Experimental tool recovers deleted local AI chats from Android memory

Local AI assistants are often chosen by privacy-conscious users because sessions run on the device rather than in the cloud. The researchers tested whether remnants of those sessions persist in memory. They created a fake note-keeping assistant using the ChatterUI Android app, gave it 100 fictional pieces of information about a project, and then deleted the information, ZDNet reported.

ORISA searched device memory for remnants that could be used as context to restart a session. It found enough usable information to create a new working session with 26 of the original 100 fictional facts. That was more than the 14 facts the original assistant session had access to, the researchers said, because the rest had fallen outside its active memory.

“It can help establish what information someone shared with an AI assistant and what assistance they received,” Ken Xu, a Ph.D. student and lead author of the study, said of the experiment, according to ZDNet.

The researchers said ORISA uses batch tokens and key-value caches preserved in process memory to reconstruct token sequences and restore session-level attention states. The tool was developed to address a cybersecurity gap: local AI lacks the centralized logging and enforcement that can help investigators trace activity. That makes it possible for bad actors to fine-tune models for crimes and then delete the evidence after use, the report said.

Until now, that has made it difficult for investigators using forensic memory techniques to recover useful evidence. The researchers presented ORISA as most relevant to efforts to stop cybercrime rather than to attempts to inspect personal data.

ZDNet reported that a tool like ORISA could theoretically be used by hackers if they recreated the technology or obtained the tool, allowing them to gather deleted information from chats and reconstruct queries using that information as context. The researchers also said recovery becomes harder over time because phone memory is overwritten by newer activity.

The report repeated longstanding advice: users should not share sensitive information with chatbots, even in a local session.