Position: Privacy Is Not Just Memorization!
Not on the map. Why?
Abstract (arXiv)
The discourse on privacy risks in Large Language Models (LLMs) has disproportionately focused on verbatim memorization of training data, while a constellation of more immediate and scalable privacy threats remain underexplored. This position paper argues that the privacy landscape of LLM systems extends far beyond training data extraction, encompassing risks from data collection practices, inference-time context leakage, autonomous agent capabilities, and the democratization of surveillance through deep inference attacks. We present a comprehensive taxonomy of privacy risks across the LLM lifecycle -- from data collection through deployment -- and demonstrate through case studies how current privacy frameworks fail to address these multifaceted threats. Through a longitudinal analysis of 1,322 AI/ML privacy papers published at leading conferences over the past decade (2016--2025), we reveal that while memorization receives outsized attention in technical research, the most pressing privacy harms lie elsewhere, where current technical approaches offer little traction and viable paths forward remain unclear. We call for a fundamental shift in how the research community approaches LLM privacy, moving beyond the narrow focus of current technical solutions and embracing interdisciplinary approaches that address the sociotechnical nature of these emerging threats.
Key facts. Cited by 17 papers in the map (data through 14 Oct 2026). Builds on 59 of its 112 references that are in the map. First posted on arXiv 2 Oct 2025.
Builds on
59 of 112 references.
References · 59
- 2020Language Models are Few-Shot Learnerscited by 32,419
- 2022Training language models to follow instructions with human feedbackcited by 15,971
- 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
- 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
- 2021On the Opportunities and Risks of Foundation Modelscited by 4,033
- 2024Gemini 1.5: Unlocking multimodal understanding across millions of tokens of contextcited by 3,224
- 2016Deep Learning with Differential Privacycited by 2,728
- 2020Extracting Training Data from Large Language Modelscited by 2,189
- 2023MemGPT: Towards LLMs as Operating Systemscited by 1,389
- 2022Quantifying Memorization Across Neural Language Modelscited by 763
- 2016Stealing Machine Learning Models via Prediction APIscited by 619
- 2025Zep: A Temporal Knowledge Graph Architecture for Agent Memorycited by 400
38 more
- 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Modelscited by 267
- 2023Can LLMs Keep a Secret? Testing Privacy Implications of Language Models via Contextual Integrity Theorycited by 230
- 2023Beyond Memorization: Violating Privacy Via Inference with Large Language Modelscited by 175
- 2025Emergent Misalignment: Narrow finetuning can produce broadly misaligned LLMscited by 172
- 2024PrivacyLens: Evaluating Privacy Norm Awareness of Language Models in Actioncited by 171
- 2023Taken out of context: On measuring situational awareness in LLMscited by 143
- 2025Subliminal Learning: Language models transmit behavioral traits via hidden signals in datacited by 95
- 2024AirGapAgent: Protecting Privacy-Conscious Conversational Agentscited by 94
- 2025AgentDAM: Privacy Leakage Evaluation for Autonomous Web Agentscited by 82
- 2024Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agentscited by 65
- 2024Protecting Privacy in Multimodal Large Language Models with MLLMU-Benchcited by 64
- 2023"It's a Fair Game", or Is It? Examining How Users Navigate Disclosure Risks and Benefits When Using LLM-Based Conversational Agentscited by 60
- 2025The Obvious Invisible Threat: LLM-Powered GUI Agents' Vulnerability to Fine-Print Injectionscited by 59
- 2024PAPILLON: Privacy Preservation from Internet-based and Local Language Model Ensemblescited by 57
- 2024Demystifying Verbatim Memorization in Large Language Modelscited by 56
- 2023Reducing Privacy Risks in Online Self-Disclosures with Language Modelscited by 47
- 2024Trust No Bot: Discovering Personal Disclosures in Human-LLM Conversations in the Wildcited by 47
- 2024GoldCoin: Grounding Large Language Models in Privacy Laws via Contextual Integrity Theorycited by 37
