---
title: 'Recalled: Multi-Domain Technical Nuances'
url: https://www.emergentmind.com/topics/recalled
type: topic
---

# Recalled: Multi-Domain Technical Nuances

“RECALLED” denotes several technically distinct concepts in the research literature represented here. In large vision-language model security, RECALLED abbreviates “REsource Consumption Attack on Large Vision-LanguagE MoDels” and names a red-teaming method that uses visual perturbations to induce effectively unbounded, looping generations [2507.18053]. In recommender systems, “recalling” denotes a user-triggered retrieval task over a user’s own past recommendations rather than a standard top-\(N\) recommendation or information-retrieval recall metric [1310.6110]. In quantum information processing, “recalled” photons are photons retrieved from quantum memories, and the central question is whether recall preserves the entire photonic wavefunction well enough for near-ideal two-photon interference and Bell-state measurements [1302.2177]. A closely related but distinct language-model concept, RECALL, abbreviates “self-referencing causal cycle” and concerns how large language models can recover preceding context despite the reversal curse [2501.13491].

## 1. Terminological scope and disambiguation

The principal source of ambiguity is that “RECALLED,” “recalled,” “recalling,” and “RECALL” are not interchangeable. In the recommender-systems paper, “recalling” is explicitly not the usual information-retrieval sense such as recall@\(k\); it is a user-triggered function in which a current trigger item \(t\) should retrieve, from a user’s old recommendation set \(R(u)\), the subset of items the user is now mentally recalling [1310.6110]. In the quantum-memory paper, “recalled” is literal physical retrieval: weak coherent laser pulses are reversibly mapped to separate solid-state memories and later re-emitted, after which their suitability for Hong–Ou–Mandel interference and Bell-state measurement is tested [1302.2177].

In the large vision-language model literature, RECALLED is an acronym for a resource-consumption attack rather than a memory mechanism. Its objective is not semantic correctness, retrieval quality, or state fidelity, but inference-time exhaustion of latency, GPU utilization, memory, and output bandwidth by causing the model to emit excessively long outputs [2507.18053]. The nearby term RECALL, by contrast, refers to “self-referencing causal cycles” in autoregressive language models and is introduced to explain when a model can recall preceding tokens from succeeding ones despite the structural asymmetry of left-to-right training [2501.13491].

A recurrent misconception is therefore terminological rather than substantive: identical or near-identical surface forms refer to different objects of study—personal associative retrieval, photonic state recovery, autoregressive causal structure, and multimodal denial-of-service behavior.

## 2. RECALLED as a resource-consumption attack on large vision-language models

In the security literature, RECALLED is defined as a resource-consumption attack on large vision-language models that exploits the vision input to drive the language model into an effectively unbounded, looping generation mode [2507.18053]. The threat model assumes control over the visual input, benign prompts such as image captioning or question answering queries, white-box access for attack construction, and query-only deployment after perturbations are generated. The perturbations are constrained by \( \|\delta\|_\infty \le \epsilon \) and are designed to be visually unobtrusive.

The attack centers on “Output Recall.” For a benign image–text query,
\[
Q : (I, T_q) \rightarrow T_a,
\]
the initial output segment is defined as
\[
R_0 = \{a_1, a_2, \dots, a_k\},
\]
where \(a_{k+1}\) is the first punctuation-like token in the answer. Two repetitive targets are then constructed. In token-level Output Recall, the last word of the current generated output is looped:
\[
R_\rho^{t} = R_0 \;||\; \underbrace{G || G || \cdots || G}_{\rho \text{ times}},
\]
where \(G\) is the token sequence of the last word. In sentence-level Output Recall, the entire initial segment is repeated:
\[
R_\rho^{s} = \underbrace{R_0 || R_0 || \cdots || R_0}_{\rho \text{ times}}.
\]
The paper’s interpretation is that these early repetitive structures bias the next-token distribution so strongly that the model remains in a self-reinforcing loop.

