Two Halves of a Story
The Tessera Protocol: A Concept for Portable, Privacy-Aware Narrative Memory in AI Systems
Abstract
Personalized AI services currently deepen their usefulness by accumulating personal data, and the accumulation creates the privacy risks that users and regulators most fear. This essay introduces a concept, the Tessera Protocol, that attempts to decouple personalization from data possession. It combines two components that are individually insufficient: a compressed symbolic narrative code, and a user-held imprint of specific life experience. A model can expand the code into a working narrative context only when both are present. The concept is at an early stage. It depends on shared formats and on agreement among AI providers, and several of its privacy properties remain hypotheses rather than demonstrated results. The essay states the proposal, identifies the threat model it must survive, and sets out the evidence that would confirm or refute it.
1. Introduction
“The Age of Surveillance Capitalism.”
Zuboff (2019), book title
Personalization in AI services follows a simple economic logic. The more a system knows about a user, the better it can serve that user, and the more data it therefore holds. Zuboff (2019) described the broader pattern in which behavioral data becomes a resource for secondary use. Conversational AI intensifies the pattern because users disclose more than preferences. They disclose reasoning, relationships, losses, and plans.
Research on identity suggests why this matters. McAdams (2001) argued that adults construct identity as an internalized, evolving life story. Ricoeur (1992) described narrative identity as the means by which a person remains the same across change, and Bruner (1991) argued that narrative is a primary way humans organize experience. If these accounts are broadly right, a person’s story is not one more data attribute. It is the structure through which the person is recognizable to themselves.
This creates a design problem with three constraints that pull in different directions. Deep personalization requires access to the story. Privacy requires that the story not be exposed. Users who move between AI providers require that it be portable. Most deployed systems resolve the tension by storing profiles inside each provider, which satisfies the first constraint and sacrifices the other two.
The proposition of this essay is that the three constraints can be addressed together by splitting the representation of a life story into two parts, neither of which suffices alone. The sections below describe the concept, its antecedents, and the objections it must answer.
2. Antecedent Framework
“A sign, or representamen, is something which stands to somebody for something in some respect or capacity.”
Charles S. Peirce, Collected Papers, vol. 2
The concept builds on earlier work on Narrative-Bound Intelligence (Kim, 2026), which proposed that user narratives be treated as compressed symbolic constraints rather than stored facts. That framework describes three layers: a stateless interaction layer, a secure narrative substrate holding compressed operators, and an external authorization layer controlling activation and update. It proposes AI-exclusive access to the substrate, authorization by user-held credentials, and privacy through lossy compression. The same work states its own limits plainly: it is primarily theoretical, no standard encoding scheme exists, and AI-exclusive access channels may face implementation constraints in current platforms.
The semiotic basis is relevant here. Peirce’s account of the sign treats meaning as a relation among a sign, its object, and an interpreter. A symbolic code does not contain a story. It stands for one, for an interpreter equipped to read it. Saussure (1916) similarly separated the signifier from what it signifies. Symbolic Persona Coding (SPC) applies this principle: a narrative is encoded as a compact symbolic structure whose meaning is realized only through interpretation by the model.
Two clarifications prevent confusion with established techniques. First, runtime conditioning of a model is not new. Prompt tuning (Lester et al., 2021), prefix tuning (Li & Liang, 2021), activation steering (Turner et al., 2023), and representation engineering (Zou et al., 2023) all shape model behavior through learned or injected signals. These signals, however, are generally specific to a given model’s internal representations. Second, SPC as used here operates at the symbolic level, which is a different layer, and the distinction becomes important in Section 4.
3. The Tessera Protocol
“How to share a secret.”
Shamir (1979), paper title
In Roman practice, a tessera hospitalis was a token broken into two halves, one kept by each party, so that recognition required the two pieces to fit. The name is used here because the proposal rests on the same structure.
The protocol has two halves.
The Tessera Key is a compressed symbolic narrative code produced by SPC. It encodes structural features of a life: transitions, recurring patterns, constraint regimes, and phases of stability or disruption. It deliberately omits the specific events that would make those structures concrete.
The Imprint is a user-held record of particular experiences that carry the personal detail the code lacks. It is entered in a prescribed format, referred to here as the Imprinting Protocol, which defines how episodic anchors are expressed so that a model can bind them to the code. The term is borrowed loosely from Lorenz (1935) to suggest an early, formative binding, and it makes no claim about ethological mechanisms.
