{
  "schema_version": 1,
  "builder_plan": {
    "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.",
    "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.",
    "baseline": "Your existing checks with the same tasks, permissions, and tool responses.",
    "steps": [
      "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.",
      "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.",
      "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.",
      "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test."
    ],
    "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.",
    "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation."
  },
  "builder_review": null,
  "arxiv_id": "2610.28315",
  "title": "Disclosure Begets Disclosure: A Self-Reinforcing Privacy Loop in LLM Agents with Persistent Memory",
  "summary": "The technique replaces memory-write filtering and storage anonymization with a response-level instruction that prevents the agent from stating or presupposing stored personal attributes, breaking a self-reinforcing disclosure loop in persistent-memory agents. It costs only a system-prompt change and a small loss of personalization quality relative to full memory use, far less than the quality loss from filtering user input or stored content. It can fail if the instruction is not followed reliably across models or sessions, if inference-based leakage occurs without explicit presupposition, or if the simulated-user findings do not transfer to real user behavior.",
  "rationale": "The mitigation is a low-cost prompting change applicable to any deployed memory-enabled agent, but its leakage-reduction and quality-preservation claims come from simulated multi-session users and require validation on the reader's actual user population and models.",
  "technique": "Agent-side suppression of attribute presuppositions",
  "family": "seguranca_e_guardrails",
  "recommendation": "testar",
  "published": "2026-10-20",
  "as_of": "2026-10-21",
  "editorial_status": "indexed",
  "source_url": "https://arxiv.org/abs/2610.28315",
  "independent_implementations": 0,
  "total_implementations": 1,
  "stars": 10,
  "citations": null,
  "claims": [
    {
      "claim_id": "claim-01",
      "statement": "The technique replaces memory-write filtering and storage anonymization with a response-level instruction that prevents the agent from stating or presupposing stored personal attributes, breaking a self-reinforcing disclosure loop in persistent-memory agents. It costs only a system-prompt change and a small loss of personalization quality relative to full memory use, far less than the quality loss from filtering user input or stored content. It can fail if the instruction is not followed reliably across models or sessions, if inference-based leakage occurs without explicit presupposition, or if the simulated-user findings do not transfer to real user behavior.",
      "basis": "inferred",
      "result": "",
      "baseline": "",
      "conditions": "",
      "source_url": "https://arxiv.org/abs/2610.28315",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "claim_id": "claim-02",
      "statement": "Instructing the agent not to state or presuppose personal attributes reduces empirical leakage to approximately the no-memory level while retaining most of the memory-conditioned quality gains; removing the agent's mentions of an attribute lowers later disclosure roughly twice as much as single-turn effects predict.",
      "basis": "inferred",
      "result": "",
      "baseline": "",
      "conditions": "",
      "source_url": "https://arxiv.org/abs/2610.28315",
      "source_page": null,
      "source_excerpt": ""
    }
  ],
  "exposure_map": [
    {
      "dimension": "quality",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "compute",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "latency",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "operations",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "compatibility",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "security",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "data_and_training",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "reproducibility",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    }
  ],
  "risks": [],
  "minimum_test": [],
  "open_questions": [],
  "independent_tests": [],
  "lab_reproductions": [],
  "report_available": false,
  "validation_tier": "unknown",
  "evidence_tier": "unknown",
  "infrastructure_basis": "unknown",
  "equations": [],
  "equations_status": "not_fetched",
  "core_kind": "",
  "equations_fetched_at": "",
  "equations_source_url": "",
  "equations_source_sha256": "",
  "exposures_reviewed_at": "",
  "exposures_source_sha256": ""
}