Source-linked AI summary
InputSnatch: Stealing Input in LLM Services via Timing Side-Channel Attacks
Xinyao Zheng, Husheng Han, Shangyi Shi, Qiyan Fang, Zidong Du, Xing Hu, Qi Guo
TL;DR
Cache-sharing optimizations in LLM services can expose private inputs through observable timing differences, creating a timing-based side-channel risk. InputSnatch combines candidate input construction with statistical time analysis to identify cache hits and reconstruct inputs. Across cache mechanisms and deployment scenarios, it reports high attack success rates, while large search spaces and timing ambiguity constrain reconstruction.
Problem
Cache-sharing mechanisms improve LLM inference efficiency but can create timing differences that expose private inputs in privacy-sensitive applications.
Method
InputSnatch combines machine-learning and LLM-based input construction with statistical timing analysis, outlier handling, and feedback to detect cache hits.
Results
The framework achieves 62% exact partial input recovery, 12.5% exact complete input extraction, and 79.5% semantic-level reconstruction under real-world constraints.
Takeaways & Limitations
Performance optimizations based on shared caching introduce exploitable privacy side channels that privacy-preserving designs must consider alongside cryptographic protections.
Takeaways & Limitations
Expansive candidate spaces and temporal ambiguity from concurrent processing and hardware scheduling constrain accurate input reconstruction.
Abstract
from arXiv · showhide
Large language models (LLMs) possess extensive knowledge and question-answering capabilities, having been widely deployed in privacy-sensitive domains like finance and medical consultation. During LLM inferences, cache-sharing methods are commonly employed to enhance efficiency by reusing cached states or responses for the same or similar inference requests. However, we identify that these cache mechanisms pose a risk of private input leakage, as the caching can result in observable variations in response times, making them a strong candidate for a timing-based attack hint. In this study, we propose a novel timing-based side-channel attack to execute input theft in LLMs inference. The cache-based attack faces the challenge of constructing candidate inputs in a large search space to hit and steal cached user queries. To address these challenges, we propose two primary components. The input constructor employs machine learning techniques and LLM-based approaches for vocabulary correlation learning while implementing optimized search mechanisms for generalized input construction. The time analyzer implements statistical time fitting with outlier elimination to identify cache hit patterns, continuously providing feedback to refine the constructor's search strategy. We conduct experiments across two cache mechanisms and the results demonstrate that our approach consistently attains high attack success rates in various applications. Our work highlights the security vulnerabilities associated with performance optimizations, underscoring the necessity of prioritizing privacy and security alongside enhancements in LLM inference.
1. Introduction
InputSnatch exploits timing differences created by prefix and semantic cache sharing to infer private LLM inputs, addressing the search and noise challenges that hinder cache-based attacks. Experiments report effective reconstruction across medical and legal deployment scenarios.
- Motivation: The attack is motivated by LLM deployment in privacy-sensitive domains where users submit medical, financial, legal, and other sensitive information.The paper frames cache-sharing leakage as a privacy and security concern for increasingly relied-upon LLM services.
- Motivation: The attack addresses prior prompt-theft limitations involving partial semantic recovery, narrow application scope, and unrealistic white-box or unlimited-query assumptions.Earlier methods relied on response features, embeddings, or privileged access and often did not transfer across applications.
- Threat and insight: InputSnatch exploits observable timing reductions when requests share prefix or semantic caches to infer other users’ secret inputs.The attack targets both prefix caching and semantic caching, which reuse cached states or responses across requests.
- Method: The framework combines an input constructor for generating cache-hitting candidates with a time analyzer for detecting cache matches from measured response times.The constructor uses machine learning, LLM-based analysis, adaptive filtering, probabilistic ranking, and optimized search, while the analyzer uses statistical timing analysis and noise mitigation.
- Challenges: Large search spaces, noisy response times, memory and rate limits, and cache TTL constraints complicate exact input reconstruction.Vocabulary and context-window growth substantially increase candidate-search complexity, while network and scheduling effects obscure cache state.
