Abstract
Personal AI systems increasingly retain long-term memory of user activity, including documents, emails, messages, meetings, and ambient recordings. Trusted hardware can keep this data private, but struggles to scale with a growing datastore. This pushes the data to external storage, which exposes retrieval access patterns that leak private information to the application provider. Oblivious RAM (ORAM) is a cryptographic primitive that can hide these patterns, but it requires a fixed access budget, precluding the query-dependent traversals that agentic memory systems rely on for accuracy. We present Opal, a private memory system for personal AI. Our key insight is to decouple all data-dependent reasoning from the bulk of personal data, confining it to the trusted enclave. Untrusted disk then sees only fixed, oblivious memory accesses. This enclave-resident component uses a lightweight knowledge graph to capture personal context that semantic search alone misses and handles continuous ingestion by piggybacking reindexing and capacity management on every ORAM access. Evaluated on a comprehensive synthetic personal-data pipeline driven by stochastic communication models, Opal improves retrieval accuracy by 13 percentage points over semantic search and achieves 29x higher throughput with 15x lower infrastructure cost than a secure baseline. Opal is under consideration for deployment to millions of users at a major AI provider.
Abstract (translated)
个人AI系统日益长期保留用户活动记忆，包括文档、邮件、消息、会议及环境录音。可信硬件虽能保障此类数据隐私，却难以随数据存储规模增长而扩展。这迫使数据转移至外部存储，导致检索访问模式暴露，向应用提供商泄露隐私信息。不经意随机存储器（ORAM）是一种可隐藏访问模式的密码学原语，但其要求固定访问预算，无法支持智能体记忆系统依赖的动态查询遍历以保障准确性。本文介绍Opal——一款面向个人AI的隐私记忆系统。核心洞见在于：将所有数据依赖推理与海量个人数据解耦，将其限制在可信执行环境中。此时非可信磁盘仅能观察到固定且不经意的内存访问。该驻留可信区的组件采用轻量级知识图谱，捕获语义搜索单独遗漏的个人上下文，并通过在每次ORAM访问中“搭车”执行重索引与容量管理，实现持续数据摄入。基于随机通信模型驱动的综合合成个人数据管道评估显示，Opal相比语义搜索将检索准确率提升13个百分点，相较于安全基线实现29倍吞吐量提升与15倍基础设施成本降低。Opal正被某大型AI提供商考虑部署至数百万用户。
URL
https://arxiv.org/abs/2604.02522
