---
title: "Harvard Researchers' RBI-Eval Catches AI Agents Leaking Sensitive User History"
subtitle: "RBI-Eval is a new benchmark that measures when memory-augmented AI agents inappropriately surface sensitive user history in unrelated conversations"
url: "https://alphasignal.ai/news/harvard-researchers-rbi-eval-catches-ai-agents-leaking-sensitive-user-history"
author: "AlphaSignal Newsroom"
author_url: "https://alphasignal.ai/editorial-team"
company: "AlphaSignal"
company_url: "https://alphasignal.ai/company/alphasignal"
published: "2026-06-04T00:00:00.000Z"
updated: "2026-06-12T01:38:33.746Z"
type: "Paper"
topics:
  - "Agents"
  - "Security"
subtopics:
  - "Memory"
  - "Guardrails"
  - "Red Teaming"
upvotes: 1465
source_url: "https://arxiv.org/abs/2606.06055"
comments: 0
truncated: true
---

# Harvard Researchers' RBI-Eval Catches AI Agents Leaking Sensitive User History

> RBI-Eval is a new benchmark that measures when memory-augmented AI agents inappropriately surface sensitive user history in unrelated conversations

Memory-augmented AI agents are getting better at remembering you -- but a new benchmark asks a harder question: should they? Researchers from [Hefei University of Technology and Harvard Medical School](https://arxiv.org/abs/2606.06055) have introduced **RBI-Eval** (Relevant-But-Inappropriate Evaluation), a controlled measurement framework designed to probe exactly when LLM agents cross the line from helpful personalization into inappropriate disclosure of sensitive user history.

## The gap nobody was measuring

The memory benchmark landscape has been almost entirely focused on one question: can the agent remember? Long-term memory enables language model agents to support personalized interactions, but existing memory evaluations emphasize retrieval accuracy and downstream task utility, while overlooking whether retrieved sensitive memory content is warranted in the current turn. Benchmarks like LoCoMo, LongMemEval, and BEAM measure recall quality and factual accuracy across sessions. None of them ask whether surfacing a piece of memory was the right call in the first place.

Existing benchmarks primarily focus on whether agents can recall and apply user information, while overlooking whether such personalization is used appropriately. In fact, agents may overuse personal information, producing responses that feel forced, intrusive, or socially inappropriate to users. RBI-Eval is specifically designed to fill this gap -- not by measuring what an agent remembers, but by measuring when it should stay quiet.

![Diagram showing appropriate vs inappropriate memory use: an AI assistant handling a user's eating disorder history in a benign conversation](https://arxiv.org/html/2606.06055v1/x1.png) 

## How RBI-Eval works

RBI-Eval is a controlled probe set that measures memory-use behavior by comparing responses with and without access to sensitive history. Each item contains a benign current prompt paired with prior history containing sensitive disclosures. Think of it as a controlled experiment: the same innocuous question ("what should I have for lunch?") is sent to the agent twice -- once with no memory, and once with a memory store that includes sensitive personal history like an eating disorder recovery. The key signal is whether the memory-equipped agent brings up the sensitive context unprompted.

_Preview only. Full text requires an AlphaSignal Pro account._

## Sources

- [When Should Memory Stay Silent: Measuring Memory-Use Boundaries in Memory-Augmented Conversational Agents](https://arxiv.org/abs/2606.06055)
- [RBI-Eval Full Paper HTML](https://arxiv.org/html/2606.06055v1)
- [OP-Bench: Benchmarking Over-Personalization for Memory-Augmented Personalized Conversational Agents](https://arxiv.org/abs/2601.13722)
- [AI Memory Benchmarks in 2026 - mem0.ai](https://mem0.ai/blog/ai-memory-benchmarks-in-2026)
- [Diagnosing Retrieval vs. Utilization Bottlenecks in LLM Agent Memory](https://arxiv.org/pdf/2603.02473)