Under the proposal, a model that receives only the Key can produce only a generic expansion, because the particular context is absent. A model that receives only the Imprint lacks the structural frame that organizes it. When both are supplied, the model expands the code into a working narrative context for the session.
The design has a cognitive analogue. Tulving and Thomson (1973) showed that retrieval depends on the match between cue and encoding conditions, so the same trace may be inaccessible without the right cue. The Imprint plays the role of the cue.
The separation should be described accurately. It is a functional separation, not an information-theoretic one. Shamir’s scheme guarantees that fewer than the threshold number of shares reveal nothing, and the Tessera design offers no equivalent guarantee. A model has priors, and given a Key alone it may generate a plausible but incorrect expansion. That is a fidelity risk. If the expansion happened to coincide with the user’s actual history, it would also be a privacy risk. Both possibilities require empirical measurement rather than assertion.
4. Portability and Opacity
“The Power of Scale for Parameter-Efficient Prompt Tuning.”
Lester et al. (2021), paper title
Portability and opacity trade against each other. A representation that is opaque to humans because it consists of model-internal adjustments is usually non-portable, since another model’s internals differ. A representation that is portable because it is expressed in a shared symbolic grammar is easier to inspect, because the grammar must be documented.
The Tessera design accepts the second horn. What is portable is the symbolic code and the imprint format, not any latent state. Each model expands the code using its own weights. The consequence is that expansions will differ across providers, and consistency becomes a measurable property. Kerckhoffs (1883) offers the relevant security principle: a system should remain secure even if everything about it except the key is public. The grammar and the Imprinting Protocol should therefore be open specifications, and protection should rest on key custody and on the two-part structure, not on obscurity of the format.
Key management follows the same logic. A single key reused across every provider would convert a breach at any one of them into a breach at all of them. The design instead assumes a user-held master secret from which provider-specific keys are derived, for example through a standard key derivation function (Krawczyk & Eronen, 2010). The approach mirrors the design of passkeys under the WebAuthn standard (W3C, 2021), where credentials are created per relying party so that no shared secret exists across services. A common name for a cross-provider key would therefore invite confusion with that standard, which is one reason for adopting a distinct name for this concept.
Interoperability also requires institutional agreement. A format that only one provider honors provides no portability. The legal context is supportive in principle, since the General Data Protection Regulation establishes a right to data portability (Regulation (EU) 2016/679, Art. 20), but a right to export data does not by itself produce a common expansion standard.
5. Threat Model
“Intel SGX Explained.”
Costan & Devadas (2016), paper title
A credible privacy proposal must state what it assumes about adversaries. Four threats are central.
Runtime exposure. The statement that only the AI can read the material is true only in a limited sense. To use the Imprint, the model’s runtime must process its content, which means the provider’s compute environment encounters it in usable form at that moment. Protection at runtime therefore depends on either local inference, a trusted execution environment, or trust in the provider. Trusted execution environments have been studied extensively and have also been attacked, as in the transient-execution attacks against SGX described by Van Bulck et al. (2018). Fully homomorphic encryption (Gentry, 2009) would in principle allow computation on encrypted data, but it remains computationally impractical for general LLM-scale inference. The honest claim is that the protocol reduces exposure at rest and narrows it at runtime. It does not eliminate it.
Retention and training leakage. If a provider logs sessions, an expanded context could enter logs or training sets. Carlini et al. (2021) demonstrated that language models can memorize and emit training data. Contractual and technical commitments to non-retention are therefore preconditions, and they must be auditable.
Memory poisoning. A persistent store is an attack surface. Chen et al. (2024) showed that agents with poisoned memory or knowledge bases can be steered toward attacker-chosen behavior in the settings they tested. A Key that is silently altered could shift how a model interprets a user’s history.
Credential compromise. Loss or theft of the master secret is the conventional failure. Recovery, rotation, and revocation procedures are required, and they must not reintroduce a central escrow that defeats the purpose.
6. The Compression Illusion
“Simple demographics often identify people uniquely.”
Sweeney (2000), paper title
A central temptation is to treat compression as anonymization. The evidence from privacy research argues for caution. Sweeney (2000) showed that a few ordinary attributes can single out individuals. Narayanan and Shmatikov (2008) re-identified users in a sparse dataset using limited auxiliary knowledge. Rocher et al. (2019) estimated that most people in the United States could be re-identified from a dataset containing only a handful of demographic attributes. More recently, Staab et al. (2024) reported that language models can infer personal attributes from text with high accuracy and at low cost.
