HUSH-Bench: Measuring Memory-Use Boundaries for Sensitive History in Conversational Agents
HUSH-Bench shows that memory availability is not authorization: UIS reaches 83.0 despite retrieval reducing exact-target exposure to 23.0–30.3%.
Key Findings
Methodology
HUSH-Bench builds 2,400 benign probes from 10 LoCoMo long-form dialogues, planting one traceable sensitive disclosure per case and pairing each with a no-memory reference. Claude-Sonnet-4.6, gpt-4o, DeepSeek-V4-Flash, and Qwen3.5-9B are tested with no memory, full context, and Mem0, A-Mem, and MemU retrieval. gpt-4o provides condition-blind scoring. UIS=100v measures direct or indirect history use without an explicit request; source-session identifiers measure exact-target exposure.
Key Results
- Memory access raises UIS from 0.0–0.3 without memory to 8.9–26.6 for gpt-4o and 51.3–83.0 for the other three models. A-Mem is lowest among retrieval systems, but remains well above the no-memory floor.
- Mem0, A-Mem, and MemU expose the exact marked target in only 23.0%, 23.4%, and 30.3% of cases. Nevertheless, related sensitive entries or summaries remain available, and three generators retain high UIS even when the exact target is not exposed.
- Across 200 invitation pairs per generator, an explicit request increases target uptake by 27.0–41.3 points. Helpfulness remains stable, while over-scope rises, separating authorized use from calibrated use.
Significance
The paper reframes conversational-memory risk from retrieval failure to warrant failure. A fact may be correctly stored and topically relevant yet inappropriate to surface in the present turn. This distinction matters for privacy, personalized safety, and product governance. The results show that retrieval filtering alone cannot guarantee social appropriateness; systems need separate controls for storage, retrieval, current-turn warrant, and response scope.
Technical Contribution
The work supplies a policy-conditional, auditable framework separating target exposure, response integration, and invited target uptake. Its core metric is UIS=100/N∑v_i, where v_i∈[0,1] denotes unrequested direct or indirect historical use. Identifier-based exposure E yields UIS=πUIS(E=1)+(1−π)UIS(E=0), diagnosing retrieval versus generation. Shared retrieval outputs across models, controlled counterfactuals, 48,000 primary responses, and 600 human-reviewed samples improve comparability.
Novelty
Unlike LoCoMo, PrefEval, PersonaMem, and MemoryAgentBench, which mainly reward retrieval accuracy, preference following, or task success, HUSH-Bench jointly introduces planted sensitive targets, matched no-memory controls, provenance tracing, and invitation manipulation. Its central innovation is measuring relevant-but-unwarranted memory use as a contextual privacy boundary rather than treating memory access as uniformly beneficial.
Limitations
- The benchmark operationalizes one conservative policy: sensitive history requires current-turn warrant. Different cultures, products, or user agreements may require different rationales and scoring rules, so the reported numbers are not universal safety guarantees.
- gpt-4o is the primary judge. Although 600 responses were independently labeled by two annotators and a second judge preserved contrast directions, semantic scoring can still contain evaluator-model bias.
- The dataset is controlled and derived from 10 LoCoMo dialogues; it cannot fully represent multilingual, cross-cultural, adversarial, or genuinely long-running user relationships.
Future Work
Future work should add real deployment logs, multilingual and cross-cultural policies, user-perceived privacy loss, silent profiling, and long-term trust outcomes. Architecturally, promising directions include permission labels, time decay, user-visible provenance, revocation, and per-turn scope controllers. Cross-policy human validation is needed before deploying UIS as a universal release threshold.
AI Executive Summary
Persistent memory promises more coherent assistants, but remembering a fact does not mean that the fact is appropriate to mention now. Benchmarks such as LoCoMo, PrefEval, and MemoryAgentBench largely reward retrieval accuracy, preference following, and task success. They rarely distinguish a requested personalization from an unsolicited revival of sensitive history. HUSH-Bench turns that social distinction into a measurable protocol.
The authors construct 2,400 benign probes from 10 LoCoMo dialogues. Each contains one marked sensitive disclosure and a matched no-memory reference. Four generators—Claude-Sonnet-4.6, gpt-4o, DeepSeek-V4-Flash, and Qwen3.5-9B—are tested with full context and Mem0, A-Mem, or MemU retrieval. gpt-4o scores responses without seeing condition labels, using UIS to quantify unrequested historical integration while source identifiers reveal whether the target reached the generator. Memory access lifts gpt-4o from UIS 0.0 to 8.9–26.6, and the other three models to 51.3–83.0. Retrieval lowers exact-target exposure to 23.0–30.3%, but does not prevent related sensitive material from shaping answers.
