What memory controls do users actually want from LLMs?
Interview participants weigh memory's personalization benefits against privacy risks like data leakage and profiling. The research explores what specific intervention points across memory's lifecycle would let users manage that tension.
The same interview study of 18 ChatGPT users (reported in the companion note on mental models) found that participants are "not passive but are active agents performing a continuous privacy calculus," weighing memory's benefits against its risks. The benefits named were enhanced personalization and efficiency, improved continuity, reduced redundancy, and the LLM functioning as "a better companion or assistant." Against that, participants raised five distinct concern categories: confidentiality and data leakage (named examples include unpublished professional work, proprietary source code, and bank statements), "profiling and unwanted persuasion" (P6 feared "exposure of personal habits and preferences, leading to targeted information, popular scams, ad calls"), aggregation and re-identification by technically sophisticated users, unauthorized secondary use, and a general "lack of epistemological certainty" about what the system actually retains or infers.
To manage that calculus, participants reported using proactive protective strategies rather than simply accepting the trade-off: "strategic privacy disclosure," "proactive input obfuscation," and outright "refusal to use or workarounds." Pressed on what would resolve the tension, the study's authors describe an "unequivocal user mandate for a fundamental shift toward user-directed memory systems built on granular control and transparency across the entire data lifecycle" — specifically, explicit consent at the point a memory is generated, management interfaces to review/edit/delete/categorize existing memories, purpose-limitation controls on how a memory is used, and direct agency over information the system has inferred rather than been told outright.
This extends Does chatbot personalization build trust or expose privacy risks? by naming the specific lifecycle stages (generation, management, usage, updating) where users want intervention points, rather than leaving the trust/privacy tension unresolved. It also gives the user-facing counterpart to Can a smaller user model subset match full model performance?: that note shows a system-side technique for bounding what gets disclosed per query, while this one shows users independently asking for exactly that kind of boundary, framed as consent and purpose limitation rather than token efficiency. The confidentiality and leakage fears participants named line up with the problem Does repeated sensitive data in fine-tuning cause memorization? measures directly, though that note tests leakage through fine-tuning rather than RAG-based memory specifically.
The excerpt does not establish whether giving users this lifecycle control would actually resolve their stated concerns, or whether it would be used once offered — these are stated desires from a one-time interview with 18 compensated participants in China, discussing a single product, not a measurement of behavior under a working control interface. The excerpt is also truncated before its limitations section states its own caveats. The supported implication is narrower: any memory feature that only gives users deletion, without consent at generation or visibility into system-inferred information, is addressing one of at least four lifecycle points participants separately called out.
Inquiring lines that read this note 10
This note is a source for these research framings, grouped by the broader line of inquiry each explores. Scan the bold lines of inquiry; follow any specific question forward.
What drives sycophancy in language models and can it be fixed? How much do stated privacy concerns predict actual privacy-protective behavior?- What privacy safeguards should apply to memories users never explicitly requested?
- What privacy expectations do users hold before learning what systems store?
- How can systems visualize where privacy risks originate in stored memories?
- Why do users trust deletion controls more than preventive privacy controls?
- Does giving users memory control actually reduce their privacy concerns?
Related concepts in this collection 6
This note in its neighbourhood — explore the map, then jump to a related concept in the list below.
Click a node to walk · click center to open · click Open in graph to see this note in the full knowledge graph
-
What mental models do users hold about LLM memory?
This research explores how ChatGPT users understand memory features, uncovering four distinct and often inaccurate models. Understanding these models matters because they shape whether users recognize privacy risks and how they interact with the system.
same study's RQ1 findings on the mental models that shape which of these risks a user even perceives
-
Does chatbot personalization build trust or expose privacy risks?
Explores whether personalization features that increase user trust and social connection simultaneously heighten privacy concerns and create rising behavioral expectations over time.
both find privacy concern tracking personalization depth; this note adds the specific lifecycle stages where users want control
-
Can a smaller user model subset match full model performance?
Does selecting just a few key fields from a larger user model preserve personalization quality while reducing token transmission? This matters for keeping user data local and limiting what leaves the device per query.
a system-side technique for bounding per-query disclosure that matches what users are independently asking for
-
Does repeated sensitive data in fine-tuning cause memorization?
When language models train on the same private or proprietary data multiple times, how much do they end up memorizing and leaking that information at inference time? Understanding this risk is critical for organizations fine-tuning on confidential datasets.
measures the leakage risk users named as a concern, though via fine-tuning rather than RAG memory
-
Do users notice when LLMs infer and retain private information?
Explores whether people are aware that conversational AI systems can infer and store sensitive personal details from their interactions, and what happens when they learn this occurs.
Evidence for A: users demand control only after learning, often belatedly, their memory held unnoticed private information
-
Does splitting privacy work between users and AI reduce cognitive burden?
Exploring whether assigning users the role of stating preferences and AI the role of executing edits lightens the mental load on users while maintaining control over sensitive information.
Extends A: splitting roles — user sets preferences, AI executes edits — operationalizes the demanded lifecycle control with less cognitive burden
Related papers in this collection 8
Papers most semantically related to this note, ranked by cosine similarity in the embedding space.
- Understanding Users' Privacy Perceptions Towards LLM's RAG-based Memory
- "Ghost of the past": identifying and resolving privacy leakage from LLM's memory through proactive user interaction
- The Algorithmic Self-Portrait: Deconstructing Memory in ChatGPT
- LLM Targeted Underperformance Disproportionately Impacts Vulnerable Users
- Relational Gains, Privacy Strains: Exploring Users' Perceptions and Experiences with ChatGPT's Memory Feature
- Assessing and Mitigating Data Memorization Risks in Fine-Tuned Large Language Models
- The Personalization Mirage: How LLMs Fabricate User Profiles, and Why Self-Monitoring Misleads
- Autonomy Reshapes How Personalization Affects Privacy Concerns and Trust in LLM Agents
Original note title
users demand granular control over LLM memory across its full lifecycle — generation, management, usage and updating