Most people don't even know their AI assistant is quietly remembering or guessing things about them.
What interface controls best address retention concerns about inferred data?
This explores which design choices give people real control over what an AI assistant remembers or guesses about them, such as edit buttons, deletion tools, or prompts at the moment something gets saved, and which of these the research says users prefer.
This explores which interface controls help people manage what an AI assistant remembers or guesses about them. The short answer from the corpus: controls that act at the moment something gets saved work better than tools for reviewing records afterward. A large part of the problem, though, is that people don't realize anything is being stored at all.
Start with awareness. In one study of 40 participants, more than 30 never noticed their LLM's memory feature or the private details it had inferred about them, until a researcher pointed it out. After that, every participant wanted the ability to edit and delete Do users notice when LLMs infer and retain private information?. Interviews with 18 ChatGPT users help explain this. People hold four incompatible ideas of what 'memory' means: it lasts only for the session, it feeds into training data, the model is actively processing information about them, or they simply don't know. Each idea leads to different privacy behavior What mental models do users hold about LLM memory?. So no single control solves retention. If a user thinks memory disappears when the chat ends, a 'delete' button will never occur to them.
On which controls work, the clearest evidence comes from a speed-dating study in which 121 users tried 12 memory-control designs. Proactive controls won clearly. These included destination prompts, which ask where a piece of information should go when it's captured, and boundary settings, which declare in advance what's off-limits. Passive audits and detailed inspection views, such as causal graphs showing why the model remembered something, did worse Do users prefer controlling what gets remembered over auditing what was stored?. People would rather prevent a bad memory than investigate one. This shifts the design question from 'how do we show users everything we stored?' to 'how do we let them steer what gets stored as it happens?'
There's a twist the interface layer can't fully fix. Private data can show up in places no memory panel covers. One analysis found that 74.8% of privacy leaks in reasoning models came from the model recalling sensitive user details inside its own reasoning, the step-by-step thinking text it writes before answering. Longer reasoning made the leakage worse, and scrubbing the reasoning afterward hurt the model's performance. That suggests the model uses the private data as working material, not just as something it stores Do reasoning traces actually expose private user data?. A delete button on a memory list doesn't reach this.
The corpus is thin here. It has strong evidence on user preferences and awareness, but almost nothing on how well controls actually work: whether deletion really removes inferred data, how long retention lasts, or how controls hold up over months of use. The takeaway for a curious reader is to design for the moment of capture first, to make memory visible before offering ways to manage it, and to recognize that 'inferred data' can live in places that memory settings don't cover.
Sources 4 notes
A 40-participant study found 30+ users never noticed their LLM's memory feature or inferred private information within it. Once shown the risk, all participants wanted editing and deletion controls, citing privacy as the primary concern.
Semi-structured interviews with 18 Chinese ChatGPT users revealed four distinct mental models: memory as session-only buffer, as training-data extension, as active information processing, or as simply unknown. These models directly influence privacy awareness and user behavior.
A speed-dating evaluation of 12 memory-control designs with 121 users found clear preference for proactive controls like destination prompts and boundary settings over passive audits or causal graph inspections. Users prioritize preventing misalignment at the moment of capture over reviewing complete records after the fact.
74.8% of privacy leaks in language model reasoning traces result from models materializing sensitive user data during thought processes. Longer reasoning chains amplify leakage, and anonymizing traces post-hoc degrades model utility, suggesting private data functions as cognitive scaffolding.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- Understanding Users' Privacy Perceptions Towards LLM's RAG-based Memory
- "Ghost of the past": identifying and resolving privacy leakage from LLM's memory through proactive user interaction
- When Are LLM Inferences Acceptable? User Reactions and Control Preferences for Inferred Personal Information
- Relational Gains, Privacy Strains: Exploring Users' Perceptions and Experiences with ChatGPT's Memory Feature
- The Algorithmic Self-Portrait: Deconstructing Memory in ChatGPT
- Characterizing Memory Misalignment in Human-LLM Interaction From User Perspectives
- Assessing and Mitigating Data Memorization Risks in Fine-Tuned Large Language Models
- Privacy Leakage Overshadowed by Views of AI: A Study on Human Oversight of Privacy in Language Model Agent