Aspect-Channel Assaults Towards LLMs – Schneier on Safety – Cyber Tech

Aspect-Channel Assaults Towards LLMs

Listed below are three papers describing completely different side-channel assaults towards LLMs.

“Distant Timing Assaults on Environment friendly Language Mannequin Inference“:

Summary: Scaling up language fashions has considerably elevated their capabilities. However bigger fashions are slower fashions, and so there’s now an in depth physique of labor (e.g., speculative sampling or parallel decoding) that improves the (common case) effectivity of language mannequin technology. However these strategies introduce data-dependent timing traits. We present it’s attainable to use these timing variations to mount a timing assault. By monitoring the (encrypted) community site visitors between a sufferer consumer and a distant language mannequin, we will study details about the content material of messages by noting when responses are quicker or slower. With full black-box entry, on open supply methods we present how it’s attainable to study the subject of a consumer’s dialog (e.g., medical recommendation vs. coding help) with 90%+ precision, and on manufacturing methods like OpenAI’s ChatGPT and Anthropic’s Claude we will distinguish between particular messages or infer the consumer’s language. We additional present that an energetic adversary can leverage a boosting assault to get well PII positioned in messages (e.g., telephone numbers or bank card numbers) for open supply methods. We conclude with potential defenses and instructions for future work.

“When Hypothesis Spills Secrets and techniques: Aspect Channels by way of Speculative Decoding in LLMs“:

Summary: Deployed massive language fashions (LLMs) typically depend on speculative decoding, a method that generates and verifies a number of candidate tokens in parallel, to enhance throughput and latency. On this work, we reveal a brand new side-channel whereby input-dependent patterns of appropriate and incorrect speculations could be inferred by monitoring per-iteration token counts or packet sizes. In evaluations utilizing analysis prototypes and production-grade vLLM serving frameworks, we present that an adversary monitoring these patterns can fingerprint consumer queries (from a set of fifty prompts) with over 75% accuracy throughout 4 speculative-decoding schemes at temperature 0.3: REST (100%), LADE (91.6%), BiLD (95.2%), and EAGLE (77.6%). Even at temperature 1.0, accuracy stays far above the two% random baseline—REST (99.6%), LADE (61.2%), BiLD (63.6%), and EAGLE (24%). We additionally present the potential of the attacker to leak confidential datastore contents used for prediction at charges exceeding 25 tokens/sec. To defend towards these, we suggest and consider a collection of mitigations, together with packet padding and iteration-wise token aggregation.

“Whisper Leak: a side-channel assault on Massive Language Fashions“:

Summary: Massive Language Fashions (LLMs) are more and more deployed in delicate domains together with healthcare, authorized companies, and confidential communications, the place privateness is paramount. This paper introduces Whisper Leak, a side-channel assault that infers consumer immediate matters from encrypted LLM site visitors by analyzing packet dimension and timing patterns in streaming responses. Regardless of TLS encryption defending content material, these metadata patterns leak ample info to allow subject classification. We reveal the assault throughout 28 fashionable LLMs from main suppliers, attaining near-perfect classification (typically >98% AUPRC) and excessive precision even at excessive class imbalance (10,000:1 noise-to-target ratio). For a lot of fashions, we obtain 100% precision in figuring out delicate matters like “cash laundering” whereas recovering 5-20% of goal conversations. This industry-wide vulnerability poses important dangers for customers below community surveillance by ISPs, governments, or native adversaries. We consider three mitigation methods – random padding, token batching, and packet injection – discovering that whereas every reduces assault effectiveness, none supplies full safety. By way of accountable disclosure, we now have collaborated with suppliers to implement preliminary countermeasures. Our findings underscore the necessity for LLM suppliers to handle metadata leakage as AI methods deal with more and more delicate info.

Tags: tutorial papers, LLM, side-channel assaults

Posted on February 17, 2026 at 7:01 AM •
7 Feedback