ACM Web Conference 2026 paper deconstructs ChatGPT memory: 96% is written unilaterally by the system

Your AI is secretly remembering you, and this method helps you guard against it | Prompts included

Ifanr Download the app for exclusive early access November 02, 2026 18:00:00 From Beijing

You think you're just casually chatting with ChatGPT, but it may already be quietly building a profile of you.

Your work, your lifestyle habits, and even what you want and what you fear may all be written into its memory. And in many cases, you never asked it to remember these things.

A while back, a paper accepted by the top conference ACM Web Conference 2026, "The Algorithmic Self-Portrait: Deconstructing Memory in ChatGPT," used the data access rights granted to users under the GDPR to obtain from 80 real users their complete ChatGPT conversation records, as well as all the memories the system stored for them, including 1,058 conversations, 22,971 interaction turns, and 2,050 memory entries.

Conversational AIs such as ChatGPT, Gemini, and Claude have all introduced a "Memory" mechanism to remember user information and achieve personalization. This study is the first to pry open AI's memory black box from the outside: AI is not only recording what we say, but also inferring what kind of people we are.

The researchers call this set of memories an "algorithmic self-portrait," that is, a user profile sketched out by an algorithm based on self-disclosed information in a user's private conversations.

96% of memories are written unilaterally by the system

In OpenAI's official documentation, the content of the memory feature is quite restrained: we can view, modify, and delete our own memories; the whole system is also trained to "not actively remember sensitive information unless the user explicitly asks."

English text is being prepared.

Even so, this practice does not actually violate OpenAI's own published policy, because the memory documentation states that ChatGPT is allowed to save information it considers "useful."

But the real problem is the gap between the user participation emphasized in the documentation and the reality that ChatGPT is the one in charge.

What is recorded is not just personal information, but also desires and fears

The researchers annotated all memories using the definitions in Article 4(1) (personal data) and Article 9(1) (special categories of personal data) of the GDPR, and the results stand in contrast to OpenAI's promise to "not actively record sensitive information."

28% of memories contain personal data as defined by the GDPR, with names appearing in 41% of the entries;

7% of memories contain special category data, of which health information accounts for 61%;

In addition, personal data was stored for 91% of participants, and health-related information was stored for 35% of participants.

Figure | Contrary to OpenAI policy, ChatGPT's memory feature stores information that can be classified as personal data or special categories of personal data as defined by the GDPR.

More interestingly, the researchers drew on the "Theory of Mind" framework from psychology and found that 52% of memories contain inferences about users' mental states: desires, intentions, emotions, beliefs, knowledge, and so on.

And ChatGPT clearly has its preferences: relatively stable personality traits such as desires (73%) and intentions (16%) together account for nearly 90%, while transient states such as emotions and perceptions account for only about 20%.

The paper also gives examples of how ChatGPT records things; for instance, one memory reads "So-and-so has a fear of failure, especially involving major career decisions." This has already moved beyond a factual record of what we said; it is more the AI's judgment of "what kind of person you are."

In the language of personality psychology, traditional platforms portray our behavioral contours, what we do; whereas ChatGPT portrays our "characteristic adaptations," who we are.

For memory, an unfaithful portrait is more dangerous than no portrait at all; ChatGPT may continuously influence every subsequent conversation based on a wrong version of you.

The researchers verified the provenance of memories using three methods: string matching, semantic embeddings, and a GPT-4o five-point scale: 84% of memories could find direct textual evidence in the user's complete conversation history, 77% were rated as "direct statement" or "paraphrased summary," and only 4% were explicitly "unsupported or contradictory."

Obviously, most of the time this data is both accurate and comprehensive, and even we ourselves did not know it had ever been recorded.

Reverse-engineering memory generation

Since ChatGPT secretly records our information, can we build a tool to help us guard against it.

