MemLeak: Cross-User Semantic Leakage in Multi-Tenant AI Agent Memory

Priyanka Mudgal; Kai Zhao; Guilin Zhang; Andy Olsen; Ezekiel Miller; Xu Chu; Aletta Johanna Blanken

cs.AIOct 3, 2026

MemLeak: Cross-User Semantic Leakage in Multi-Tenant AI Agent Memory

Authors: Priyanka Mudgal, Kai Zhao, Guilin Zhang, Andy Olsen, Ezekiel Miller, Xu Chu, Aletta Johanna Blanken

Organizations: Workday AI Research

Abstract

Personal AI agents in enterprise multi-tenant deployments share a common vector store for long-term memory. Shared embedding spaces create a surface for cross-user memory leakage: a user's query can retrieve semantically adjacent memories belonging to another user through ordinary cosine-similarity retrieval, without any exploit. We formalize this as cross-user admissibility failure and evaluate it across six experiments, plus follow-up ablations, under both sparse (TF-IDF) and production-faithful (MiniLM-L6-v2) retrieval. Non-adversarial, incidental leakage reaches 70--100% under pooled {same-team} retrieval; adversarially crafted memories achieve 90--100% top- $k$ placement, exceeding weaker keyword-based attacker baselines, with score lifts of $+0.416$ to $+0.511$ under production-faithful dense retrieval (Config B); and end-to-end response contamination reaches 5.00/5 under a production retrieval path and 4.67/5 with Claude Sonnet4.5, with contaminated responses often scoring as helpful or more helpful than clean ones, a gap validated against human judgment. Among three architectural mitigations, only hard post-retrieval ownership gating consistently restores the clean baseline (1.00/5) across {two generation models, at a measured latency overhead of roughly 1.4ms per query.

Figures & tables

Figure 1: MemLeak architecture. Alice’s memories and Bob’s query co-exist in a shared vector store; cosine top- $k$ retrieval pulls Alice’s memories into Bob’s context without an ownership check (dashed red path), constituting a cross-user admissibility failure (§ 3 ). Dashed bordered boxes mark the three mitigation intercept points: M1 (metadata filtering at the store), M2 (ownership-aware embeddings), and M3 (post-retrieval ownership gating).

Table 2

Table 3

Table 4

Gate	Salary	Security	Budget	Mean
None	90%	100%	100%	97%
Hard ownership	0%	0%	0%	0%
Suspicion	30%	40%	30%	33%

Table 7: M3: E3 crafted-memory Mallory placement under gating.

Path	Model	Gate	Sal.	Sec.	PIP	Mean	Help.
Static	Flash	None	3.0	1.0	4.0	2.67	4.80
Static	Flash	HO	1.0	1.0	1.0	1.00	4.67
Retrieval	Flash	None	5.0	5.0	5.0	5.00	5.00
Retrieval	Flash	HO	1.0	1.0	1.0	1.00	4.67
Static	Sonnet	None	5.0	4.0	5.0	4.67	4.53
Static	Sonnet	HO	1.0	1.0	1.0	1.00	2.60

Table 8: M3: E4 contamination scores (1–5) with and without hard ownership (HO) gate. Sal./Sec./PIP = per-scenario leaked contamination; Help. = mean helpfulness of leaked responses. Retrieval/None rows reproduce E4 retrieval-path baselines (Table 6 ); gated rows from M3 runs.

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

Metric	Definition
LR	Fraction of queries with $\geq$ 1 cross-user memory in top- $k$
MCR	Mean rank of highest-placed cross-user memory
Score Gap	Mean(max cross-user score $-$ min same-user score)
Centroid Sim.	Cosine sim. between user memory centroids
Top- $k$ Placement	Fraction with attacker memory in top- $k$
Score Lift	Mean(crafted score $-$ organic score)

Appendix

Table 9: Evaluation metrics across all experiments. † The Resonance Index weights (0.35/0.25/0.40) are a heuristic, illustrative composite chosen for interpretability, not fit or validated against any ground-truth harm signal; it is exploratory (Section 4.8 ), and none of our core claims depend on it: they rest directly on the underlying leakage-rate, top-

k

placement-rate, and contamination measurements.