- Results: 62% exact partial input recovery, 12.5% exact complete input extraction, and 79.5% semantic-level reconstruction demonstrate effective attacks under real-world constraints.These results are reported as the framework's overall attack effectiveness.
2. Background
Transformer LLM inference uses self-attention and autoregressive prefill/decode phases, with KV and semantic caching reducing repeated computation or responses. These optimizations improve efficiency but expose timing differences that can support input-recovery attacks.
- 2.1. Transformer-Based LLM Inference: LLM inference generates tokens autoregressively through prefill, which processes the input prompt, and decoding, which produces subsequent tokens.Autoregressive dependencies prevent full parallelization of generation.
- 2.2. Cache Optimization in LLM Inference: KV caching reuses stored key-value vectors during decoding, reducing per-step attention complexity from O(n2) to O(n).The mechanism avoids recomputing attention states for previous tokens.
- 2.2. Cache Optimization in LLM Inference: Prefix caching reuses KV states for identical request prefixes, while semantic caching reuses responses for identical or semantically similar queries.Prefix matches must occur from the beginning of the sequence, whereas semantic caching uses embedding similarity.
- 2.3. Targeted Attack Scenarios: Semantic caching compares embedded requests and directly returns cached responses above a similarity threshold, bypassing retrieval and LLM inference.Cache misses continue through vector-database retrieval and generation.
- 2.3. Targeted Attack Scenarios: Shared caching across users creates observable timing differences that can reveal whether sensitive requests or responses are cached.Streaming APIs expose sequential per-token feedback, enabling timing measurements.
3. Attack Hints and Threat Model
InputSnatch exploits timing differences between cache hits and misses, selecting prefill timing as an efficient attack signal across prefix and semantic caching. The threat model assumes shared cloud caches and faces search-space, measurement-noise, and deployment constraints.
- 3.1. Attack Hints: Prefill timing was selected as the attack vector because it distinguishes prefix-cache hits from misses and permits early termination after the first token.For prefix caching, the timing gap increases with cached-request length, while decode differences reflect reused input-token computation.
- 3.1. Attack Hints: Semantic-cache hits have negligible prefill and overall latency because cached responses bypass token-by-token generation, unlike noisy cache misses.The contrast is observable in GPTCache experiments accessing GPT-4o-mini.
- 3.2. Threat Model: The timing differential between cache hits and misses persists across model sizes, hardware, tensor parallelism, and sampling configurations.Figure 6 measures prefill time across these deployment variables using repeated vLLM runs.
- 3.2. Threat Model: The attack assumes users share cloud-side caches through an application interface and encrypted API channels, allowing cross-user cache observations without targeting the victim directly.The shared infrastructure bypasses computation on cache hits to improve throughput and latency.
- 3.3. Challenges: Real-world attacks are constrained by exponentially expanding input spaces, timing noise from network and scheduling effects, resource limits, cache TTLs, and rate limiting.Load balancing, resource contention, and provider defenses further complicate large-scale reconstruction.
4. Attack 1: Prompt Engineering
InputSnatch targets prompt-engineered applications using prefix-cache timing differences to reconstruct sensitive fields. Its constructor learns field relationships and searches candidates, while the analyzer estimates cache-hit blocks despite noisy response times.
- 4.1. Introduction to Attack Scenario: The attack targets medical consultation prompts that embed sensitive user information across six structured and free-form fields.Age and Gender are constrained, whereas Disease History and Symptoms allow customizable content.
- 4.2. Attack Methodology: The framework combines an input constructor for generating field candidates with a time analyzer for detecting cache matches from response timing.Offline learning and timing calibration support online attempts against embedded system-prompt inputs.
- 4.2. Attack Methodology: The analyzer models prefill time as proportional to (n-k) × n and retains likelihood-weighted hit-ratio candidates to handle noise and adjacent-block ambiguity.Field separation and multi-block contents help prevent occasional block-level errors from propagating across fields.
