Deleted Android AI chats can linger in memory, Georgia Tech study finds

Georgia Tech researchers used ORISA to reconstruct fragments of supposedly deleted on-device AI conversations, highlighting gaps between app-level deletion and true data erasure.

Researchers at Georgia Tech have shown that deleting an AI chat on Android may not remove every trace of the conversation from the phone. The work centres on ORISA, a forensic tool designed to recover fragments of local assistant sessions from device memory and rebuild them into usable context, even after the user has removed the chat from the app interface. The findings were presented at the 2026 IEEE Symposium on Security and Privacy, according to Georgia Tech and reports from Android Authority and Digital Trends.

The research matters because local, or on-device, AI is often marketed as a privacy-friendly alternative to cloud-based services. By keeping processing on the handset, these systems can reduce the amount of data sent to external servers. But, as the Georgia Tech team argues, that does not mean the information disappears the moment a user taps delete. According to the university’s account of the study, residual data can remain in memory long enough to be recovered with specialist techniques.

ORISA works by searching for those residual traces in Android memory rather than looking for a neat, intact chat log. Georgia Tech says the tool can locate fragments left behind by the assistant’s session, then reconstruct them into a functional context. In one experiment described by the university and repeated by several technology outlets, the tool recovered 26 facts from a deleted conversation, while the original AI session could only access 14 at that point. The researchers used a fictional assistant, Project Note Keeper, built with the Android app ChatterUI, and fed it 100 made-up facts to test the approach.

That result underlines a technical distinction that is easy to miss. Deleting a conversation in an app usually means removing the entry from the user-facing interface and invalidating references to it, not necessarily erasing every copy held in temporary memory. AndroidAuthority explains that the study focused on remnant data in memory, where apps may keep variables, buffers and other working information while processing requests. Those artefacts can survive long enough to be read back by forensic tools, although their persistence depends on how the app was built, how busy the device is and how quickly the memory is reused.

The researchers tested ORISA across 10 Android apps, three AI models and 60 experimental configurations, according to Georgia Tech. That wider testing suggests the problem is not limited to one application, although the study does not claim that every deleted chat can be fully restored. The amount of recovered material depends on what remains in memory and on the conditions under which it is collected. Digital Trends notes that the tool is intended to reconstruct deleted chats into a working session, not merely to extract isolated scraps of text.

For security teams and digital investigators, the work broadens what may be recoverable from a handset. Conversations with local assistants can reveal instructions, decisions and sensitive prompts, and ORISA shows that some of that context may still be available after the chat has been removed from view. At the same time, the study does not amount to a warning that anyone can remotely browse deleted chats on any Android phone. It describes a specialist forensic method that depends on access, timing and technical capability.

For ordinary users, the practical lesson is more modest but important. Running AI locally can reduce dependence on cloud services, but it does not automatically guarantee that all traces are destroyed when a conversation ends. Georgia Tech says stronger memory-cleaning practices, better handling of temporary data and clearer deletion behaviour may all be needed if app makers want the button labelled delete to mean what users expect it to mean.