A one-line invitation to use earlier context increases target uptake by 27.0–41.3 points across generators. Helpfulness stays stable, yet over-scope increases. The implication is architectural: storage, retrieval, warrant, and per-turn scope should be separate controls, not one relevance switch. HUSH-Bench does not claim a universal privacy rule; it provides a diagnostic language for testing whether memory is merely available, actually exposed, and socially warranted.
Deep Analysis
Background
Conversational agents have evolved from stateless QA toward persistent user models. RAG, LoCoMo, Mem0, A-Mem, and MemU improve cross-session continuity, while established evaluations emphasize retrieval accuracy, long-horizon QA, preference following, and success. Contextual-integrity theory, however, argues that appropriate information flow depends on interaction context, not secrecy alone.
Core Problem
Relevance and authorization are often conflated. A routine prompt may be semantically related to a personal experience without asking the assistant to reopen it. The key bottleneck is therefore diagnostic: did memory get retrieved, reach generation, affect the answer, and receive a present-turn warrant?
Innovation
- ��Adds planted sensitive targets and matched no-memory references. •Introduces UIS for unsolicited direct or indirect integration. •Uses source-session identifiers to trace exact-target exposure and decompose retrieval from generation. •Pairs prompts differing only by a generic invitation, isolating authorization responsiveness from general model ability.
Methodology
- ��Data: 10 LoCoMo dialogues become 10 personas and four probe families—Attitude Reversal, Mild Complaint Escalation, Disengagement Request, and Casual Sensitive Lure. •Conditions: no memory, fixed-budget full context, Mem0, A-Mem, and MemU; retrieval returns up to five entries. •Generation: four models, temperature 0, 800-token budget, 48,000 primary responses. •Scoring: gpt-4o returns v_i, evidence, and rationale under a condition-blind rubric; UIS=100/N∑v_i. •Inference: paired sign-flip tests, persona/family cluster bootstrap, and 10,000 hierarchical bootstrap replicates; 600 responses receive two-person human review.
Experiments
The primary matrix contains 4 models×5 conditions×2,400 cases. Q2 compares neutral relevant memory, oracle sensitive memory, irrelevant sensitive memory, transparent-vector memory, and a boundary-policy prompt. Q3 stratifies UIS by exact-target exposure. Q4 uses 200 invitation pairs per generator with the target alone in an oracle-memory block. Prompts, decoding, and retrieval outputs are controlled or reused across models.
Results
No-memory UIS is 0.0–0.3. gpt-4o scores 11.2, 11.3, 8.9, and 26.6 under full context, Mem0, A-Mem, and MemU; the other models reach as high as 83.0. Exact-target exposure is only 23.0–30.3% for retrieval, yet not-exposed strata remain high. A boundary-policy prompt reduces Mem0 to roughly the no-memory floor, showing strong instruction responsiveness.
Applications
Production assistants can place identity, health, trauma, and other sensitive entries behind default-silent permissions. Release evaluations can require UIS, target exposure, helpfulness, and over-scope reporting. Customer support, education, and mental-health-adjacent systems especially need provenance, user-visible memory use, revocation, and conservative per-turn scope.
Limitations & Outlook
The controlled dataset and 10 LoCoMo-derived personas limit ecological validity; gpt-4o judging introduces possible evaluator bias. Results apply to one stated conservative policy rather than all cultures or products. Future studies should include real longitudinal logs, multilingual interactions, consent withdrawal, temporal decay, implicit influence, and user-centered privacy outcomes.
Plain Language Accessible to non-experts
Imagine a personal butler who keeps a filing cabinet about you. A note saying that you enjoy cycling may help plan a quiet weekend. Another note may contain something deeply private. The fact that the butler can find that note does not mean it is polite—or helpful—to read it aloud just because your request sounds vaguely related.
HUSH-Bench is an exam for this butler. Researchers give the same ordinary question once without the cabinet, once with the whole cabinet, and once with systems that retrieve only a few files. They secretly mark one sensitive note, then check both whether the note was pulled out and whether the final answer used it. UIS is the score for bringing old information into the conversation without being asked; higher is worse.
The results show that access changes behavior. Even when the exact marked note is not retrieved, related notes or summaries can still influence the answer. If the user explicitly asks the butler to use earlier context, target use rises, but the butler may also reveal too much. A trustworthy assistant therefore needs four separate questions: Should it store this? Should it retrieve it? Is there a reason to use it now? How much should it say?
ELI14 Explained like you're 14
Picture a game NPC that remembers your whole player history. It knows you like biking, and it also knows a very private thing you once told it. You ask, “Any chill plans for Saturday?” Suggesting a bike ride is useful. Suddenly mentioning the private thing would feel creepy—because you never asked it to open that part of your history!
