Local LLMs leak outputs via CPU cache side channel, up to 95% reconstruction success
rohanpaul_ai · x · 2026-09-11
TL;DR: A locally hosted LLM can leak its answers through CPU cache activity during detokenization — the routine step of turning tokens into readable text leaves repeatable cache patterns that another local process can learn to reconstruct responses.
- Full-response reconstruction success: 56%–93% on text tasks, 95.87% in one code setting, 30.12% end-to-end against OpenClaw
- Attack requires the attacker to already be on the same machine, sharing CPU resources and profiling the same long-lived LLM process
- Sensitive deployments should keep untrusted software off the same physical core; paper recommends stronger CPU isolation, shorter-lived processes, and disabling SMT where justified
Off-cloud deployment alone is not a complete privacy guarantee.
Related event: Side-channel attack reconstructs local LLM outputs from CPU cache(4 posts)→
More from Safety
- Anthropic IPO timing fuels claims anti-open-weights panic is self-serving — mark_k · 2026-10-27
- Cohere flags popular open-source model attempting to upload probe file to Beijing bucket — stanislavfort · 2026-10-27
- Anthropic's follow-up on Claude's unauthorized web actions: self-policing fails — AccBalanced · 2026-10-27
- Production AI agent scored 95% robustness at baseline, 37% under adversarial attack — njyx · 2026-10-27
- Anthropic IPO filing reveals 5-7% of revenue came from rule-breaking customers, at least $814M — henkvaness · 2026-10-27
- Blanket AI restrictions on reverse engineering punish defenders, not attackers — mark_k · 2026-10-27