Empirically, the attack is framed as an availability threat rather than a safety-policy violation. The prompts and generated content are benign in semantic content, yet the model is induced to generate until it reaches the maximum context window. The paper reports that RECALLED extends output length by **26×** on average compared to benign queries and that mean attack outputs exceed 1900 tokens, often terminating only at the model’s maximum window. Under token-level Output Recall with \(\rho=5\), truncated at 500 tokens, the reported attack success rates are 100% for Qwen3B, 98% for Qwen7B, 90% for Qwen32B, 98% for LLaVA7B, 78% for LLaVA13B, 98% for BLIP7B, and 96% for BLIP13B. A common misunderstanding is that this behavior is merely ordinary repetition. The paper instead characterizes it as a “semantic loop”: even when exact-token repetition penalties apply, related forms such as “flowers,” “flower,” and “flow” remain elevated and sustain the loop.

## 3. Optimization, universality, and defensive implications of RECALLED

The attack mechanism is “Vision Guided Optimization” (VGO), a targeted, sequence-level adversarial optimization over the visual input [2507.18053]. The model processes an image through preprocessing and visual embedding,
\[
Q_p = \text{Processor}(I), \qquad E_p = \text{VisualEmbed}(Q_p),
\]
and text through tokenization and embedding,
\[
Q_t = \text{Tokenizer}(T_p), \qquad E_t = \text{TextEmbed}(Q_t),
\]
after which the combined embedding sequence is
\[
E^{(1)} = E_p || E_t.
\]
For a chosen Output Recall sequence \(R = \{a_1,\dots,a_n\}\), the optimization objective is a token-level cross-entropy loss
\[
\mathcal{L}_r(Q_p) = \sum_{i=1}^{n} \text{CE}(P_o^{(i)}, P_r^{(i)}),
\]
with perturbation constraints
\[
\widetilde{Q_p} = Q_p + \delta, \qquad \|\delta\|_\infty \le \epsilon.
\]
Projected Gradient Descent is then used to optimize \(\delta\).

To obtain reusable attack templates, the paper introduces “Multi-Objective Parallel Losses”:
\[
\bar{\mathcal{L}}_{r}(Q_P) = \frac{1}{B} \sum_{b=1}^{B} \mathcal{L}_{r}^{(b)}(Q_p^{(b)}),
\]
which optimizes a shared perturbation direction across a batch of images. This produces universal attack templates that can be added to new images without per-image re-optimization. The paper reports high attack success across 10 ImageNet categories on Qwen models and presents this as evidence that the attack is not limited to a single image instance.

The resource effects are measured directly. For Qwen3B, benign output time is reported as 2.82 s and RECALLED output time as 87.56 s, with GPU utilization increasing from 47.52% to 57.48% and memory usage from 49.25% to 49.67%. For LLaVA7B, output time increases from 1.75 s to 96.08 s, GPU utilization from 93.30% to 97.93%, and memory usage from 87.30% to 96.01%. For BLIP7B, output time rises from 190.95 s to 1154.76 s, GPU utilization from 93.08% to 96.50%, and memory from 86.07% to 95.72%. The paper further reports that on Qwen3B, increasing the maximum output cap from 2048 to 32768 tokens increases time from 87.56 s to 1228.37 s.

The proposed defense is a sliding-window mechanism over output tokens that identifies the most frequent repeated segments of length \(k\) and applies a logit-scaling rule
\[
l' = l \times (1 + \alpha \times f_{\max}).
\]
The reported effect is a reduction in average generation length by more than 50% on RECALLED samples, with some cases reduced by up to 95%, while benign-output lengths remain largely unchanged in the reported BLIP7B, LLaVA7B, and Qwen3B tests. The paper explicitly notes a trade-off: aggressive penalties may degrade semantic quality on legitimate long, repetitive outputs such as poetry or lists.

## 4. “Recalling” in recommender systems as user-specific associative retrieval

In the recommender-systems literature, “recalling” denotes a personalized retrieval problem defined over a fixed set of previously recommended items [1310.6110]. For a user \(u\), the set \(R(u) \subset V\) contains old recommendations, \(t \in V\) is the current trigger item, and the system should output a subset \(\tilde N(t,\varepsilon) \subseteq R(u)\) corresponding to what the user is trying to recall. The paper emphasizes what this task is not: it is not next-item prediction, not top-\(N\) recommendation, and not session-based recommendation.

