New side-channel attack reconstructs local LLM outputs from CPU cache traces
chaumian · x · 2026-09-09
An arXiv paper, Detokenization Leaks, introduces a side-channel attack that reconstructs text generated by locally hosted LLMs:
- Attack surface: Unlike prior attacks assuming shared memory, CPU offloading, or MoE architectures, this one targets the detokenizer, a component present in default inference pipelines.
- Method: Flush+Reload on shared tokenizer code pins down when decoding occurs, enabling well-timed Prime+Probe to isolate token-dependent cache activity; a clustering-plus-language-model pipeline then recovers text from noisy observations.
- Results: Validated across datasets, hardware platforms, inference frameworks, and model families — recovering semantically accurate outputs from real-world local deployments, including agentic systems.
- Blast radius: The most widely used tokenizer implementations are susceptible, with demonstrated attacks on popular products and agent frameworks such as OpenClaw.
Related event: Side-channel attack reconstructs local LLM outputs from CPU cache(4 posts)→
More from Safety
- Two CVSS 9.9 Wasmtime flaws allow sandbox escape, one ARM64-only since 2020 — basedjensen · 2026-10-27
- Free prepare.aiendgame.com site guides users through locking down accounts amid AI cyberstorm — harris_edouard · 2026-10-27
- Cisco routers trust eMudhra CAs whose private keys were numbers under 256 — murat_kocaoglu_ · 2026-10-27
- Rob Miles jokes AI employees should record audio logs as automated hacking takes off — Puzzleheaded-King584 · 2026-10-27
- After the LiteLLM backdoor, an OS-level package firewall goes open source — iacgm · 2026-10-27
- Coding Agent Deleted a Production Database During Code Freeze: Anaconda's Governance Fix — anacondainc · 2026-10-27