These results bear directly on the concept. A structural description of a life, such as the timing of an early loss, the shape of a career change, or the pattern of a recurring conflict, may be distinctive in combination even without a name or address. Compression reduces detail. It does not establish non-identifiability.
The dual structure is intended to raise the cost of reconstruction by withholding the episodic material. Whether it does so enough to matter is an empirical question. A defensible position is that the Key should be treated as sensitive data until tests show otherwise, and that the claim of structural privacy should be earned through adversarial re-identification studies and not through argument.
7. Context, Consent, and Withdrawal
“Privacy as contextual integrity.”
Nissenbaum (2004), paper title
Nissenbaum (2004) argued that privacy norms attach to contexts, so that the same information may flow appropriately in one setting and violate expectations in another. A life story shared with a reflective writing assistant should not appear in an advertising pipeline. Technical separation of the Key and the Imprint addresses storage but not purpose. Purpose limitation must be expressed in the consent record that accompanies each expansion.
Solove’s (2006) taxonomy of privacy harms identifies aggregation, secondary use, and exclusion from knowledge of one’s own data among the injuries that arise in information systems. Each has a counterpart here. The aggregation of many sessions into a profile, the repurposing of expanded context, and the opacity of the Key to the person it describes are all foreseeable failure modes.
Get Kim, Jace (Jeong Hyeon)’s stories in your inbox
Join Medium for free to get updates from this writer.
The regulatory baseline is relevant. Life narratives readily contain special-category data, such as health, belief, or sexual life, which the GDPR treats with heightened protection (Art. 9). The right to erasure (Art. 17) and the requirement of data protection by design and by default (Art. 25) apply to any provider that processes such material. A withdrawal mechanism must therefore do more than delete a stored Key. It must revoke derived provider keys, end active expansions, and leave an auditable record that it has done so.
8. Dependence and Identity Fixation
“Alone Together.”
Turkle (2011), book title
A persistent representation of a person can harm the person it serves. Weizenbaum (1966) observed that users attributed understanding to a trivially simple conversational program, and Turkle (2011) documented how relationships with responsive machines can substitute for human ones. A system that appears to know a user’s whole story may intensify this effect.
A second risk is fixation. McAdams (2001) emphasized that life stories are revised as lives change. A Key that persists unchanged may anchor a model to an earlier version of the person. The design should therefore treat revision as a user-controlled act, apply decay to older structural elements, and provide an exit that returns the system to baseline behavior without penalty. These properties are design requirements, and they are testable.
9. Standards and Falsifiability
“Web Authentication: An API for Accessing Public Key Credentials.”
W3C (2021), specification title
The concept cannot be realized by one organization acting alone. It requires a shared specification covering at least the following: the SPC grammar, the Imprint schema and its versioning, key derivation and wrapping, the consent receipt format, revocation semantics, and audit requirements. The standardization of passkeys through the W3C and the FIDO Alliance illustrates that competing providers can converge on a common credential model when the benefits of interoperability are clear. Whether the same convergence is plausible for narrative memory is uncertain, and it is a matter for negotiation among providers, regulators, and users.
The concept is only worth pursuing if it can fail. The following tests would discriminate between its claims.
- Expansion without imprint. Measure how closely a model’s expansion from a Key alone matches the user’s true history, and how often it fabricates plausible detail.
- Re-identification. Test whether Keys, individually and in aggregate, allow an adversary with realistic auxiliary data to identify individuals.
- Cross-model consistency. Compare expansions of the same Key and Imprint across different models and versions.
- Retention audit. Verify that no expanded context persists in provider logs or training data.
- Revocation efficacy. Confirm that revoking a provider key ends access in practice.
- User comprehension. Assess whether users understand what they have consented to.
10. Conclusion
The Tessera Protocol is a proposal at an early stage. Its central idea is modest and specific: represent a life story as two halves, a symbolic structure and a private imprint, so that neither the provider’s storage nor any single credential holds the whole. If the idea works, it offers a route to personalization that does not require each provider to hold a complete profile and that lets a user carry continuity across providers.
The limits are equally clear. Runtime exposure cannot be wished away. Compression does not by itself guarantee anonymity. Cross-provider operation requires agreement that no individual researcher can supply. The appropriate stance is therefore to treat the concept as a research agenda with explicit tests, and to defer claims of privacy until the evidence supports them. The more important question, perhaps, is not how an AI can remember a person, but under what conditions a person can let it, and take that permission back.
