Opal: Private Memory for Personal AI

Darya Kaviani; Alp Eren Ozdarendeli; Jinhao Zhu; Yu Ding; Raluca Ada Popa

cs.CRApr 2, 2026

Opal: Private Memory for Personal AI

Authors: Darya Kaviani, Alp Eren Ozdarendeli, Jinhao Zhu, Yu Ding, Raluca Ada Popa

Organizations: UC Berkeley · Google DeepMind

Abstract

Personal AI systems increasingly retain long-term memory of user activity, including documents, emails, messages, meetings, and ambient recordings. Trusted hardware can keep this data private, but struggles to scale with a growing datastore. This pushes the data to external storage, which exposes retrieval access patterns that leak private information to the application provider. Oblivious RAM (ORAM) is a cryptographic primitive that can hide these patterns, but it requires a fixed access budget, precluding the query-dependent traversals that agentic memory systems rely on for accuracy. We present Opal, a private memory system for personal AI. Our key insight is to decouple all data-dependent reasoning from the bulk of personal data, confining it to the trusted enclave. Untrusted disk then sees only fixed, oblivious memory accesses. This enclave-resident component uses a lightweight knowledge graph to capture personal context that semantic search alone misses and handles continuous ingestion by piggybacking reindexing and capacity management on every ORAM access. Evaluated on a comprehensive synthetic personal-data pipeline driven by stochastic communication models, Opal improves retrieval accuracy by 13 percentage points over semantic search and achieves 29x higher throughput with 15x lower infrastructure cost than a secure baseline. Opal is under consideration for deployment to millions of users at a major AI provider.

Figures & tables

Figure 1. System model. The client sends queries and ingestion data to TEEs that run search and model serving while storing encrypted state on untrusted disk.

Figure 2. Opal system architecture. The Opal Controller orchestrates query and ingestion operations across three enclaves, routing data through oblivious storage (ORAM) on untrusted disk. Blue numbers trace the query flow; red numbers trace ingestion. Numbered steps correspond to Algorithm 3 .

Panel of Figure 3 — Figure 3. Security game for Opal

Figure 4. Sample Opal knowledge graph for user Alice. artifact nodes link to modality , person , and project nodes; chunk nodes are labeled $c_{1}$ - $c_{8}$ . Sample \sys{} knowledge graph for user Alice. Artifact nodes link to modality, person, and project nodes, and chunk nodes are labeled c1 through c8. Ambient appears as an extra modality. Timestamps and summary nodes are omitted.

Figure 5. Oblivious dreaming lifecycle. (1) Initial IVF state. (2) Writes grow a cluster; expired items (red) pass TTL. (3) Overgrown cluster splits, vectors marked pending, expired items deleted. (4) Pending corrections resolved on ordinary ORAM accesses.

Figure 6. Average weekly cadence of each modality across the synthetic corpus. Messages and emails cluster into dense weekday bursts, meetings concentrate during work hours, and all modalities drop on weekends. Average weekly cadence of each modality across the full synthetic corpus, showing weekday bursts and weekend drops.

Figure 7. Accuracy comparison for ANN-only and Opal. Left: aggregate GT-retrieval rate and judged accuracy across Vertex and open-weight stacks. Right: judged accuracy by question type (Vertex).

Figure 8. Online bandwidth per query and ingestion operation for Opal, In-Memory Opal, and Plaintext Opal across database sizes. Left: linear scale; right: log-2 scale. Bandwidth comparison across systems as corpus size increases.

Figure 9. Single-client latency for query (Q) and ingestion (I). ANN denotes embeddings, Data raw encrypted chunks, and Client sealed per-user state; each split shows disk I/O versus in-memory compute. Latency breakdown for query and ingest paths across systems.

System	Tput. (ops/s)	Users/Encl.	Cost ($/yr)
Opal	15.82	1,932	$1.40M /$ 5.21M
In-Memory	0.549	67.0	$21.13M /$ 24.93M
Ratio	28.8 $\times$	28.8 $\times$	15.0 $\times$ / 4.79 $\times$

Table 1. Serving metrics at one million users. Cost columns show infrastructure cost (compute + storage) and total cost (including model/API).