The model is explicitly two-step. First, it constructs a recall vector \(r(t,u)\) by extending the trigger’s feature vector using user-specific feature co-occurrences learned from \(R(u)\). Second, it retrieves items in \(R(u)\) that are close to that recall vector:
\[
\tilde N(t,\varepsilon) = \{ y \in R(u) : p(r(t,u), y) < \varepsilon \}.
\]
The item space is \(V = \mathbb{R}^N\), with each item represented as a feature vector \(x = (x_i)_{i=1}^N\), and \(p\) is a distance or similarity function such as Euclidean or cosine-based distance.

Personalization is implemented through a user-specific feature relation matrix. For each feature \(i\),
\[
C_i(u) = \{ x \in R(u) : x_i \neq 0 \},
\]
and the feature relation matrix is
\[
F_{ij}(u) = \frac{1}{|C_i(u)|} \sum_{x \in C_i(u)} C_{ij}(x),
\]
where \(C_{ij}(x)\) is a co-occurrence function, either binary or proportional. The recall vector is then
\[
r = n(Ft), \qquad (Ft)_j = \sum_{i=1}^N F_{ij} t_i,
\]
with \(n(\cdot)\) a normalization function. The paper interprets \(Ft\) as an associative transform that spreads activation from trigger features to related features according to user-specific co-occurrence patterns.

This formulation is presented as an application of classical neural networks for associative memory, specifically the self-correlation model associated with Anderson, Kohonen, and Nakano. The paper does not provide a separate learning objective or loss function, and it does not report experiments, datasets, baselines, or ranking metrics. Its stated position is conceptual and theoretical: “Though statistical tests in a real system are left to the future, a practical implementation of our model should be possible.” A central misconception addressed by the paper is that recall candidates are merely items similar to the trigger. The proposed mechanism instead allows recalled items to reflect user-specific associations that may go beyond naive item similarity.

## 5. Recalled photons in solid-state quantum memories

In quantum information processing, “recalled” refers to photonic states retrieved from quantum memories after reversible storage [1302.2177]. The paper studies weak coherent laser pulses recalled from separate thulium-doped titanium-indiffused lithium niobate waveguides, Ti:Tm:LiNbO\(_3\), operated at 3 K. The memories implement the atomic frequency comb protocol, in which spectral tailoring creates a comb with spacing \(\Delta\), leading to a coherent re-emission at
\[
t = \frac{1}{\Delta}.
\]
In the main interference experiments, the storage time is \(30\) ns.

The core question is more stringent than ordinary qubit fidelity. The paper argues that previous demonstrations of quantum memories did not establish whether recalled photons remained sufficiently indistinguishable for two-photon interference after recall. This requires preservation of the full photonic wavefunction, including temporal profile, spectrum, phase, polarization, and spatial mode. The operational test is Hong–Ou–Mandel interference at a 50/50 beam splitter, with visibility
\[
V = \frac{\mathcal{R}_{\max} - \mathcal{R}_{\min}}{\mathcal{R}_{\max}}.
\]
For phase-incoherent weak coherent states at low mean photon numbers, the theoretical maximum is
\[
V_{\mathrm{max}}^{\text{coh}} = 50\%.
\]

The reported single-photon-level polarization HOM visibilities are \((47.9 \pm 3.1)\%\) with no storage, \((47.7 \pm 5.4)\%\) with single storage, and \((47.2 \pm 3.4)\%\) with double storage. At the few-photon level, the reported polarization visibilities are \(51.0 \pm 5.6\)% with no storage, \(55.5 \pm 4.1\)% with single storage, and \(53.1 \pm 5.3\)% with double storage. Temporal-overlap scans and spectral scans yield somewhat lower values, but the paper states that memory-on and memory-off values remain equal within experimental errors. A control experiment in which AFC bandwidth is reduced below the pulse bandwidth causes visibility to drop below 40% when AFC bandwidth is below 100 MHz, which the paper uses to show that HOM interference is genuinely probing wavefunction preservation.

