UMPeek recovers private user models from a personalized agent's choices, with no access to memory.

Personalized agents increasingly compress retained memory into structured user models, which are commonly assumed to be more private because direct memory-extraction attacks lose the source text they target. UMPeek forms hypotheses from the choices a request leaves open, switches among ordinary follow-up tasks, and retains only claims supported and not contradicted by visible behavior. It outperforms existing attacks on a benchmark and in real systems using information confirmed to be retained. The summarized user model is an attack surface, not a privacy mitigation. arXiv 2609.03815