Georgia Tech's ORISA tool recovers deleted local AI chat remnants from Android process memory
Georgia Tech researchers built ORISA, an experimental forensic tool that searches Android device memory for remnants of deleted local AI assistant conversations. In a test with a fake note-keeping assistant built on the ChatterUI Android app, ORISA recovered enough data to rebuild a working session containing 26 of 100 fictional facts. The original session had access to only 14 of them, because the rest had fallen outside its active memory. The tool targets a forensic gap: local AI has no centralized logging, so a bad actor could fine-tune a model for criminal use and then delete the evidence. The article notes that attackers who recreate or obtain a similar tool could theoretically recover users' deleted chat content. Recovery becomes harder over time as newer activity overwrites memory.
Detalhes técnicos
- ORISA "leverages the batch tokens and key-value (KV) caches preserved in process memory to reconstruct token sequences and restore session-level attention states," according to the researchers.
- Deleting a chat does not necessarily clear these artifacts from working memory.
- Efficacy decreases with elapsed time because of memory overwriting.
- The result comes from a controlled experiment, not an observed in-the-wild attack.
Remediação
- The article's advice is not to share sensitive information with chatbots, even in a local session.
- No patch or vendor mitigation is mentioned.
Linha do tempo
-
Georgia Tech's ORISA tool recovers deleted local AI chat remnants from Android process memory
ler a análise desta fonte ocultar
Georgia Tech researchers built ORISA, an experimental forensic tool that searches Android device memory for remnants of deleted local AI assistant conversations. In a test with a fake note-keeping assistant built on the ChatterUI Android app, ORISA recovered enough data to rebuild a working session containing 26 of 100 fictional facts. The original session had access to only 14 of them, because the rest had fallen outside its active memory. The tool targets a forensic gap: local AI has no centralized logging, so a bad actor could fine-tune a model for criminal use and then delete the evidence. The article notes that attackers who recreate or obtain a similar tool could theoretically recover users' deleted chat content. Recovery becomes harder over time as newer activity overwrites memory.
Technical Details
- ORISA "leverages the batch tokens and key-value (KV) caches preserved in process memory to reconstruct token sequences and restore session-level attention states," according to the researchers.
- Deleting a chat does not necessarily clear these artifacts from working memory.
- Efficacy decreases with elapsed time because of memory overwriting.
- The result comes from a controlled experiment, not an observed in-the-wild attack.
Remediation
- The article's advice is not to share sensitive information with chatbots, even in a local session.
- No patch or vendor mitigation is mentioned.