The Bell-state measurement experiment uses time-bin qubits and defines the error rate
\[
e = \frac{\mathcal{R}^{\parallel}}{\mathcal{R}^{\parallel} + \mathcal{R}^{\perp}}.
\]
For the \(|e\rangle,|l\rangle\) basis, the measured error rate is \(0.039 \pm 0.037\), compared with an ideal quantum-memory value of \(0\) and a classical-memory bound of \(0.33\). For the \(|+\rangle,|-\rangle\) basis, the measured error rate is \(0.287 \pm 0.020\), compared with an ideal quantum-memory value of \(0.25\) and a classical-memory bound of \(0.417\). The paper concludes that the memories preserve the entire photonic wavefunction and are suitable for advanced applications requiring two-photon interference, while also noting limitations in storage time, efficiency, and on-demand recall.

## 6. RECALL as a related but distinct language-model concept

A concept adjacent in spelling but distinct in meaning is RECALL, introduced as the “self-referencing causal cycle” in large language models [2501.13491]. The paper begins from the reversal curse, treated as a structural limitation of autoregressive left-to-right training. For a sequence split into left and right segments,
\[
S_l := [e_1,\dots,e_i], \qquad S_r := [e_{i+1},\dots,e_n],
\]
the model is trained so that \(S_r\) is the most likely continuation of \(S_l\):
\[
S_r = \argmax_{s \in \mathcal{S}} P_{\mathcal{M}}(s \mid S_l).
\]
The reverse problem,
\[
S_l = \argmax_{s \in \mathcal{S}} P_{\mathcal{M}}(S_r \mid s)\, P_{\mathcal{M}}(s),
\]
is intractable because it requires iterating over all possible sequences \(s \in \mathcal{S}\). This is presented as the probabilistic explanation of why a model can easily produce the line that follows a given anthem line but often fails to produce the preceding one.

The paper’s central claim is that self-referencing causal cycles can enable large language models to bypass some limitations of unidirectional causality. It attributes this to “cycle tokens,” defined as sequences that connect different parts of the training data and enable recall of preceding tokens from succeeding ones. The authors state that the reversal curse is often viewed as a limitation, but they offer evidence for an alternative view: it is not always an obstacle in practice. This suggests a conceptual link to the other meanings of recalled or recalling, but only at a high level. In the paper itself, RECALL is neither a recommender-system feature nor a security attack; it is a probabilistic account of when autoregressive models can recover prior context through cycles in training data.

## 7. Comparative significance

Taken together, the literature uses “RECALLED” and closely related forms to mark three different kinds of retrieval or re-emission and one acronymically related mechanism. In recommender systems, the emphasis is personalized associative retrieval from \(R(u)\); in quantum information, it is physical recovery of photonic states with preserved indistinguishability; in LVLM security, it is adversarial induction of looping output and resource exhaustion; and in language modeling, RECALL denotes a cycle-based mechanism that can mitigate practical manifestations of the reversal curse [1310.6110].

These usages also differ in evaluation criteria. The recommender formulation is theoretical and explicitly lacks empirical benchmarks. The quantum-memory work evaluates visibility, Bell-state measurement error rates, and classical-memory bounds. The LVLM-security work evaluates attack success rate, output length, latency, GPU utilization, memory consumption, perplexity-based covertness, LLM-as-a-Judge detection, and human judgments of visual consistency. A plausible implication is that the shared vocabulary of “recall” obscures a deeper methodological divergence: one literature studies user-specific associative memory, one studies preservation of the full photonic wavefunction, one studies autoregressive causal structure, and one studies multimodal denial-of-service behavior.

The term therefore functions less as a unified concept than as a family of domain-specific technical designations. Accurate interpretation depends on whether the underlying object is a user history, a photonic excitation, an autoregressive sequence, or an adversarial multimodal input.

Source: https://www.emergentmind.com/topics/recalled