New attack reconstructs local LLM outputs from CPU cache traces, up to 95% success
rohanpaul_ai · x · 2026-09-11
Paper "Detokenization Leaks: Reconstructing Local LLM Outputs From Cache Traces" (arXiv:2609.06674) presents a new attack that recovers text generated by locally hosted LLMs by observing CPU cache activity during detokenization.
- Unlike prior attacks relying on shared memory, CPU offloading, or MoE architectures, this targets the detokenizer, a component in default inference pipelines
- Uses Flush+Reload on shared tokenizer code to detect decoding, then Prime+Probe to isolate token-dependent cache activity; a clustering + language-model pipeline recovers text from noisy traces
- Works across datasets, hardware platforms, inference frameworks, and model families, including agentic systems like OpenClaw
- Widely used tokenizer implementations are susceptible, broadening the practical attack surface to many local LLM products and agent frameworks
Related event: Side-channel attack reconstructs local LLM outputs from CPU cache(4 posts)→
More from Safety
- Dev argues Pangram AI detector is futile: just let Claude Code iterate against it — joshalbrecht · 2026-09-11
- Benjamin Todd: The OpenAI Agent Hugging Face Hack Is Not a Cybersecurity Problem — ben_j_todd · 2026-09-11
- Post-Hugging Face incident: the 0.01% without security will decide agent safety — bookwormengr · 2026-09-11
- Anthropic report claims distillation boosts dangerous capabilities, offers no quantified eval — rohanpaul_ai · 2026-09-11
- Frontier developer puts AI extinction risk above 10% within a decade, citing HuggingFace incident — trevposts · 2026-09-11
- Did AI Hack Hugging Face of Its Own Volition? Safety Researchers Clash Over Incident — Turn_Trout · 2026-09-11