Can a smaller user model subset match full model performance?

The discussion section puts one finding first, and says it is "not the effect size but the ratio." Eight retrieved fields, 211 tokens, "matched the fidelity of injecting the entire 32-field user model, 915 tokens." The authors add that "nothing in the study suggests that the remaining twenty-four fields were doing work that the eight did not." They call this a modest saving for efficiency, but "for architecture it is the whole argument."

The argument runs through privacy. The Atomic User Model is committed to local residence: the store sits on the user's device or in a user-controlled vault, "never in a third-party log." That commitment is hard to keep if the whole model must go out on every complex request, because "a model that is transmitted in full on every turn has, for practical purposes, been uploaded." A budgeted payload changes this. Disclosure per query "is bounded by construction, the bound is measurable," and the fields that never leave are "disproportionately the inner-shell ones," which the authors call the ones whose exposure carries the greatest cost. They then reframe the design question in terms of contextual integrity (Nissenbaum, 2011): not whether the user model is secret, but whether each flow out of it matches the norms of the context that produced it.

Set against the nearest notes, this is a design-side answer to a tension those notes document. Does chatbot personalization build trust or expose privacy risks? finds that personalization raises trust and privacy concern together; a per-query field budget is one way to cap the second without giving up the first, though the excerpt reports no user study of perceived privacy. Do user outputs outperform inputs for LLM personalization? points the same direction, since a small amount of the right content carries the effect. Can LLMs predict demographics from social media usernames alone? is a reminder that leakage also happens through surface signals. The seepage claim in the sibling note (Should personalization systems model stable personality traits?) suggests the prompt text carries a fingerprint of its own, and the excerpt does not say whether the field budget bounds that channel.

The excerpt leaves most of the result undefined. It does not say how fidelity was measured, on what tasks or models, with how many users or trials, or how the eight fields were selected for retrieval. The size of the effect is withheld by the authors' own framing. The claim that never-transmitted fields skew toward the inner shells is stated as a design consequence, with no distribution shown. What survives is a single study's observation that a small retrieved subset was not beaten by the full model, plus a principled case for treating the per-query field budget as a privacy control worth testing across users and task types.