- 2025PrivaCI-Bench: Evaluating Privacy with Contextual Integrity and Legal Compliancecited by 37
- 2024CopyBench: Measuring Literal and Non-Literal Reproduction of Copyright-Protected Text in Language Model Generationcited by 35
- 2023Split-and-Denoise: Protect large language model inference with local differential privacycited by 32
- 2024When LLMs Go Online: The Emerging Threat of Web-Enabled LLMscited by 24
- 2024Large Language Model Supply Chain: A Research Agendacited by 23
- 2024Data Extraction Attacks in Retrieval-Augmented Generation via Backdoorscited by 23
- 2024Granular Privacy Control for Geolocation with Vision Language Modelscited by 21
- 2024SOPHON: Non-Fine-Tunable Learning to Restrain Task Transferability For Pre-trained Modelscited by 17
- 20251-2-3 Check: Enhancing Contextual Privacy in LLM via Multi-Agent Reasoningcited by 17
- 2024Rescriber: Smaller-LLM-Powered User-Led Data Minimization for LLM-Based Chatbotscited by 16
- 2025Dark Patterns Meet GUI Agents: LLM Agent Susceptibility to Manipulative Interfaces and the Role of Human Oversightcited by 16
- 2024On the (In)Security of LLM App Storescited by 14
- 2024Privacy Leakage Overshadowed by Views of AI: A Study on Human Oversight of Privacy in Language Model Agentcited by 14
- 2024WebLLM: A High-Performance In-Browser LLM Inference Enginecited by 14
- 2024Privacy in Fine-tuning Large Language Models: Attacks, Defenses, and Future Directionscited by 14
- 2025Understanding and Mitigating Cross-lingual Privacy Leakage via Language-specific and Universal Privacy Neuronscited by 13
- 2025Malicious LLM-Based Conversational AI Makes Users Reveal Personal Informationcited by 13
- 2024Evaluating LLM-based Personal Information Extraction and Countermeasurescited by 12
- 2024"Ghost of the past": identifying and resolving privacy leakage from LLM's memory through proactive user interactioncited by 10
- 2025Privacy Ripple Effects from Adding or Removing Personal Information in Language Model Trainingcited by 10
50 most cited of 59 All 59 (JSON)
Built on by
Citing papers per year: 2025: 2; 2026: 15.
17 papers.
Sort:
By area:
- 2026A Survey of Agent Memory in the Second Half: Towards Self-Evolving and Long-Horizon Agentscited by 44
- 2026Large-scale online deanonymization with LLMscited by 14
- 2025Agent Tools Orchestration Leaks More: Dataset, Benchmark, and Mitigationcited by 11
- 2026Agentic LLMs as Powerful Deanonymizers: Re-identification of Participants in the Anthropic Interviewer Datasetcited by 7
- 2026SuperLocalMemory: Privacy-Preserving Multi-Agent Memory with Bayesian Trust Defense Against Memory Poisoningcited by 7
- 2026Privacy Collapse: Benign Fine-Tuning Can Break Contextual Privacy in Language Modelscited by 6
- 2026MPCI-Bench: A Benchmark for Multimodal Pairwise Contextual Integrity Evaluation of Language Model Agentscited by 2
- 2026PrivacyAlign: Contextual Privacy Alignment for LLM Agentscited by 2
- 2025Black Box Absorption: LLMs Undermining Innovative Ideascited by 1
- 2026Large Language Models in the Abuse Detection Pipelinecited by 1
- 2026Behavioral Transfer in AI Agents: Evidence and Privacy Implicationscited by 0
- 2026Reconstruction of Personally Identifiable Information from Proprietary Data in Supervised Fine-Tuned Modelscited by 0
5 more
- 2026LLM Anonymization Against Agentic Re-Identificationcited by 0
- 2026Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agentscited by 0
- 2026PANOPTICON: A PII-Based Assemblage of Naturalistic Output Tokens for Investigating Privacy Leakage Within LLM Context Windowcited by 0
- 2026Privacy in Personalized AI Is a System Property, Not Just a Model Propertycited by 0
- 2026AgentDoxx: Agentic Re-identification of Anonymized Text with Web Searchcited by 0
- 2026AgentDoxx: Agentic Re-identification of Anonymized Text with Web Search4 Oct 2026
- 2026Privacy in Personalized AI Is a System Property, Not Just a Model Property29 Sep 2026
- 2026PANOPTICON: A PII-Based Assemblage of Naturalistic Output Tokens for Investigating Privacy Leakage Within LLM Context Window17 Jul 2026
- 2026Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents25 Jun 2026
- 2026PrivacyAlign: Contextual Privacy Alignment for LLM Agents19 Jun 2026
- 2026LLM Anonymization Against Agentic Re-Identification29 May 2026
