New side-channel attack reconstructs local LLM outputs from CPU cache traces

chaumian · x · 2026-09-09

An arXiv paper, Detokenization Leaks, introduces a side-channel attack that reconstructs text generated by locally hosted LLMs:

Attack surface: Unlike prior attacks assuming shared memory, CPU offloading, or MoE architectures, this one targets the detokenizer, a component present in default inference pipelines.
Method: Flush+Reload on shared tokenizer code pins down when decoding occurs, enabling well-timed Prime+Probe to isolate token-dependent cache activity; a clustering-plus-language-model pipeline then recovers text from noisy observations.
Results: Validated across datasets, hardware platforms, inference frameworks, and model families — recovering semantically accurate outputs from real-world local deployments, including agentic systems.
Blast radius: The most widely used tokenizer implementations are susceptible, with demonstrated attacks on popular products and agent frameworks such as OpenClaw.

More from Safety