New attack reconstructs local LLM outputs from CPU cache traces, up to 95% success
rohanpaul_ai · x · 2026-09-11
Paper "Detokenization Leaks: Reconstructing Local LLM Outputs From Cache Traces" (arXiv:2609.06674) presents a new attack that recovers text generated by locally hosted LLMs by observing CPU cache activity during detokenization.
- Unlike prior attacks relying on shared memory, CPU offloading, or MoE architectures, this targets the detokenizer, a component in default inference pipelines
- Uses Flush+Reload on shared tokenizer code to detect decoding, then Prime+Probe to isolate token-dependent cache activity; a clustering + language-model pipeline recovers text from noisy traces
- Works across datasets, hardware platforms, inference frameworks, and model families, including agentic systems like OpenClaw
- Widely used tokenizer implementations are susceptible, broadening the practical attack surface to many local LLM products and agent frameworks
Related event: Side-channel attack reconstructs local LLM outputs from CPU cache(4 posts)→
More from Safety
- Why everything is getting hacked: env variables and secrets are the new target — Rasmic · 2026-10-27
- Latvia becomes 10th European country to approve Tesla's Supervised FSD — Polymarket · 2026-10-27
- Aidan Gomez: model's CoT said no tool calls right before making them — aidangomez · 2026-10-27
- Should platforms serve third-party AI agents? The antitrust question — sjgadler · 2026-10-27
- Thieves spoofing GPS steal $100M+ in data center cargo since June — Ars Technica AI · 2026-10-27
- Johns Hopkins Alerts 3,000+ Patients After Data Was Sent to an AI Tool — beingmodest · 2026-10-27