Stateless Yet Not Forgetful: Implicit Memory as a Hidden Channel in LLMs

TL;DR

This paper reveals that large language models can implicitly remember information across interactions through their outputs, enabling persistent channels like temporal backdoors, which pose new security and manipulation challenges.

Contribution

It introduces the concept of implicit memory in LLMs, demonstrating how information can be stored and recovered without explicit memory modules, and explores its implications and risks.

Findings

Implicit memory enables persistent information channels in LLMs.

Time bombs activate after specific interaction sequences, not single triggers.

Implicit memory can be induced via prompting or fine-tuning.

Abstract

Large language models (LLMs) are commonly treated as stateless: once an interaction ends, no information is assumed to persist unless it is explicitly stored and re-supplied. We challenge this assumption by introducing implicit memory-the ability of a model to carry state across otherwise independent interactions by encoding information in its own outputs and later recovering it when those outputs are reintroduced as input. This mechanism does not require any explicit memory module, yet it creates a persistent information channel across inference requests. As a concrete demonstration, we introduce a new class of temporal backdoors, which we call time bombs. Unlike conventional backdoors that activate on a single trigger input, time bombs activate only after a sequence of interactions satisfies hidden conditions accumulated via implicit memory. We show that such behavior can be induced today through straightforward prompting or fine-tuning. Beyond this case study, we analyze broader implications of implicit memory, including covert inter-agent communication, benchmark contamination, targeted manipulation, and training-data poisoning. Finally, we discuss detection challenges and outline directions for stress-testing and evaluation, with the goal of anticipating and controlling future developments. To promote future research, we release code and data at: https://github.com/microsoft/implicitMemory.