configure thresholds e.g. mask PL2+ for flexible privacy–utility tradeoffs.

• Three masking modes: type_specific typed placeholders (best utility); generic (<Mask_1>, stronger privacy, weaker semantics); complete deletion (strongest privacy, lowest utility). Switch by scenario.

• Edge–cloud–edge pipeline: Local mask → cloud infer/memory/tools → local unmask. Cloud never touches raw secrets; breach exposes meaningless placeholders.

• Multi-size on-device models: Open 0.6B, 1.7B, 4B (Qwen3 base) with SFT and RL variants—0.6B for light IoT, 4B for flagship phones.

• MemPrivacy-Bench: 200 users, bilingual dialogues, 155K+ items; scripts for Mem0, LangMem, Memobase to measure privacy–utility tradeoffs.

• Low-latency local processing: Per-message detect-and-mask under one second on mobile—optimized pipeline for seamless UX.

• Persistent mapping management: SQLite holds placeholder↔value maps across sessions; local only, optional encryption.

3. How to Use

1. Requirements: Python 3.9+, Linux or macOS recommended. GPU with ≥8 GB VRAM for 4B; 0.6B runs on CPU. Git and pip installed.

2. Clone and install: git clone https://github.com/MemTensor/MemPrivacy.git, create venv, pip install -r requirements.txt (PyTorch, Transformers, SQLite, etc.).

3. Configure privacy framework: Edit src/privacy_config.yaml—LLM API keys, SQLite path (e.g., ./data/mapping.db), mask level (e.g., mask_level: PL3), mode (type_specific / generic / complete).

4. Evaluation config (optional): Edit evaluation/eval_config.yaml for OpenAI keys, Mem0/Memobase DB, and role LLM names.

5. Run masking: Call mask_dialogue() in src/privacy_masking.py—e.g., masked_text, mapping = mask_dialogue(user_input, mode='type_specific', mask_level='PL3').

6. Cloud interaction: Send masked text to cloud LLM or memory systems—no extra cloud config; placeholders are plain text.

7. Unmask responses: original_response = unmask_dialogue(cloud_response, db_path='./data/mapping.db').

8. Benchmarks (optional): Run python evaluation/eval_mem0.py, eval_langmem.py, or eval_memobase.py for F1 and utility loss metrics.

4. Pros and Cons

5. Comparison with Similar Tools

Selection advice: For long-memory cloud Agents (personal assistants, medical bots), MemPrivacy is optimal—reversible typed placeholders with ~1% utility loss beat traditional masking for regulated finance/healthcare with flexible PL tiers. For simple PII scrubbing pipelines, Presidio is lighter but irreversible and hurts Agent semantics. OpenAI privacy-filter suits low-stakes filtering only given 35.50% F1 and high utility loss.

6. Editor's Take

MemPrivacy makes a real breakthrough on the privacy–utility tradeoff in Agent memory. Irreversible masks cause "Agent amnesia"; typed placeholders preserve roles while local maps enable safe restore—a strong privacy-computing design.

Benchmarks convince: 85.97% F1 vs. 35.50%, utility loss ~1% vs. 16%–42%. Multi-size models fit IoT through flagship phones.

Audience: On-device assistant teams, enterprise Agent compliance (GDPR, etc.), privacy researchers using MemPrivacy-Bench, long-memory personal assistant builders. Chinese users should benchmark or fine-tune.

Future: Smaller edge models (0.3B), more languages, native LangChain/AutoGPT hooks. As edge Agents and regulation tighten, reversible pseudo-anonymization becomes essential infrastructure.

Strong innovation and utility; minor deductions for non-disruptive architecture novelty and Chinese coverage.

7. Use Cases

• On-device assistant privacy: Filter health and financial data locally—mask PL3+ while keeping personalization from lower tiers.

• Enterprise Agent compliance: Customer service and medical Agents meet GDPR/HIPAA with PL2+ masking for identity anchors while allowing benign profile signals.

• Long-memory personal assistants: Remember schedules and preferences; mask child names and addresses as placeholders while cloud knows "weekly Tuesday pickup" without raw PII.

• Cross-border cloud isolation: Mainland users mask before cloud processing—e.g., mask door numbers, restore locally after cross-border inference.

• Privacy research: MemPrivacy-Bench compares Mem0, LangMem, Memobase with one-click scripts and standardized privacy–utility reports.

8. FAQ

Q: vs. Presidio and classic PII tools?
A: Reversibility and semantics. Irreversible [EMAIL] breaks cloud context; <Email_1> preserves role and restores locally—utility loss ~1% vs. 16%–42%.

Q: Hardware requirements?
A: 0.6B CPU, 4 GB+ RAM; 1.7B ~4 GB VRAM; 4B ~8 GB VRAM (e.g., T4). Under 1 s per message on device. Benchmarks: 16 GB VRAM recommended.

Q: Languages?
A: Chinese and English; ~30% Chinese in training—evaluate Chinese before production; fine-tune if needed.

Q: SQLite mapping security?
A: Optional encrypted SQLite; maps stay local. Enable device encryption; prune stale entries. Malware on device remains a threat—combine with endpoint security.

Q: Integrate with existing Agent frameworks?
A: Yes—Python middleware: mask_dialogue() before Agent, unmask_dialogue() after. Mem0/LangMem/Memobase eval scripts are reference implementations.

Q: Choosing masking modes?
A: type_specific for max Agent performance; generic for stronger privacy with some semantics; complete for strictest privacy. Mix by tier e.g. type_specific on PL2, complete on PL4.

9. Project Links

• GitHub: https://github.com/MemTensor/MemPrivacy
• Hugging Face models: https://huggingface.co/collections/IAAR-Shanghai/memprivacy
• arXiv paper: https://arxiv.org/pdf/2605.09530