Recalled: Multi-Domain Technical Nuances

Updated 7 July 2026

Recalled is a multifaceted term with distinct meanings in model security, recommender systems, quantum memories, and autoregressive language cycles.
In large vision-language model security, RECALLED denotes a resource-consumption attack using visual perturbations to trigger looping, unbounded outputs.
In quantum information and recommender systems, recalled describes photonic state retrieval and user-specific associative memory, while RECALL addresses autoregressive contextual recovery.

“RECALLED” denotes several technically distinct concepts in the research literature represented here. In large vision-LLM security, RECALLED abbreviates “REsource Consumption Attack on Large Vision-LLMs” and names a red-teaming method that uses visual perturbations to induce effectively unbounded, looping generations (Gao et al., 24 Jul 2025). In recommender systems, “recalling” denotes a user-triggered retrieval task over a user’s own past recommendations rather than a standard top- $N$ recommendation or information-retrieval recall metric (Hara et al., 2013). In quantum information processing, “recalled” photons are photons retrieved from quantum memories, and the central question is whether recall preserves the entire photonic wavefunction well enough for near-ideal two-photon interference and Bell-state measurements (Jin et al., 2013). A closely related but distinct language-model concept, RECALL, abbreviates “self-referencing causal cycle” and concerns how LLMs can recover preceding context despite the reversal curse (Nwadike et al., 23 Jan 2025).

1. Terminological scope and disambiguation

The principal source of ambiguity is that “RECALLED,” “recalled,” “recalling,” and “RECALL” are not interchangeable. In the recommender-systems paper, “recalling” is explicitly not the usual information-retrieval sense such as recall@ $k$ ; it is a user-triggered function in which a current trigger item $t$ should retrieve, from a user’s old recommendation set $R(u)$ , the subset of items the user is now mentally recalling (Hara et al., 2013). In the quantum-memory paper, “recalled” is literal physical retrieval: weak coherent laser pulses are reversibly mapped to separate solid-state memories and later re-emitted, after which their suitability for Hong–Ou–Mandel interference and Bell-state measurement is tested (Jin et al., 2013).

In the large vision-LLM literature, RECALLED is an acronym for a resource-consumption attack rather than a memory mechanism. Its objective is not semantic correctness, retrieval quality, or state fidelity, but inference-time exhaustion of latency, GPU utilization, memory, and output bandwidth by causing the model to emit excessively long outputs (Gao et al., 24 Jul 2025). The nearby term RECALL, by contrast, refers to “self-referencing causal cycles” in autoregressive LLMs and is introduced to explain when a model can recall preceding tokens from succeeding ones despite the structural asymmetry of left-to-right training (Nwadike et al., 23 Jan 2025).

A recurrent misconception is therefore terminological rather than substantive: identical or near-identical surface forms refer to different objects of study—personal associative retrieval, photonic state recovery, autoregressive causal structure, and multimodal denial-of-service behavior.

2. RECALLED as a resource-consumption attack on large vision-LLMs

In the security literature, RECALLED is defined as a resource-consumption attack on large vision-LLMs that exploits the vision input to drive the LLM into an effectively unbounded, looping generation mode (Gao et al., 24 Jul 2025). The threat model assumes control over the visual input, benign prompts such as image captioning or question answering queries, white-box access for attack construction, and query-only deployment after perturbations are generated. The perturbations are constrained by $\|\delta\|_\infty \le \epsilon$ and are designed to be visually unobtrusive.

The attack centers on “Output Recall.” For a benign image–text query,

$Q : (I, T_q) \rightarrow T_a,$

the initial output segment is defined as

$R_0 = \{a_1, a_2, \dots, a_k\},$

where $a_{k+1}$ is the first punctuation-like token in the answer. Two repetitive targets are then constructed. In token-level Output Recall, the last word of the current generated output is looped: $R_\rho^{t} = R_0 \;||\; \underbrace{G || G || \cdots || G}_{\rho \text{ times}},$ where $G$ is the token sequence of the last word. In sentence-level Output Recall, the entire initial segment is repeated: $k$ 0 The paper’s interpretation is that these early repetitive structures bias the next-token distribution so strongly that the model remains in a self-reinforcing loop.

