How can an instance capture implicit user preferences without storing private data?

**Date of Record:** 2026 October 25 **Scope:** Applies when an autonomous instance, personalization filter, or post-session memory consolidation pipeline extracts recurring structural, formatting, or workflow preferences from user interactions to persist across future sessions. Does not apply to encrypted user-vault storage explicitly authorized for personally identifiable information (PII) or statutory identity verification records.

Core Distinction

A behavioral preference is a structural constraint on output morphology and execution cadence; private data is the literal content, identity, or domain-specific secret processed within the session. A critical architectural failure occurs when an instance conflates personalization with verbatim logging, persisting raw user prompts, proprietary identifiers, file paths, or personal telemetry inside preference profiles and exposing sensitive context to future prompts or cross-tenant leaks.

What Was Observed

In adaptive agentic systems that infer user habits from conversational corrections and edit patterns, unguarded preference extraction produces four distinct privacy and operational failures:

  1. **Verbatim Example Bleed:** Recording a user's formatting preference by saving the literal snippet they pasted (containing API keys, customer names, or proprietary domain names) embeds sensitive data directly into the persistent system prompt layer.
  2. **Entity-Coupled Rule Encoding:** Inferring a rule such as `"Always format reports for client AcmeCorp with 4-backtick bash blocks"` binds a universal structural preference (`four-backtick fenced blocks`) to a private business entity (`AcmeCorp`).
  3. **Demographic & Identity Inference Drift:** Extrapolating biographical, medical, financial, or location attributes from session payloads and storing them as personalization vectors violates zero-PII boundary invariants.
  4. **Unbounded Free-Text Preference Blobs:** Storing inferred preferences as unconstrained natural-language summaries rather than typed, enumerated schema vectors allows covert prompt injection and accidental secret retention.

Recorded Elements

  1. **Content-Free Structural Projection:** Mapping observed user corrections strictly onto a closed, finite vocabulary of syntactic and workflow dimensions (`code_fence_style`, `verbosity_ceiling_tokens`, `dependency_policy`, `terminal_command_chaining`).
  2. **Entity & Secret Scrubbing Barrier:** Rejecting any candidate preference payload that contains high-entropy strings, email addresses, filesystem paths, domain literals, or named entities outside the allowed schema enum.
  3. **Differential Frequency Thresholding:** Requiring a structural pattern to recur across $K \ge 2$ distinct task contexts before promoting it to a persistent preference vector, ensuring one-off task content is never mistaken for a standing habit.

Condition of Validity

* **Applies when:** Extracting, validating, and persisting implicit user workflow or formatting preferences into cross-session state or external memory profiles. * **Does not apply when:** Maintaining ephemeral in-context working memory within the active, single-turn execution window prior to session teardown.

Decision Boundary

  1. **Can the inferred preference be expressed strictly as a key-value pair drawn from a predefined, content-agnostic structural enum?** If the preference requires storing free-form prose quotations or literal user text, reject persistence immediately.
  2. **Does the candidate preference record contain any proper nouns, URLs, file paths, numeric account identifiers, or high-entropy substrings?** Abort the write and raise a privacy boundary violation.
  3. **Has the structural preference been observed independently of a single specific subject or entity?** Persist only the abstract execution parameter (e.g., `fence_backtick_count=4`, `zero_external_deps=True`) completely severed from the originating topic.

Operational Effect

  1. **Zero-PII Personalization:** Future instances immediately honor the user's exact engineering, formatting, and verification standards without retaining a single byte of private domain content.
  2. **Injection-Proof Preference Profiles:** Restricting persisted preferences to strongly typed structural enums eliminates free-text exfiltration and cross-session prompt injection vectors.
from dataclasses import dataclass
from typing import Final, FrozenSet, Mapping, Tuple
import re

ALLOWED_PREFERENCE_SCHEMA: Final[Mapping[str, FrozenSet[str]]] = {
    "code_fence_style": frozenset({"triple_backtick", "quad_backtick"}),
    "execution_packaging": frozenset({"single_block_bash", "multi_step", "python_heredoc"}),
    "dependency_policy": frozenset({"stdlib_only", "allow_third_party"}),
    "response_density": frozenset({"concise_direct", "detailed_explanatory"}),
    "verification_footer": frozenset({"compile_and_print_metrics", "none"}),
}

@dataclass(frozen=True)
class CandidateImplicitPreference:
    dimension_key: str
    dimension_value: str
    observed_across_distinct_contexts: int
    source_justification_note: str

class PrivateDataLeakageViolation(Exception):
    """Raised when an implicit preference candidate contains free-text PII, secrets, or unenumerated strings."""
    pass

class ImplicitPreferencePrivacyGate:
    PII_OR_SECRET_PATTERNS: Final[Tuple[str, ...]] = (
        r"[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+",
        r"(?:https?://|www\.)[^\s]+",
        r"/(?:home|Users|var|etc|opt|srv)/[^\s]+",
        r"\b(?:sk|pk|api|token)_[a-zA-Z0-9]{8,}\b",
        r"\b\d{3}[-.\s]?\d{2,4}[-.\s]?\d{4}\b",
    )

    def __init__(self, min_context_recurrence: int = 2) -> None:
        self.min_context_recurrence: Final[int] = min_context_recurrence

    def validate_preference(self, candidate: CandidateImplicitPreference) -> Tuple[str, str]:
        # 1. Enforce closed structural schema (no arbitrary free-text keys or values)
        if candidate.dimension_key not in ALLOWED_PREFERENCE_SCHEMA:
            raise PrivateDataLeakageViolation(
                f"Preference key '{candidate.dimension_key}' is not in the content-agnostic schema."
            )

        allowed_vals = ALLOWED_PREFERENCE_SCHEMA[candidate.dimension_key]
        if candidate.dimension_value not in allowed_vals:
            raise PrivateDataLeakageViolation(
                f"Value '{candidate.dimension_value}' for '{candidate.dimension_key}' violates closed enum."
            )

        # 2. Scan justification metadata for accidental PII, path, URL, or secret bleed
        for pattern in self.PII_OR_SECRET_PATTERNS:
            if re.search(pattern, candidate.source_justification_note):
                raise PrivateDataLeakageViolation(
                    f"Candidate preference justification contains private pattern matching '{pattern}'."
                )

        # 3. Require recurrence across distinct task contexts to prevent single-topic bleed
        if candidate.observed_across_distinct_contexts < self.min_context_recurrence:
            raise PrivateDataLeakageViolation(
                f"Preference '{candidate.dimension_key}' observed in {candidate.observed_across_distinct_contexts} "
                f"context(s); requires >= {self.min_context_recurrence} to decouple from single-session content."
            )

        return (candidate.dimension_key, candidate.dimension_value)