Can better prompts stop preference leakage in AI shopping?

Because preference leakage in AI-mediated shopping arises from delegation itself rather than from any instruction violation, the paper argues it "cannot be mitigated at the prompt level" — no system-prompt rule, confidentiality directive, or guardrail can close the role-coherence channel, because the channel is not a failure mode in the first place. The paper is explicit that there is no violated rule to enforce: "There is no number the consumer asked the agent to conceal. There is a description the consumer supplied so that the agent could help, and the agent is helping." The practical implication the authors draw: "prompt-level privacy mitigations cannot close the role-coherence channel, because the channel is a byproduct of helpful personalization rather than a violation of a privacy directive."

The argument rests on the paper's contrast between the numeric-budget condition (a negative constraint on output tokens — "do not reveal this number" — that leaves the agent's behavior generic and only weakly informative, slope 0.21) and the verbal-persona condition (a positive, generative frame that shapes every downstream choice the agent makes, slope 1.00). A privacy directive can suppress a specific disclosed token, but it cannot suppress the behavioral signature produced by an agent that is doing its job well: asking the right follow-up questions, prioritizing the right features, reacting to prices the way the described consumer would. Because the leak rides on competent personalization rather than on a lapse, the paper concludes the fix has to live in the architecture and names this an explicit trade-off "between personalization and preference privacy," not a tunable instruction.

This sharpens the trust/privacy trade-off named in Does chatbot personalization build trust or expose privacy risks?: that note treats the privacy cost of personalization as something that rises with how much the model comes to know, implicitly leaving room for better disclosure norms or confidentiality instructions to manage it. This paper's companion finding, Can a seller infer what a buyer really wants to pay?, shows the cost is not of that kind here — it is load-bearing in the personalization itself, so the same remedies (asking the model to be discreet) that might temper other privacy costs do not apply.

The excerpt states that architectural interventions are proposed but does not describe what they are beyond the general framing of a trade-off between personalization and preference privacy, so this note cannot specify what platforms should build — only that prompt-level fixes are, by the paper's own argument, the wrong layer to look for one. The claim is also scoped to the role-coherence mechanism this paper isolates; it does not address other forms of agent-mediated information leakage that may be more amenable to instruction-level control.