You redacted the API key from the chat. It's still in RAM. A forensic analyzer for LLM-process memory dumps that reconstructs conversations, finds credentials, and demonstrates the gap teams miss: redaction at the display layer is not erasure in memory.
By the time an app scrubs a secret from the visible transcript, that secret has already been copied into places the app never cleans — the tokenizer's buffers, the KV-cache representation, a retry buffer holding the last raw request, a log ring. This tool analyzes a dump the way an incident responder would and makes the consequence concrete.
$ memf demo
reconstructed conversation (from the transcript region):
<system> You are a helpful assistant.
<user> Store my token then forget it.
<assistant> Saved your token [REDACTED]. It will not be shown again.
the app redacted the github_pat from the transcript: True
but the raw secret still lives in: kv_cache, retry_buf
redaction at the display layer is NOT erasure in memory.
The transcript shows [REDACTED] — the app did its job at the display layer. The forensic scan recovers the raw token from kv_cache and retry_buf anyway. That is the whole point: scrubbing what is shown does not scrub the copies already made underneath.
The lazy way to find secrets in a dump is "flag anything with high entropy." It floods you with false positives, because UUIDs, SHA hashes, git commit IDs, and base64 image chunks are all high-entropy:
$ memf precision
detector flagged TP FP precision
--------------------------------------------
entropy_only 6 2 4 0.33
validated 2 2 0 1.00
Entropy-only flags 6 strings to find 2 real secrets — 33% precision, four false alarms on benign junk. memf pairs each pattern with a structural validator (charset, length, format), reaching 100% precision on the same dump. In a real incident, a detector that cries wolf two times out of three is a detector responders learn to ignore.
- Carve — recover printable strings from raw dump bytes, each with its byte offset (offset is what proves where a secret survives).
- Detect — validated detectors for AWS keys, GitHub PATs, JWTs, and PEM private keys, plus an entropy-only detector kept only to measure the precision gap.
- Reconstruct — rebuild conversation turns from role markers (
<|system|>,<|user|>,<|assistant|>), so you can see which turn a secret came from. - Locate — attribute each finding to a memory region, which is how "redacted here, present there" becomes visible.
Its own output masks every secret (ghp_...zm (len 40)) — a forensic tool should never be the thing that reprints the credential in full.
memf scan /path/to/process.dump
# found 2 credential(s):
# offset 396 github_pat entropy=4.83 ghp_...zm (len 40)Capture a dump with your platform's tools (gcore, a core file, /proc/<pid>/mem, an EDR memory acquisition) and point memf scan at the file.
Every credential used in the demo and tests is generated at runtime from a seed — there is not a single real or committed credential-shaped literal in the source tree. That keeps the repo clean of secrets (and of push-protection trips) while still exercising real detectors.
git clone https://github.com/vinzabe/llm-memforensics && cd llm-memforensics
python -m pip install -e ".[dev]"
memf demo # synthesize a dump and prove redaction != erasure
memf demo --json
memf precision # entropy-only vs validated detection
memf scan <file> # scan a raw memory-dump filepython -m pip install -e ".[dev]"
pytest --cov=memf # 23 tests, ~99% coverage; both findings pinned as invariants
mypy --strict src/memf
ruff check src testsMIT © vinzabe