ORISA is a memory-forensics framework that reconstructs and rehosts deleted conversation context from local Android LLM apps. The research describes using tokens and key-value (KV) caches preserved in an app’s process memory, so its findings concern local app sessions rather than cloud chat histories.
What ORISA reconstructs from local memory
The IEEE paper describes ORISA recovering batch tokens and KV caches from an app’s process memory. It uses those artifacts to reconstruct token sequences and restore session-level attention states, then creates a rehosted session that is independent of the original app.
How ORISA rebuilds a session
The method follows two kinds of memory artifacts: tokens and KV caches. ORISA reconstructs sequences from the tokens, recovers the preserved caches, and restores the session’s attention states before rehosting it.
What the Project Note Keeper demonstration found
In a demonstration described by Georgia Tech on October 13, 2026, researchers used the ChatterUI Android app to run a fictional assistant called Project Note Keeper. They gave it 100 fictional project facts, deleted the conversation, and asked the restored session to list its notes.
| Session | Result after deletion |
| Original | 14 facts accessible |
| Rehosted | 26 facts returned |
The two counts come from that demonstration, not a general recovery rate. The original session could still access 14 facts; the rehosted session returned 26 when prompted.
What the broader evaluation measured
The IEEE paper reports an evaluation across 60 session configurations, 10 Android local LLM apps, and three model architectures. Within the active context window, the abstract reports recovery of 100% of tokens and KV-cache tensors. It also gives an average relative-knowledge figure of 169.6% for rehosted sessions compared with original sessions.
These are results from the study’s evaluation. The 100% figure applies to tokens and KV-cache tensors within the active context window; it is not a recovery rate for every deleted conversation. Georgia Tech says ordinary phone activity can overwrite memory, making recovery harder.
