Georgia Tech tool recovers deleted local AI chats from phone memory

Researchers at Georgia Tech have built a tool that recovers deleted conversations from locally run AI assistants, and in their experiment it retrieved more usable information than the original chat session itself could see. The tool, called ORISA, recovered 26 of 100 deleted fictional facts from a phone's working memory. The original session, by the researchers' own account, had access to only 14 of those facts, "because the rest had fallen outside its active memory." The result, reported by ZDNET, exposes a gap between what users believe local AI protects and what actually persists inside a device.

The finding matters because a growing population of privacy-conscious users runs AI assistants entirely on their phones precisely to avoid the cloud. Local sessions keep data on the device instead of transmitting it to remote servers, where it could be exposed to breaches or surveillance. The Georgia Tech work shows that deletion does not equal erasure: remnants of those conversations survive in process memory, where a purpose-built forensic tool can find them.

How did the experiment work?

The team designed a fake note-keeping AI assistant built on the ChatterUI Android app. They fed it 100 fictional pieces of information about a project, then deleted that information. The deletion was real, in the sense users understand it: the chats were gone from the interface.

ORISA then searched the device's memory for remnants of that information which could serve as context to restart the session. It found enough to reconstruct a new working session containing 26 of the original 100 facts. That figure is the core of the story. The recovered session, assembled purely from memory artifacts, held nearly twice the usable context of the assistant session the researchers had actually run, which could still access only 14 facts at that point.

The technical mechanism is specific. "ORISA leverages the batch tokens and key-value (KV) caches preserved in process memory to reconstruct token sequences and restore session-level attention states," the researchers wrote. In plain terms, modern AI systems keep computational byproducts — the batch tokens (chunks of processed text) and KV caches (intermediate stored states that let a model track earlier parts of a conversation) — in the device's working memory. Even after a user deletes a chat, those byproducts can linger. ORISA reads them out and rebuilds the conversation's context from them.

Why did the researchers build it?

ORISA was developed to fill a cybersecurity gap, not a surveillance one. The researchers identified a structural weakness of local AI: its lack of "centralized logging and enforcement." Cloud AI services typically leave records that investigators and providers can audit. A model running on a personal phone leaves no such trail.

The consequences are concrete. Bad actors can fine-tune models for crimes, the researchers noted, and then make the evidence effectively untraceable by deleting the sessions after they have finished using them. Until now, that reality has made it difficult for investigators using forensic memory techniques to recover useful evidence of that activity. ORISA changes the equation by giving forensic analysts a way to pull deleted session content out of memory, even when no server-side log exists.

The lead author framed the tool's value in investigative terms. "It can help establish what information someone shared with an AI assistant and what assistance they received," said Ken Xu, a Ph.D. student at Georgia Tech and lead author of the study.

Should ordinary users worry?

The researchers' positioning is clear: ORISA is most relevant to those trying to stop cybercrime, not to those digging into personal data. A forensic tool of this kind serves investigations, and the study's stated purpose is closing the evidence gap that local AI creates for law enforcement.

The risk profile, however, is not zero. If hackers recreate a comparable technology, or obtain a tool like ORISA itself, they could theoretically use it to gather deleted information from a victim's chats and recreate that person's queries using the recovered material as context. The attack would require access to the device's memory. But for users who chose local AI specifically because they believed on-device sessions leave nothing behind, the possibility reframes the security promise.

Time is a limiting factor. ORISA's efficacy depends on how much activity has occurred since deletion: the researchers noted that it becomes harder to recover deleted information as time passes, because the phone's memory gets overwritten by newer activity. Deleted chat remnants are not permanent artifacts. They decay as the device continues to run.

What is the practical takeaway?

The experiment's numbers define the stakes precisely. One hundred facts were shared. Fourteen remained reachable by the live session. Twenty-six were recoverable after deletion. The delta between what the assistant "knew" and what forensic recovery could reconstruct is the story: deletion removed the interface, but memory retained more usable context than the running session held.

For the AI industry, the work highlights an engineering tension. The KV caches and batch tokens that make local AI assistants responsive are the same artifacts that make their sessions forensically recoverable. A device that keeps no traces would need to manage memory differently than current implementations do.

For users, ZDNET's guidance is unchanged and blunt: do not share sensitive information with chatbots, even in a local session. The local-versus-cloud decision reduces exposure to remote breaches and data-hungry providers, but the Georgia Tech results demonstrate that it does not make deleted conversations unrecoverable. As local AI adoption grows on Android and iOS devices, the researchers' work suggests both investigators and attackers will have a technical path into sessions that users believed were gone.