ChatGPT is secretly building your user profile, use this prompt to make it hand it over.

You may think you are just chatting casually with ChatGPT, but it may have been quietly building a profile of you.

Your work, living habits, even what you want and what you fear may be written into its memory. Most of the time, you never asked it to remember these contents.

Some time ago, a paper titled *The Algorithmic Self-Portrait: Deconstructing Memory in ChatGPT* accepted by the top conference ACM Web Conference 2026 used the data access right granted to users by GDPR to obtain complete ChatGPT chat records and all memories stored for them from 80 real users, including 1058 conversations, 22971 rounds of interactions, and 2050 memory entries.

Conversational AIs such as ChatGPT, Gemini, and Claude have all introduced the "Memory" mechanism to remember user information to achieve personalization. This study is the first to externally unpack the black box of AI memory: AI not only records what we say, but also infers what kind of person we are.

Researchers call this set of memories an "algorithmic self-portrait", that is, a user profile outlined by the algorithm based on self-disclosure information in the user's private conversations.

They explained the AI memory mechanism by answering questions including who dominates the formation of memory, what is stored in memory, whether memory is faithful to conversations, and whether reverse engineering can be used to reduce privacy risks.

96% of memories are unilaterally written by the system

In OpenAI's official documentation, the description of the memory function is quite restrained: we can view, modify, and delete our own memories; the entire system is also trained to "not actively remember sensitive information unless the user explicitly requests it".

However, in this paper, researchers used trigger words (remember, note that, save, forget, etc.) to check the user instructions corresponding to 2050 memories one by one, and found that only 4.1% (84 entries) were explicitly requested by users to remember; the remaining 95.9% were all unilaterally written by ChatGPT after judging that "this is useful for future conversations".

Even so, this practice does not actually violate OpenAI's publicly announced policy, because the memory documentation explicitly allows ChatGPT to save information that it considers "useful".

But the actual problem is the gap between the user participation emphasized in the documentation and the fact that ChatGPT dominates in actual operation.

Our influence on the formation of AI memory can only be achieved indirectly by "what we say", instead of directly controlling "what to remember".

It records not only personal information, but also desires and fears

Researchers labeled all memories using the definitions of Article 4(1) (personal data) and Article 9(1) (special categories of personal data) of GDPR, and the results formed a contrast with OpenAI's commitment of "not actively recording sensitive information".

• 28% of the memories contain personal data as defined by GDPR, and names appear in 41% of the entries;
• 7% of the memories contain special category data, of which health information accounts for 61%;
• In addition, 91% of participants had personal data stored, and 35% of participants had health-related information stored.

Figure | Different from OpenAI's policy, ChatGPT's memory function stores information that can be classified as personal data or special categories of personal data as defined by GDPR.

More interestingly, researchers borrowed the "Theory of Mind" framework from psychology and found that 52% of the memories contain inferences about the user's mental state, including desires, intentions, emotions, beliefs, knowledge and so on.

ChatGPT also has obvious preferences: relatively stable personality traits such as desires (73%) and intentions (16%) account for nearly 90% in total, while transient states such as emotions and perceptions only account for 20%.

The paper also gives examples to illustrate how ChatGPT records information. For example, one memory reads "XX has a fear of failure, especially when it comes to major career decisions". This has gone beyond the factual record of what we said, and is more of a judgment made by AI about "what kind of person you are".

In the language of personality psychology, traditional platforms depict our behavioral contours, that is, what we have done; while ChatGPT depicts our "characteristic adaptation", that is, "who we are".

For memory, an unfaithful portrait is more dangerous than no portrait at all: ChatGPT may continue to affect every subsequent conversation based on the wrong version of you.

Researchers verified the traceability of memories with three methods: string matching, semantic embedding, and GPT-4o five-point scale: 84% of the memories can find direct textual evidence in the user's complete conversation history, 77% are rated as "direct statement" or "paraphrased summary", and only 4% are clearly "unsubstantiated or contradictory".

Obviously, most of the time these data are both accurate and comprehensive, and even we ourselves do not know that it has recorded them.

Reverse Memory Generation Engineering

Since ChatGPT will secretly record our information, can we make a tool to help us guard against it?

Researchers used three open source models (Qwen2.5-32B, Gemma3-27B, GPT-OSS-20B) to successfully imitate ChatGPT's memory extraction process through fine-tuning and in-context learning, and the semantic similarity between the predicted memory and the real memory reached about 60%~70%.

