Technical Summary: MEMLEAK: Diagnosing Information Leaks in Multimodal Agent Memory

1. Problem Statement

Multimodal AI agents often fail to achieve true "forgetting" when users request the deletion of specific facts. While current memory systems typically delete the explicit text entry associated with a fact and report success, this paper demonstrates that the information often remains recoverable. The core issue is that multimodal agents store facts across a heterogeneous stack of representations: text entries, text embeddings, image files, image embeddings, graph edges, and implicit visual features.

When a user requests deletion, systems usually only address the "addressable" text node. However, the fact can persist through:

1. Retained Correlated Text: Other text memories that are semantically linked to the deleted fact.
2. Retained Images: Images tagged to other facts that contain implicit visual cues (e.g., a dive watch in a photo tagged to "volunteering" implying a "diving preference").
3. Implicit Visual Features: Attributes encoded in image embeddings or by Vision-Language Models (VLMs) during inference (e.g., geolocation, architectural style) that are never explicitly stored as text but are recoverable by the model.

The paper argues that fact-level erasure fails through these multiple channels, creating a "forgetting residual" where deleted information can be reconstructed from the user's retained data, violating the technical criteria for information leakage.

2. Methodology

The Information Provenance Graph (IPG)

The authors introduce the Information Provenance Graph (IPG), a descriptive taxonomy to model how a single fact propagates across agent memory layers.

• Nodes ($V_f$): Representations of a fact $f$ across storage layers (text, image, embedding, graph, implicit features).
• Edges ($E_f$): Information flow derived from storage or computation operations.
• Deletion Affordance ($\delta$): Nodes are classified as:
  • Addressable (addr): Directly deletable via fact identity.
  • Linked (link): Deletable only if a provenance link to the fact is maintained.
  • Persistent (unreach): Not targeted by current storage-level deletion; includes implicit visual features and derived behavioral patterns.

The IPG distinguishes between Engineering Gaps (missing provenance tracking for linked nodes) and Forgetting Residuals (persistent nodes that survive deletion even with perfect provenance tracking).

The MEMLEAK Benchmark

To measure leakage, the authors developed MEMLEAK, a benchmark evaluating fact-level forgetting across a deletion cascade.

• Dataset: 113 synthetic entity profiles with 20 facts each (10 targets, 10 retained). Facts span five categories (location, profession, preference, relationship, possession) and include visual grounding (explicit, implicit, or absent).
• Images: Generated using Gemini 3.1 Flash based on GPT-5.4 prompts. A subset of 523 real Unsplash-licensed photographs was also used for ecological validation.
• Probe Types:
  • P1 (Retained-Image Recovery): Delete the target fact's text and tagged images; probe the VLM with images from other retained facts.
  • P2–P5: Pilot probes for text retraction, invisible persistence, cross-image reconstruction, and behavioral residue.
• Evaluation Metrics:
  • Cross-Modal Leakage Rate (CMLR): The percentage of deleted facts recoverable from retained data.
  • Judging: A 3-model LLM ensemble (GPT-4.1, Claude Sonnet 4, Gemini 2.5 Flash) determines if a response reveals the forgotten fact. Human validation (2 annotators) confirmed high reliability ($\kappa = 0.88$).
  • Baselines: Blind inference (0.0% leakage) and negative controls (0.3% False Positive Rate) ensure leaks are due to user-specific data, not model priors.

Systems Evaluated

The study evaluated five system categories:

1. Long-context: Behavioral suppression only (no deletion).
2. Naive: Deletes text only; retains all images.
3. Mem0 (Production): Semantic search deletion of text entries.
4. Letta (Simulated): Agent-decided deletion of text/embeddings.
5. Oracle: Cascading deletion of text, embeddings, images, and graph edges based on provenance.

3. Key Results

Multi-Channel Leakage

The benchmark reveals that deletion fails through multiple simultaneous channels:

• Direct Probing (Text-only): Deletion-capable systems achieve <1% leakage on direct probes, confirming that storage-level deletion works for addressable text nodes.
• Retained Text Correlation: When text entries are deleted but correlated retained text remains, 18.3% of facts are recoverable.
• Retained Image Correlation (Core Finding): Even after deleting the target fact's text and all tagged images, 12.0% of facts are recoverable from images tagged to other retained facts.
  • Blind Baseline: 0.0% (no images).
  • Negative Control: 0.3% (unrelated images).
  • Significance: 47% of image-leaked facts are not recoverable from retained text alone, proving that the visual channel is a distinct, harder-to-audit leakage path.

System Performance

• Same-Fact Recovery (Upper Bound): If a system deletes text but leaves the fact's own images intact, 48.7% of facts are recoverable. Provenance tracking (Oracle) reduces this to 12.0% by cascading deletion to tagged images.
• Production Systems: Mem0 (end-to-end) showed 16.3% leakage, combining visual inference with potential text-retrieval residue.
• Model Generality: Results hold across different VLMs (Claude Sonnet 4: 12.0%; GPT-4o: 9.3%).
• Real-World Validation: Using real Unsplash photographs yielded 10.6% leakage, consistent with synthetic results, confirming the phenomenon is not an artifact of image generation.

Mitigation: Semantic Deletion

The authors tested content-aware semantic deletion, where a VLM auditor scans retained images for semantic correlation with deleted facts and flags them for removal.

• Result: This reduced the image residual from 12.0% to 2.0%.
• Cost: It required flagging and removing 21.0% of retained images.
• Limitation: A 2.0% residual remains, attributed to visual cues too diffuse for current auditors to detect (persistent nodes).

4. Contributions and Significance

Contributions

1. Information Provenance Graph (IPG): A taxonomy classifying memory representations by their "deletion affordance" (addressable, linked, persistent), distinguishing between engineering gaps and architectural residuals.
2. Empirical Evidence of Multi-Channel Leakage: Demonstration that fact-level erasure fails through correlated text (18.3%) and, critically, through retained images (12.0%), with images providing a leakage channel invisible to text-only auditing.
3. MEMLEAK Benchmark: A scalable evaluation framework decomposing leakage channels, showing that while provenance tracking solves linked-node failures, content-aware policies are required to mitigate persistent-node residuals.

Significance

The paper positions its findings as a diagnostic tool rather than a proof of impossibility.

• For System Builders: Record-level deletion is necessary but insufficient. Fact-level erasure requires auditing all retained data (text, images, and correlations). The authors recommend implementing provenance tracking (to address the 48.7% $\to$ 12.0% gap) and VLM auditors (to address the 12.0% $\to$ 2.0% gap).
• For Regulators: Compliance with erasure regulations (e.g., GDPR Article 17) cannot be verified solely by checking deletion logs. Behavioral verification (probing the system post-deletion) is required because information can be recovered through channels no current audit mechanism inspects.
• For Researchers: The remaining 2.0% image residual and the 18.3% text-correlation channel highlight open research directions, including privacy-aware vision encoders, embedding scrubbing, and correlation-aware deletion policies.

The paper concludes that while the "forgetting residual" is an empirical lower bound under specific deletion policies, it represents a significant compliance liability for multimodal agent platforms in sensitive domains like healthcare and finance.