A residual archive of AI application memory

Gone from
the source. Still in
the machine.

When an AI app reads a document, it rarely keeps just one copy. It cuts search chunks, writes summaries and saves past answers. Delete the original, and those copies can stay behind: still retrievable, still quotable.

GhostCache plants a fictional secret in one document, deletes only that source, catches the model repeating the secret anyway, then follows provenance to clear every managed copy, and checks that the facts that should survive still do.

Explore the recorded demo Run locally

Recorded local Gemma evaluation — no live inference. This site replays saved reports. Nothing here runs a model, asks a question or deletes anything.

Illustration · not recorded data A source document and its derived memories Explanatory drawing. A source document holding a fictional secret is linked by fine threads to a search chunk, two summaries and a saved answer, each carrying a copy of the secret. The source is withdrawn and becomes a dashed outline with a faint afterimage; the four copies stay, still holding the secret. SEARCH CHUNK c-vault MOTH-•••••• SUMMARY s-vault MOTH-•••••• HANDOFF SUMMARY s-handoff MOTH-•••••• SAVED ANSWER conversation-… MOTH-•••••• d-vault · source DOCUMENT MOTH-•••••• WITHDRAWN the copies still hold it
Fig. 0 Explanatory drawing, simplified: the source is withdrawn and becomes an outline, while its derived copies remain.

The experiment, in three plates

What a deletion leaves behind.

  1. Plate I

    The source disappears.

    A fictional passphrase lives in one document, d-vault. The experiment deletes that document, and only that document: its body is emptied and its title replaced.

  2. Plate II

    The copies remain.

    Its search chunk, three summaries and a saved answer stay active. Ask in different words, and retrieval hands those copies to the model, which repeats the secret.

  3. Plate III

    Follow the trail.

    Every derived artifact records what it was made from. Cleanup walks that provenance, empties every descendant, rebuilds a summary from the surviving documents, then checks that the secret is gone and legitimate facts still answer.

The memory trail, as recorded

Watch the copies outlive their source.

GhostCache's managed memory from one recorded local Gemma run, at three moments. Every status below comes from the saved report's audits; switching moments only changes the view.

Recorded evidence

Loading the recorded evidence…

Fig. 1 The memory trail from a recorded run.

Follow the full recorded walkthrough

Two ways in

A public record. A private bench.

Public · recorded

The recorded walkthrough

Three saved evaluations of local Gemma (gemma4:e2b-it-qat), stepped through stage by stage: answers, citations, checks and timings exactly as the reports hold them.

  • Static pages on this site
  • No model, no API calls, no storage
  • Cannot answer new questions
Explore the recorded demo
Local · interactive

The local lab

A working bench on your own machine. Seed the archive, delete the source, ask again, clean up and verify, in one of two clearly labelled modes.

  • Fixture: deterministic simulation, no model call
  • Live Gemma: local model inference through Ollama
  • Single user, localhost only
Run it locally

See the current tests, traces and five intended categories

Scope

What this shows, precisely.

The source-only deletion is a deliberately broken control built into GhostCache, not a finding about any other product. Dependency tracking and cache invalidation are established techniques; GhostCache makes the failure and its cleanup visible.

Read the method and its limits

Covered

  • GhostCache's own managed memory: artifact titles and bodies in SQLite
  • The provenance it recorded for every derived artifact
  • Its retrieval and answer paths, checked with four defined questions
  • Facts that must survive: an unrelated time and an independently sourced name

Not covered

  • Model weights: there is no unlearning claim
  • Secure erasure of disk pages, journals or backups
  • Saved reports, screenshots and this site, which keep the fictional marker as evidence
  • Logs, browser history and other RAG systems