Stateless yet not forgetful: implicit memory in LLMs as a hidden channel

AI reading guideResearchers from Microsoft MSRC and other institutions propose the concept of implicit memory in LLMs, referring to the model encoding state into its own outputs and recovering it when those outputs are fed back as input, thereby maintaining state across seemingly independent interactions. Based on this, the authors propose a class of time bomb backdoors whose trigger conditions must accumulate gradually across multiple interactions rather than being triggered by a single input, and provide two proof-of-concept implementations via prompting and fine-tuning. In the prompting setting, reasoning models achieve significantly higher exact match accuracy on bit setting and propagation than non-reasoning models, with non-reasoning models having a false activation rate of at least 13.2%; fine-tuning raises exact match accuracy on bit setting to 77.8%–82.4%, with false activation rates below 2% and changes in perplexity and average loss on benign tasks below 1%. The paper also notes that zero-width character encoding is completely eliminated by cleaning and rewriting defenses, while semantic-level encoding is more robust but harder for models to generate reliably, and lists risks including covert agent-to-agent communication, benchmark contamination, targeted manipulation, and training data poisoning.