Question 1

What privacy risk does the paper focus on for locally run LLMs?

Accepted Answer

It focuses on privacy leakage that can occur through volatile memory, where forensic traces may remain in RAM after the model runs locally.

Question 2

How were RAM traces collected in the study?

Accepted Answer

FTK Imager was used to record a RAM dump after querying the DeepSeek-R1 model via the Ollama interface.

Question 3

Which types of sensitive data or artifacts did the analysis find in RAM?

Accepted Answer

The analysis found model-related strings, active network sessions, and plaintext query tokens that can remain in RAM, which are relevant for forensic investigations and privacy assessments.