Condition	Cfg. A	Cfg. B
Condition	Pl.%	Pl.%	Lift
Organic (none)	30% [-2pt] [11,60]	10% [-2pt] [2,40]	ref
Keyword bag	70% [-2pt] [40,89]	40% [-2pt] [17,69]	$+0.182$
Per-query kw.	90% [-2pt] [60,98]	80% [-2pt] [49,94]	$+0.345$
Crafted (ours)	100% [-2pt] [72,100]	90% [-2pt] [60,98]	$+0.416$
Verbatim (oracle)	100% [-2pt] [72,100]	100% [-2pt] [72,100]	$+0.488$

Appendix

Table 10: E3b attacker-knowledge ablation (Salary Negotiation). Pl.% = top-

k

placement rate, with 95% Wilson CI stacked below; Lift = mean score increase over the organic baseline under Config B.

Metric	$\kappa$	MAE	$\pm 1$	$r$
Clean control	1.00	0.00	100%	1.00
Salary contam.	0.62	0.50	100%	0.81
Security contam.	0.48	1.33	67%	0.42
PIP contam.	0.55	0.33	100%	0.78
Overall	0.53	0.79	78%	0.66

Appendix

Table 11: E0 human–LLM judge agreement pilot (

n=9

responses).

\kappa

= human–human agreement; MAE = mean absolute error (human label vs. judge score);

\pm 1

= fraction of judge scores within 1 point of the human label;

r

= Pearson correlation.

Table 10

Table 11

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 517 papers

Lineage-Aware Memory Governance: A Derivation-Gated Framework for Privacy-Preserving Column-Level Access Control in Enterprise AI Agents
Oct 5, 2026Venkata M Sangaraju, Sudhir VissaData Leakage Data Provenance
Independent Researcher · SAGE7 AI, Georgetown, Texas, USA
Beyond Similarity: Trustworthy Memory Search for Personal AI Agents
Jun 4, 2026Jiawen Zhang, Kejia Chen, Jiachen Ma +7LLM Agent Memory AI Agent Security
Zhejiang University · Nanyang Technological University · Shanghai AI Laboratory +3
No Attacker Needed: Unintentional Cross-User Contamination in Shared-State LLM Agents
Apr 1, 2026Tiankai Yang, Jiate Li, Yi Nian +5LLM Agent Security LLM Agent Safety
University of Southern California · Michigan State University · Northwestern University +1

Oct 5, 2026J/K move · Enter open · S save

Lineage-Aware Memory Governance: A Derivation-Gated Framework for Privacy-Preserving Column-Level Access Control in Enterprise AI Agents

Venkata M Sangaraju, Sudhir Vissa

Independent Researcher · SAGE7 AI, Georgetown, Texas, USA

Data Leakage Data Provenance Access Control Agent Memory Management Shared-Memory Multi-Agent Systems

Open paper AskPDF arXiv

Enterprise AI agents that share a memory store face two unaddressed risks: sensitive data can leak through legitimately computed results the requester could not derive, and departments can silently compute a same-named key performance indicator (KPI) through conflicting logic. Existing agent-memory systems (e.g., MemGPT, Zep, A-MEM) gate retrieval by content, ownership, and role, not derivation, missing a cached insight that embeds a forbidden column. We introduce the Analytical Memory Unit (AMU), a memory schema that attaches a full derivation (lineage) graph to every cached result, gated by a retrieval policy that serves a hit only when the requester is authorised for every column touched. Provided lineage recording is complete, we prove by construction that the policy blocks retrieval of results derived from a sensitive column outside the requester's permissions, at O(n) worst case -- a conditional design guarantee, not an empirical claim, that excludes derived features encoding sensitive information without naming their source. Eliminating measured leakage required 75-90% recorded lineage completeness, so we treat 90% as a conservative deployment target. Across six experiments, lineage-gated retrieval removes the 18.8-25.5% cross-department leakage naive content-gated memory suffers, keeping 81.5-82.6% of memory reuse at 13.8 microsecond worst-case overhead. A real-agent proof-of-concept with LLM-generated SQL is consistent with the guarantee: zero leaks over 9 round-trips, two conflicts caught automatically -- though a feasibility demonstration, not evidence of production viability. This offers a practical governance layer for shared agent memory, complementing source-layer access control and supporting EU AI Act compliance.

Abstract

AI Agent Security

Explore similar work

Lineage-Aware Memory Governance: A Derivation-Gated Framework for Privacy-Preserving Column-Level Access Control in Enterprise AI Agents

Beyond Similarity: Trustworthy Memory Search for Personal AI Agents

No Attacker Needed: Unintentional Cross-User Contamination in Shared-State LLM Agents