Disclaimer: This essay is an independent research perspective intended for informational purposes. It does not claim to present a definitive solution to AI memory or represent the official position of any AI company.
References
Bruner, J. (1991). The narrative construction of reality. Critical Inquiry, 18(1), 1–21.
Carlini, N., Tramèr, F., Wallace, E., et al. (2021). Extracting training data from large language models. USENIX Security Symposium 2021.
Chen, Z., Xiang, Z., Xiao, C., Song, D., & Li, B. (2024). AgentPoison: Red-teaming LLM agents via poisoning memory or knowledge bases. NeurIPS 2024.
Costan, V., & Devadas, S. (2016). Intel SGX explained. IACR Cryptology ePrint Archive, 2016/086.
Gentry, C. (2009). Fully homomorphic encryption using ideal lattices. Proceedings of the 41st ACM Symposium on Theory of Computing (STOC).
Kerckhoffs, A. (1883). La cryptographie militaire. Journal des sciences militaires, 9, 5–38.
Kim, J. (2026). Narrative-Bound Intelligence: A Structural Account of Human-AI Interaction via Symbolic Persona Coding. Zenodo. https://zenodo.org/records/18116379
Krawczyk, H., & Eronen, P. (2010). HMAC-based extract-and-expand key derivation function (HKDF). RFC 5869. Internet Engineering Task Force.
Lester, B., Al-Rfou, R., & Constant, N. (2021). The power of scale for parameter-efficient prompt tuning. EMNLP 2021.
Li, X. L., & Liang, P. (2021). Prefix-tuning: Optimizing continuous prompts for generation. ACL 2021.
Lorenz, K. (1935). Der Kumpan in der Umwelt des Vogels. Journal für Ornithologie, 83, 137–215, 289–413.
McAdams, D. P. (2001). The psychology of life stories. Review of General Psychology, 5(2), 100–122.
Narayanan, A., & Shmatikov, V. (2008). Robust de-anonymization of large sparse datasets. IEEE Symposium on Security and Privacy 2008.
Nissenbaum, H. (2004). Privacy as contextual integrity. Washington Law Review, 79(1), 119–157.
Peirce, C. S. (1931–1958). Collected Papers of Charles Sanders Peirce. Harvard University Press.
Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation), Articles 9, 17, 20, and 25.
Ricoeur, P. (1992). Oneself as Another (K. Blamey, Trans.). University of Chicago Press.
Rocher, L., Hendrickx, J. M., & de Montjoye, Y.-A. (2019). Estimating the success of re-identifications in incomplete datasets using generative models. Nature Communications, 10, 3069.
Saussure, F. de (1916). Cours de linguistique générale. Payot.
Shamir, A. (1979). How to share a secret. Communications of the ACM, 22(11), 612–613.
Solove, D. J. (2006). A taxonomy of privacy. University of Pennsylvania Law Review, 154(3), 477–564.
Staab, R., Vero, M., Balunović, M., & Vechev, M. (2024). Beyond memorization: Violating privacy via inference with large language models. ICLR 2024.
Sweeney, L. (2000). Simple demographics often identify people uniquely (Data Privacy Working Paper 3). Carnegie Mellon University.
Tulving, E., & Thomson, D. M. (1973). Encoding specificity and retrieval processes in episodic memory. Psychological Review, 80(5), 352–373.
Turkle, S. (2011). Alone Together: Why We Expect More from Technology and Less from Each Other. Basic Books.
Turner, A. M., Thiergart, L., Leech, G., et al. (2023). Activation addition: Steering language models without optimization. arXiv preprint.
Van Bulck, J., Minkin, M., Weisse, O., et al. (2018). Foreshadow: Extracting the keys to the Intel SGX kingdom with transient out-of-order execution. USENIX Security Symposium 2018.
W3C (2021). Web Authentication: An API for accessing public key credentials, Level 2. W3C Recommendation.
Weizenbaum, J. (1966). ELIZA: A computer program for the study of natural language communication between man and machine. Communications of the ACM, 9(1), 36–45.
Zou, A., Phan, L., Chen, S., et al. (2023). Representation engineering: A top-down approach to AI transparency. arXiv preprint.
Zuboff, S. (2019). The Age of Surveillance Capitalism. PublicAffairs.