Figure 10. Three-year replay of oblivious dreaming. (A) Active entries rise to capacity and then remain stable. (B) ORAM stash size stays bounded. (C) Opal tracks LIRE closely on judged accuracy over time. Three-panel oblivious-dreaming figure showing active entries, stash size, and judged accuracy over time, including a no-expiration control.

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Research Finding	How Used
Email
Mean reply rate of 45.6% across Enron email corpus ( Fox et al., 2016 )	Email self-excitation set to 0.40, adjusted down from 0.45 for inbox noise absent in Enron and cross-modal budget reserved for meeting- and message-triggered emails
Reply time distribution: median 47 min, mean 1157 min ( Kooti et al., 2015 )	Email triggering influence decays with 47-minute half-life
$\sim$ 50% of corporate emails contain no actionable task ( Sappelli et al., 2016 )	60% of emails treated as noise
8.4% of institutional emails are organizational bulk emails ( de Castro, 2025 )	15% of noise emails are organizational bulk emails such as newsletters
$\sim$ 15% of Enron emails classified as gossip ( Mitra and Gilbert, 2013 )	25% of noise emails are gossip

Appendix

Table 2. Empirical sources used to calibrate the synthetic data generator and how each source informs the workload design.

Agent Memory

Agent memory lets AI systems retain, update, and use facts, experiences, and skills across sessions and long-horizon tasks.

See all 191 papers

Beyond Similarity: Trustworthy Memory Search for Personal AI Agents
Jun 4, 2026Jiawen Zhang, Kejia Chen, Jiachen Ma +7LLM Agent Memory AI Agent Security
Zhejiang University · Nanyang Technological University · Shanghai AI Laboratory +3
Mi-Memory: A Lifecycle Memory Framework for Personal AI
Jul 21, 2026Xule Liu, Hanlin Teng, Chao Li +15Multimodal Memory LLM Personalization
Darwin Agent Team
AIM: A Privacy-Aware Interoperable Memory Framework for Multi-Agent Multi-User LLM Systems
Sep 11, 2026Zachary Johnson, Nigel Boachie Kumankumah, Somya Chatterjee +8Multi-Agent LLM Systems Privacy-Preserving Language Models
Microsoft

Jun 4, 2026J/K move · Enter open · S save

Beyond Similarity: Trustworthy Memory Search for Personal AI Agents

Jiawen Zhang, Kejia Chen, Jiachen Ma, Yangfan Hu+6

Zhejiang University · Nanyang Technological University · Shanghai AI Laboratory+3

LLM Agent Memory AI Agent Security Memory-Augmented Agents Agent Memory Management

Open paper AskPDF arXiv

Personal AI agents increasingly rely on long-term memory to provide persistent personalization across sessions. However, existing memory pipelines are largely driven by semantic similarity: memory data close to the current query is retrieved and injected into the model context. This creates a critical trustworthiness gap, since a semantically related memory may still be contextually inappropriate, leading to threats such as cross-domain leakage, sycophancy, tool-call drift, or memory-induced jailbreaks. In this paper, we study memory search as a trust boundary in personal AI agents. We evaluate representative agentic memory frameworks, including A-Mem, Mem0, and MemOS, together with OpenClaw, a real-world personal-agent environment with persistent state and tool-use capability. Our results show that long-term memory is not merely a utility layer, but a durable control channel that can reshape how agents interpret tasks and execute actions, leaving them highly susceptible to the aforementioned threats. To mitigate these vulnerabilities, we propose MemGate, a lightweight and deployable memory plug-in for trustworthy memory search, with only 9M parameters and a 35.1MB footprint. MemGate is inserted between the vector memory store and the backbone LLM, requiring no LLM modification, memory-database rewriting, or inference-time LLM judge. It applies a query-conditioned neural gate to candidate memory representations, turning raw similarity search into task-conditioned memory admission. Across multiple mainstream memory frameworks, real-world agent settings, and diverse LLM backbones, MemGate reduces memory-induced threats while preserving long-term memory utility.

Abstract

Agent Memory

Explore similar work

Beyond Similarity: Trustworthy Memory Search for Personal AI Agents

Mi-Memory: A Lifecycle Memory Framework for Personal AI

AIM: A Privacy-Aware Interoperable Memory Framework for Multi-Agent Multi-User LLM Systems