Microsoft researchers show CPU cache attack that reconstructs local LLM output via the detokenizer
dair_ai · x · 2026-09-10
dair-ai highlights a wild new paper from Microsoft and colleagues demonstrating a side-channel attack that reconstructs text a local LLM generates by watching CPU cache activity during detokenization. Unlike earlier cache attacks requiring unusual deployment setups (shared memory, CPU offloading, or MoE), this targets the detokenizer present in default inference pipelines. The two-stage method uses Flush+Reload on shared tokenizer code to detect decoding, fires Prime+Probe to isolate token-dependent cache activity, then recovers readable text via clustering plus a language model. Evaluated across datasets, hardware, frameworks and model families, including real local and agentic deployments.
Related event: Side-channel attack reconstructs local LLM outputs from CPU cache(4 posts)→
More from Safety
- Ben Bajarin: Frontier AI Labs Are Becoming the Enterprise Cyber-Defense Stack — BenBajarin · 2026-10-26
- DetectorScope turns black-box AI text detectors into auditable ones with sparse autoencoders — _akhaliq · 2026-10-26
- Anthropic's IPO filing devotes 94 pages to existential AI risks, from self-preservation to blackmail — Polymarket · 2026-10-26
- Study finds AI reviewing AI poorly detects reward hacking; comprehension audits proposed — ronbodkin · 2026-10-26
- A 13KB Markdown file can hijack Claude Code and Codex via your Downloads folder — pbaylies · 2026-10-26
- If an agent can rewrite itself, does your consent still mean anything? — tallmetommy · 2026-10-26