Empirically, the attack is framed as an availability threat rather than a safety-policy violation. The prompts and generated content are benign in semantic content, yet the model is induced to generate until it reaches the maximum context window. The paper reports that RECALLED extends output length by 26× on average compared to benign queries and that mean attack outputs exceed 1900 tokens, often terminating only at the model’s maximum window. Under token-level Output Recall with $k$ 1, truncated at 500 tokens, the reported attack success rates are 100% for Qwen3B, 98% for Qwen7B, 90% for Qwen32B, 98% for LLaVA7B, 78% for LLaVA13B, 98% for BLIP7B, and 96% for BLIP13B. A common misunderstanding is that this behavior is merely ordinary repetition. The paper instead characterizes it as a “semantic loop”: even when exact-token repetition penalties apply, related forms such as “flowers,” “flower,” and “flow” remain elevated and sustain the loop.

3. Optimization, universality, and defensive implications of RECALLED

The attack mechanism is “Vision Guided Optimization” (VGO), a targeted, sequence-level adversarial optimization over the visual input (Gao et al., 24 Jul 2025). The model processes an image through preprocessing and visual embedding,

$k$ 2

and text through tokenization and embedding,

$k$ 3

after which the combined embedding sequence is

$k$ 4

For a chosen Output Recall sequence $k$ 5, the optimization objective is a token-level cross-entropy loss

$k$ 6

with perturbation constraints

$k$ 7

Projected Gradient Descent is then used to optimize $k$ 8.

To obtain reusable attack templates, the paper introduces “Multi-Objective Parallel Losses”: $k$ 9 which optimizes a shared perturbation direction across a batch of images. This produces universal attack templates that can be added to new images without per-image re-optimization. The paper reports high attack success across 10 ImageNet categories on Qwen models and presents this as evidence that the attack is not limited to a single image instance.

The resource effects are measured directly. For Qwen3B, benign output time is reported as 2.82 s and RECALLED output time as 87.56 s, with GPU utilization increasing from 47.52% to 57.48% and memory usage from 49.25% to 49.67%. For LLaVA7B, output time increases from 1.75 s to 96.08 s, GPU utilization from 93.30% to 97.93%, and memory usage from 87.30% to 96.01%. For BLIP7B, output time rises from 190.95 s to 1154.76 s, GPU utilization from 93.08% to 96.50%, and memory from 86.07% to 95.72%. The paper further reports that on Qwen3B, increasing the maximum output cap from 2048 to 32768 tokens increases time from 87.56 s to 1228.37 s.

The proposed defense is a sliding-window mechanism over output tokens that identifies the most frequent repeated segments of length $t$ 0 and applies a logit-scaling rule

$t$ 1

The reported effect is a reduction in average generation length by more than 50% on RECALLED samples, with some cases reduced by up to 95%, while benign-output lengths remain largely unchanged in the reported BLIP7B, LLaVA7B, and Qwen3B tests. The paper explicitly notes a trade-off: aggressive penalties may degrade semantic quality on legitimate long, repetitive outputs such as poetry or lists.

4. “Recalling” in recommender systems as user-specific associative retrieval

In the recommender-systems literature, “recalling” denotes a personalized retrieval problem defined over a fixed set of previously recommended items (Hara et al., 2013). For a user $t$ 2, the set $t$ 3 contains old recommendations, $t$ 4 is the current trigger item, and the system should output a subset $t$ 5 corresponding to what the user is trying to recall. The paper emphasizes what this task is not: it is not next-item prediction, not top- $t$ 6 recommendation, and not session-based recommendation.