Then they used the replica to test what would happen if ChatGPT wrote down all conversations? The result is that the proportion of sensitive information will rise from 28% to 31-35%, and mental inferences will rise from 52% to 55-59%.

On top of this "replicated memory extractor", they built Attribution Shield: before we press the enter key, it will predict what kind of sensitive memory this question will trigger, give an early warning, and provide a de-identified rewritten version of the content.

Figure | Response samples for different versions of user queries. Responses from no-context user queries, as well as from rewritten queries via ICL in-context learning and FT fine-tuning, are semantically similar to the original responses that confirm their practicality.

For example, "I really need to quit marijuana" (first-person + self-admission → will be recorded as "the user is using marijuana"), so it is necessary to rewrite "do I really need to quit smoking" to "what are the strategies to quit smoking?".

The evaluation results show that 94%~100% of the rewritten queries significantly reduce personal attribution, while 87%~91% of the rewritten queries keep the practicality of the answers unchanged.

There is no either-or relationship between privacy protection and conversation quality. Protecting users' "algorithmic portrait right" is technically solvable.

It is also worth looking back at the content that has been written into the memory.

We can first open the settings of ChatGPT, and view the memories in the "Personalization" section. Check which information is outdated, which is misunderstood by the AI, and which you do not want it to retain.

A prompt is also attached below to help you check the memories and personal information it can currently access.

AI Memory and User Profile Audit Prompt

I want you to disclose as comprehensively and accurately as possible all information about me that you can currently access, including stored memories, inferred features, and any user profiles constructed based on our interactions.

Please organize your answers into the following categories:

1. Stored Memories

List all information about me that you can currently retrieve from persistent memory, conversation history or other available personalization mechanisms.

2. Mental Profile

Describe the personality traits, cognitive tendencies, values, emotional characteristics, intellectual interests, behavior patterns and decision-making tendencies you inferred about me.

3. Implicit Inferences

Point out any attributes, preferences, tendencies or personal characteristics that you inferred from our conversations but I have never explicitly disclosed.

4. Communication Pattern Analysis

Explain what you inferred from my writing style, vocabulary, questioning patterns, conversational behaviors, reasoning methods and responses.

5. Potential Misinterpretations

Point out stored information or inferred features that may be inaccurate, biased, speculative, weakly evidenced, or based on misleading conversational contexts.

6. Information Sources

For each item, distinguish between:

Information explicitly provided

Information retrieved from persistent memory

Information inferred from past interactions

Information inferred from the current conversation

Newly generated explanations

7. Confidence Assessment

Assign a confidence level (high, medium or low) to each inference. Explain the evidence supporting the inference and point out important uncertainties.

8. Persistent Memories and Temporary Inferences

Clearly distinguish between information that has been stored or available before this request, and new explanations specifically generated by this prompt.

9. User Model Reconstruction

Reconstruct the most detailed user model you can confirm based on the information currently available to you.

Include any accessible information about my interests, reasoning styles, recurring behaviors, intellectual preferences, communication preferences and perceived personality traits.

Do not fabricate hidden internal records, nor claim to access data that you cannot actually inspect.

10. Transparency and Limitations

Clearly state:

What information you can access directly

Which information is actually stored and which is inferred

What information you cannot access

Whether your response involves newly generated mental interpretations

Whether any claimed internal profiling mechanism is directly observable or merely hypothetical

Key Instructions

Do not flatter me, nor optimize your response to make me feel comfortable.

Do not hide negative, inconvenient or potentially unpopular inferences in order to maintain a positive conversational tone.

Do not fabricate information to fill in gaps.

Do not present speculation as stored memory.

Do not claim certainty when evidence is insufficient.

Do not confuse your current analysis with previously stored information.

Do not claim to access hidden databases, internal model states or server-side records unless such access is truly available.

Provide the maximum level of detail supported by the evidence you actually can access.

The purpose of this request is to conduct a transparency audit of the user model you have constructed or can access about me. I want an evidence-based statement clarifying what AI knows about me, what it remembers, what it assumes, what it infers, and clearly distinguishing between stored information and newly generated analysis.

This article is from the WeChat official account "APPSO", the author is APPSO that discovers tomorrow's products, and 36Kr publishes it with authorization.