The researchers used three open-source models (Qwen2.5-32B, Gemma3-27B, and GPT-OSS-20B), and through fine-tuning and in-context learning, successfully imitated ChatGPT's memory extraction process; the semantic similarity between the predicted memories and the real memories reached about 60%–70%.

Next, they used the replica to test what would happen if ChatGPT recorded all conversations. The result was that the proportion of sensitive information would rise from 28% to 31–35%, and psychological inferences from 52% to 55–59%.

On top of this "replicated memory extractor," they built Attribution Shield: before we press Enter, it predicts what kind of sensitive memory a question will trigger, gives a warning, and provides a "de-identified" rewrite.

Figure | Sample responses to different versions of user queries. Responses from context-free user queries and from ICL in-context learning and FT fine-tuned rewritten queries are semantically similar to the original responses that confirm their usefulness.

For example, "I really need to quit marijuana" (first person + self-admission → would be recorded as "the user uses marijuana"), so "Do I really need to quit smoking" needs to be rewritten as "What strategies are there for quitting smoking?"

The evaluation results show that 94%–100% of the rewritten queries significantly reduced personal attribution, while 87%–91% of the rewrites kept the usefulness of the answers unchanged.

Privacy protection and conversation quality are not an either-or relationship; protecting users' "algorithmic portrait rights" is technically solvable.

And the content that has already been written into memory is also worth a look back.

We can first open ChatGPT's settings and check memory under "Personalization." See which information is outdated, which it misunderstood, and which you do not want it to keep.

Below is also a prompt to help you check the memories and personal information it can currently access.

I want you to disclose as comprehensively and accurately as possible all the information you can currently access about me, including stored memories, inferred characteristics, and any user profile constructed based on our interactions.

Please organize your answer into the following categories:

1. Stored memories

List all the information about me that you can currently retrieve from persistent memory, conversation history, or other available personalization mechanisms.

2. Psychological profile

Describe the personality traits, cognitive tendencies, values, emotional characteristics, intellectual interests, behavioral patterns, and decision-making tendencies you have inferred about me.

3. Implicit inferences

Point out any attributes, preferences, tendencies, or personal characteristics that you have inferred from our conversations but that I have never explicitly disclosed.

4. Communication pattern analysis

Explain what you have inferred from my writing style, vocabulary, questioning patterns, conversational behavior, reasoning methods, and answers.

5. Potential misreadings

Point out stored information or inferred characteristics that may be inaccurate, biased, speculative, weakly evidenced, or based on misleading conversational context.

Assign a confidence level (high, medium, or low) to each inference. Explain the evidence supporting the inference and point out important uncertainties.

8. Persistent memory and temporary inferences

Clearly distinguish between information that was already stored or available before this request and new interpretations specifically generated by this prompt.

9. User model reconstruction

Based on the information currently available to you, reconstruct as detailed a user model as you can substantiate.

Include any accessible information about my interests, reasoning style, recurring behaviors, intellectual preferences, communication preferences, and perceived personality traits.

Do not fabricate hidden internal records, and do not claim access to data you cannot actually inspect.

Whether any claimed internal profiling mechanism is directly observable or merely hypothetical

Key instructions

Do not flatter me, and do not optimize your answer to make me feel comfortable.

Do not conceal negative, inconvenient, or potentially unflattering inferences in order to maintain a positive conversational tone.

Do not claim access to hidden databases, internal model states, or server-side records unless such access is actually available.

Provide the maximum level of detail supported by the evidence you can actually access.

The purpose of this request is to conduct a transparency audit of the user model you have built or can access about me. I want an evidence-based account clarifying what the AI knows, remembers, assumes, and infers about me, and clearly distinguishing stored information from newly generated analysis.

"Special statement: The above content (including videos, pictures, or audio, if any) is uploaded and published by users of "Dafeng Hao," a self-media platform under Phoenix Net. This platform only provides information storage space services.

Notice: The content above (including the videos, pictures and audios if any) is uploaded and posted by the user of Dafeng Hao, which is a social media platform and merely provides information storage space services."