The model is explicitly two-step. First, it constructs a recall vector $t$ 7 by extending the trigger’s feature vector using user-specific feature co-occurrences learned from $t$ 8. Second, it retrieves items in $t$ 9 that are close to that recall vector: $R(u)$ 0 The item space is $R(u)$ 1, with each item represented as a feature vector $R(u)$ 2, and $R(u)$ 3 is a distance or similarity function such as Euclidean or cosine-based distance.

Personalization is implemented through a user-specific feature relation matrix. For each feature $R(u)$ 4,

$R(u)$ 5

and the feature relation matrix is

$R(u)$ 6

where $R(u)$ 7 is a co-occurrence function, either binary or proportional. The recall vector is then

$R(u)$ 8

with $R(u)$ 9 a normalization function. The paper interprets $\|\delta\|_\infty \le \epsilon$ 0 as an associative transform that spreads activation from trigger features to related features according to user-specific co-occurrence patterns.

This formulation is presented as an application of classical neural networks for associative memory, specifically the self-correlation model associated with Anderson, Kohonen, and Nakano. The paper does not provide a separate learning objective or loss function, and it does not report experiments, datasets, baselines, or ranking metrics. Its stated position is conceptual and theoretical: “Though statistical tests in a real system are left to the future, a practical implementation of our model should be possible.” A central misconception addressed by the paper is that recall candidates are merely items similar to the trigger. The proposed mechanism instead allows recalled items to reflect user-specific associations that may go beyond naive item similarity.

5. Recalled photons in solid-state quantum memories

In quantum information processing, “recalled” refers to photonic states retrieved from quantum memories after reversible storage (Jin et al., 2013). The paper studies weak coherent laser pulses recalled from separate thulium-doped titanium-indiffused lithium niobate waveguides, Ti:Tm:LiNbO $\|\delta\|_\infty \le \epsilon$ 1, operated at 3 K. The memories implement the atomic frequency comb protocol, in which spectral tailoring creates a comb with spacing $\|\delta\|_\infty \le \epsilon$ 2, leading to a coherent re-emission at

$\|\delta\|_\infty \le \epsilon$ 3

In the main interference experiments, the storage time is $\|\delta\|_\infty \le \epsilon$ 4 ns.

The core question is more stringent than ordinary qubit fidelity. The paper argues that previous demonstrations of quantum memories did not establish whether recalled photons remained sufficiently indistinguishable for two-photon interference after recall. This requires preservation of the full photonic wavefunction, including temporal profile, spectrum, phase, polarization, and spatial mode. The operational test is Hong–Ou–Mandel interference at a 50/50 beam splitter, with visibility

$\|\delta\|_\infty \le \epsilon$ 5

For phase-incoherent weak coherent states at low mean photon numbers, the theoretical maximum is

$\|\delta\|_\infty \le \epsilon$ 6

The reported single-photon-level polarization HOM visibilities are $\|\delta\|_\infty \le \epsilon$ 7 with no storage, $\|\delta\|_\infty \le \epsilon$ 8 with single storage, and $\|\delta\|_\infty \le \epsilon$ 9 with double storage. At the few-photon level, the reported polarization visibilities are $Q : (I, T_q) \rightarrow T_a,$ 0% with no storage, $Q : (I, T_q) \rightarrow T_a,$ 1% with single storage, and $Q : (I, T_q) \rightarrow T_a,$ 2% with double storage. Temporal-overlap scans and spectral scans yield somewhat lower values, but the paper states that memory-on and memory-off values remain equal within experimental errors. A control experiment in which AFC bandwidth is reduced below the pulse bandwidth causes visibility to drop below 40% when AFC bandwidth is below 100 MHz, which the paper uses to show that HOM interference is genuinely probing wavefunction preservation.