- 2026Reconstruction of Personally Identifiable Information from Proprietary Data in Supervised Fine-Tuned Models12 May 2026
- 2026Behavioral Transfer in AI Agents: Evidence and Privacy Implications21 Apr 2026
- 2026Large Language Models in the Abuse Detection Pipeline31 Mar 2026
- 2026Large-scale online deanonymization with LLMs18 Feb 2026
- 2026SuperLocalMemory: Privacy-Preserving Multi-Agent Memory with Bayesian Trust Defense Against Memory Poisoning17 Feb 2026
- 2026Privacy Collapse: Benign Fine-Tuning Can Break Contextual Privacy in Language Models21 Jan 2026
5 more
- 2026A Survey of Agent Memory in the Second Half: Towards Self-Evolving and Long-Horizon Agents14 Jan 2026
- 2026MPCI-Bench: A Benchmark for Multimodal Pairwise Contextual Integrity Evaluation of Language Model Agents13 Jan 2026
- 2026Agentic LLMs as Powerful Deanonymizers: Re-identification of Participants in the Anthropic Interviewer Dataset9 Jan 2026
- 2025Agent Tools Orchestration Leaks More: Dataset, Benchmark, and Mitigation18 Dec 2025
- 2025Black Box Absorption: LLMs Undermining Innovative Ideas23 Oct 2025
- 2026A Survey of Agent Memory in the Second Half: Towards Self-Evolving and Long-Horizon Agentscited by 44
- 2025Agent Tools Orchestration Leaks More: Dataset, Benchmark, and Mitigationcited by 11
- 2026Agentic LLMs as Powerful Deanonymizers: Re-identification of Participants in the Anthropic Interviewer Datasetcited by 7
- 2026SuperLocalMemory: Privacy-Preserving Multi-Agent Memory with Bayesian Trust Defense Against Memory Poisoningcited by 7
- 2026MPCI-Bench: A Benchmark for Multimodal Pairwise Contextual Integrity Evaluation of Language Model Agentscited by 2
- 2026PrivacyAlign: Contextual Privacy Alignment for LLM Agentscited by 2
- 2026Behavioral Transfer in AI Agents: Evidence and Privacy Implicationscited by 0
- 2026LLM Anonymization Against Agentic Re-Identificationcited by 0
- 2026Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agentscited by 0
- 2026AgentDoxx: Agentic Re-identification of Anonymized Text with Web Searchcited by 0
- 2026AgentDoxx: Agentic Re-identification of Anonymized Text with Web Search4 Oct 2026
- 2026Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents25 Jun 2026
- 2026PrivacyAlign: Contextual Privacy Alignment for LLM Agents19 Jun 2026
- 2026LLM Anonymization Against Agentic Re-Identification29 May 2026
- 2026Behavioral Transfer in AI Agents: Evidence and Privacy Implications21 Apr 2026
- 2026SuperLocalMemory: Privacy-Preserving Multi-Agent Memory with Bayesian Trust Defense Against Memory Poisoning17 Feb 2026
- 2026A Survey of Agent Memory in the Second Half: Towards Self-Evolving and Long-Horizon Agents14 Jan 2026
- 2026MPCI-Bench: A Benchmark for Multimodal Pairwise Contextual Integrity Evaluation of Language Model Agents13 Jan 2026
- 2026Agentic LLMs as Powerful Deanonymizers: Re-identification of Participants in the Anthropic Interviewer Dataset9 Jan 2026
- 2025Agent Tools Orchestration Leaks More: Dataset, Benchmark, and Mitigation18 Dec 2025
- 2026Large-scale online deanonymization with LLMscited by 14
- 2026Privacy Collapse: Benign Fine-Tuning Can Break Contextual Privacy in Language Modelscited by 6
- 2025Black Box Absorption: LLMs Undermining Innovative Ideascited by 1
- 2026Large Language Models in the Abuse Detection Pipelinecited by 1
- 2026Reconstruction of Personally Identifiable Information from Proprietary Data in Supervised Fine-Tuned Modelscited by 0
- 2026PANOPTICON: A PII-Based Assemblage of Naturalistic Output Tokens for Investigating Privacy Leakage Within LLM Context Windowcited by 0
- 2026Privacy in Personalized AI Is a System Property, Not Just a Model Propertycited by 0
- 2026Privacy in Personalized AI Is a System Property, Not Just a Model Property29 Sep 2026
- 2026PANOPTICON: A PII-Based Assemblage of Naturalistic Output Tokens for Investigating Privacy Leakage Within LLM Context Window17 Jul 2026
- 2026Reconstruction of Personally Identifiable Information from Proprietary Data in Supervised Fine-Tuned Models12 May 2026
- 2026Large Language Models in the Abuse Detection Pipeline31 Mar 2026
- 2026Large-scale online deanonymization with LLMs18 Feb 2026
- 2026Privacy Collapse: Benign Fine-Tuning Can Break Contextual Privacy in Language Models21 Jan 2026
- 2025Black Box Absorption: LLMs Undermining Innovative Ideas23 Oct 2025