Researcher recovers LLM prompt tokens from VRAM using KV cache

A forensic researcher demonstrates that local large language models retain their entire prompt context in VRAM while running, even when all disk logging and history are disabled. By attaching a debugger to the inference process and copying device memory to the host, an investigator can use the first attention layer's value vectors to recover the exact prompt tokens on classic transformers. However, the technique yields only partial recovery on hybrid state-space models like Qwen3.8. Open article →