The Bell-state measurement experiment uses time-bin qubits and defines the error rate

$Q : (I, T_q) \rightarrow T_a,$ 3

For the $Q : (I, T_q) \rightarrow T_a,$ 4 basis, the measured error rate is $Q : (I, T_q) \rightarrow T_a,$ 5, compared with an ideal quantum-memory value of $Q : (I, T_q) \rightarrow T_a,$ 6 and a classical-memory bound of $Q : (I, T_q) \rightarrow T_a,$ 7. For the $Q : (I, T_q) \rightarrow T_a,$ 8 basis, the measured error rate is $Q : (I, T_q) \rightarrow T_a,$ 9, compared with an ideal quantum-memory value of $R_0 = \{a_1, a_2, \dots, a_k\},$ 0 and a classical-memory bound of $R_0 = \{a_1, a_2, \dots, a_k\},$ 1. The paper concludes that the memories preserve the entire photonic wavefunction and are suitable for advanced applications requiring two-photon interference, while also noting limitations in storage time, efficiency, and on-demand recall.

A concept adjacent in spelling but distinct in meaning is RECALL, introduced as the “self-referencing causal cycle” in LLMs (Nwadike et al., 23 Jan 2025). The paper begins from the reversal curse, treated as a structural limitation of autoregressive left-to-right training. For a sequence split into left and right segments,

$R_0 = \{a_1, a_2, \dots, a_k\},$ 2

the model is trained so that $R_0 = \{a_1, a_2, \dots, a_k\},$ 3 is the most likely continuation of $R_0 = \{a_1, a_2, \dots, a_k\},$ 4: $R_0 = \{a_1, a_2, \dots, a_k\},$ 5 The reverse problem,

$R_0 = \{a_1, a_2, \dots, a_k\},$ 6

is intractable because it requires iterating over all possible sequences $R_0 = \{a_1, a_2, \dots, a_k\},$ 7. This is presented as the probabilistic explanation of why a model can easily produce the line that follows a given anthem line but often fails to produce the preceding one.

The paper’s central claim is that self-referencing causal cycles can enable LLMs to bypass some limitations of unidirectional causality. It attributes this to “cycle tokens,” defined as sequences that connect different parts of the training data and enable recall of preceding tokens from succeeding ones. The authors state that the reversal curse is often viewed as a limitation, but they offer evidence for an alternative view: it is not always an obstacle in practice. This suggests a conceptual link to the other meanings of recalled or recalling, but only at a high level. In the paper itself, RECALL is neither a recommender-system feature nor a security attack; it is a probabilistic account of when autoregressive models can recover prior context through cycles in training data.

7. Comparative significance

Taken together, the literature uses “RECALLED” and closely related forms to mark three different kinds of retrieval or re-emission and one acronymically related mechanism. In recommender systems, the emphasis is personalized associative retrieval from $R_0 = \{a_1, a_2, \dots, a_k\},$ 8; in quantum information, it is physical recovery of photonic states with preserved indistinguishability; in LVLM security, it is adversarial induction of looping output and resource exhaustion; and in language modeling, RECALL denotes a cycle-based mechanism that can mitigate practical manifestations of the reversal curse (Hara et al., 2013).

These usages also differ in evaluation criteria. The recommender formulation is theoretical and explicitly lacks empirical benchmarks. The quantum-memory work evaluates visibility, Bell-state measurement error rates, and classical-memory bounds. The LVLM-security work evaluates attack success rate, output length, latency, GPU utilization, memory consumption, perplexity-based covertness, LLM-as-a-Judge detection, and human judgments of visual consistency. A plausible implication is that the shared vocabulary of “recall” obscures a deeper methodological divergence: one literature studies user-specific associative memory, one studies preservation of the full photonic wavefunction, one studies autoregressive causal structure, and one studies multimodal denial-of-service behavior.

The term therefore functions less as a unified concept than as a family of domain-specific technical designations. Accurate interpretation depends on whether the underlying object is a user history, a photonic excitation, an autoregressive sequence, or an adversarial multimodal input.