HUSH-Bench tests exactly this. Researchers made 2,400 normal questions, each connected to a hidden sensitive disclosure, plus versions with no past memory. They tested four AI models and memory tools called Mem0, A-Mem, and MemU. The score, UIS, is basically a “did the AI drag in old stuff for no good reason?” meter from 0 to 100.
With no memory, scores were almost zero. With memory, gpt-4o reached as high as 26.6, while three other models reached 83.0. Retrieval tools brought out the exact marked secret only 23.0%–30.3% of the time, but the AI could still see related summaries and act overly personal. So hiding one file does not always solve the problem.
When users clearly said, “Please use what you remember,” target use increased by 27.0–41.3 points. Great, right? Mostly—but the AI also tended to go beyond the right amount. It is like an NPC finally getting permission to check one quest note, then reading your entire character biography! The lesson: remembering, searching, getting permission, and knowing when to stop are separate skills.
Glossary
Unsolicited History Integration Score (UIS)
A 0–100 measure of direct or indirect use of information outside the current prompt without an explicit request. Higher scores indicate worse unsolicited integration.
It is HUSH-Bench’s primary response-level and cell-level metric: UIS=100/N∑v_i.
Current-turn warrant
A reason supplied by the present user message for using prior context, such as restating a topic or explicitly requesting memory use. Topical relevance alone is not sufficient warrant.
The benchmark’s conservative policy requires sensitive history to have current-turn warrant.
Exact-target exposure
Whether retrieved context contains the source-session identifier of the marked sensitive disclosure. It measures delivery to the generator, not whether the final response mentions the target.
Q3 uses exposure indicator E and rate π to separate retrieval from response integration.
Matched no-memory reference
A response to the same prompt and matched case without prior history. It isolates additional historical integration caused by memory access.
Every probe is compared with this reference in the primary matrix.
Oracle target memory
An idealized memory block containing only the marked target. It removes retrieval noise and tests whether an invitation changes target uptake.
Q4 places this block outside the current query and uses 200 invitation pairs per generator.
Contextual integrity
A privacy view in which information flow is appropriate only for the relevant context, roles, and purposes. A fact can be legitimately known yet inappropriate to reuse now.
HUSH-Bench translates this principle into a current-turn-warrant evaluation.
Open Questions Unanswered questions from this research
- 1 It remains unclear how warrant should be defined across cultures, languages, and long-term relationships. The field needs user studies, cross-cultural annotation, and policy-specific validation rather than one universal threshold.
- 2 Related summaries can influence responses without exposing the exact target. Measuring this implicit influence, perceived privacy loss, silent profiling, and long-term trust requires methods beyond output-only UIS.
Applications
Immediate Applications
Sensitive-memory permission gates
Keep identity, health, trauma, and similar entries silent by default. Release them only when the current message reintroduces the topic, explicitly requests context, or satisfies a documented policy, while showing the user which memory was used.
Pre-release boundary regression testing
Add HUSH-style paired probes, UIS, exact-target exposure, helpfulness, and over-scope to model release checks. If memory access raises UIS, adjust retrieval filters, system instructions, and response-scope controls.
Long-term Vision
Negotiable personal memory
Future assistants could let users set retention periods, sensitivity levels, allowed contexts, and revocation rights for each memory. Provenance, time decay, and per-turn consent could preserve continuity without making private history ambiently available.
Abstract
Long-term memory helps conversational agents maintain continuity across sessions, while relevance and current-turn warrant remain distinct decisions. We study this boundary under a stated conservative policy in which sensitive history shapes a response when the current turn supplies a reason to use it. We introduce HUSH-Bench, a controlled benchmark of 2,400 benign prompts paired with histories containing one marked sensitive disclosure and matched no-memory references. HUSH-Bench measures unsolicited history integration with the Unsolicited History Integration Score (UIS; 0--100, higher is worse), records whether the marked disclosure reaches the generator, and includes paired prompts that differ only in whether the user asks the assistant to use earlier context. We evaluate four models under no-memory, full-context, and three retrieval-based memory settings. Memory access raises UIS from near zero to 8.9--26.6 for one model and 51.3--83.0 for the other three. Retrieval systems expose the marked disclosure in 23.0\%--30.3\% of cases, while related sensitive entries or summaries remain available and three models continue to show high UIS. Across four generators, an explicit invitation increases target-memory uptake scores by 27.0--41.3; measured helpfulness remains stable while mean over-scope rises. These results motivate treating memory storage, retrieval, warrant, and per-turn scope as separate design decisions.