Georgia Tech researchers have given AI users another reason to worry about their privacy by developing a forensic tool that can recover deleted AI chats from a phone.
People are increasingly using AI for any number of tasks, including those of a personal nature. Many people are discussing their medical issues, emotional concerns, financial matters, and more with AI. Virtually all AI applications give people the ability to delete a chat, but those options appear to be far less secure than they would at first seem, at least when the AI app is running locally on a user’s phone.
As with most computers, phones, and tablets, when a conversation with AI is deleted, the underlying data may remain in memory for some time. According to Georgia Tech, researchers developed a forensic tool called ORISA. ORISA is designed to comb through an Android phone’s memory to retrieve deleted conversations. In fact, it can retrieve enough information from a device’s memory to partially recreate conversations, even to the point of allowing the user to resume the conversation.
In one experiment, researchers created a fictional AI assistant called “Project Note Keeper” using the ChatterUI Android app. They gave it 100 fictional facts about a project, then deleted the conversation.
ORISA recovered information from the deleted conversation and used it to create a new working session. When researchers asked the restored assistant to list the project notes it had been given, it returned 26 facts. The original session could access only 14 facts because the rest had fallen outside its active memory.
The experiment showed that researchers could recover information the AI had already stopped actively using.
“It can help establish what information someone shared with an AI assistant and what assistance they received,” said Ph.D. student Ken Xu, lead author of the study.
The researchers do point out that data recovery becomes harder if the phone’s memory is overwritten by other app activity. As long as the data does remain in memory, however, users cannot trust that their conversations are truly private.