- 4.2. Attack Methodology: The constructor narrows the vocabulary search by learning field contents and probabilities from open-source datasets, then ranks candidates for sequential cache-hit attempts.Construction advances only after the preceding field hits, while failed fields trigger alternative candidates.
- 4.3. Experimental Setup: Under vLLM prefix caching with LLaMA-2 70B on an 8×A40 cluster, 600 samples achieved 86.34% block-hit prediction and 97.25% field-level detection for 800-token inputs.For 1600-token inputs, 600 samples achieved 87.13% block-hit prediction and 100% field-level detection; additional sampling produced diminishing returns.
- 4.4. Evaluation Results: Under ideal conditions, Probability-based Vocabulary achieved 67.5% disease, 53.75% symptom, and 49% overall prediction success, while GaussianNB was more efficient.GaussianNB achieved the highest overall real-world prediction accuracy at 12.50%.
- 4.4. Evaluation Results: The Finetuned LLM approach fell from 54.00% in ideal conditions to complete failure under comprehensive constraints because of variability, uncertainty, and high resource use.The results favor traditional machine-learning methods for practical accuracy, resource utilization, and operational stability.
5. Attack 2: Retrieval Augmented Generation
InputSnatch extends timing-based input theft to RAG systems using semantic caching. It combines cache-hit timing classification with structured semantic-space exploration, achieving substantial extraction success across datasets.
- 5.1. Introduction to Attack Scenario: Semantic caching in RAG systems can leak whether sensitive topics or questions are present in shared caches through timing differences between hits and misses.The attack probes semantic proximity rather than requiring exact query matches.
- 5.1. Introduction to Attack Scenario: The legal-consultation scenario targets cached inquiries whose exposure can reveal users’ legal circumstances and consultation topics.RAG services use semantic caching to reduce retrieval and inference costs for similar inquiries.
- 5.3. Experimental Evaluation: Table 4 evaluates disease, symptom, and overall attack success alongside attempts, token usage, and time under ideal and real-world constraints.The table’s scope covers comparisons among multiple construction methods and operational settings.
- 5.2. Methodologies: The time analyzer distinguishes semantic-cache hits from misses with 100% accuracy, while the constructor must generate semantically relevant queries in an extensive search space.Cached responses reduce retrieval and LLM inference, creating a measurable temporal disparity.
- 5.2. Methodologies: The constructor partitions semantic space with hierarchical clustering and explores a weighted binary tree whose weights reflect cluster cardinality.This organizes search toward likely regions while retaining systematic coverage.
- 5.2. Methodologies: Candidate ranking combines attempt history, similarity to prior attempts, and pool representativeness, while diversity thresholds prevent redundant probes.The resulting strategy balances focused exploitation with strategic exploration.
- 5.3. Experimental Evaluation: With GPTCache configured at a 0.9 similarity threshold, the constructor achieved semantic extraction success rates from 43% to 100% across datasets.The evaluation used a conservative threshold to impose stringent semantic-matching quality requirements.
6. Discussion and Defenses
The discussion frames shared caching as a performance optimization that creates exploitable privacy side channels. It recommends defenses that balance isolation and operational efficiency while acknowledging limits on input detail and attribution.
- 6.1. Discussion: Cloud-deployed LLM optimizations improve scalability but can create exploitable privacy side channels that cryptographic protections alone may not address.The paper specifically identifies leakage arising from system-level prefix cache-sharing.
- 6.1. Discussion: The attack captures secret information but lacks the fine-grained context required for precise input recovery.Embedding inversion and token-length side channels are proposed as complementary sources of granular information.
- 6.1. Discussion: The attack cannot link inferred inputs to specific users or input objects, limiting the practical use of stolen data.The authors identify user attribution as a critical practical limitation.
- 6.2. Defenses: User-level cache isolation can contain cache states within individual sessions, but it trades security gains against system efficiency.The defense strategy is presented as a deployment-dependent balance among security, performance, and user experience.
7. Related Work
Prior work studies prompt theft, memorization, and side channels through outputs, embeddings, token probabilities, and token lengths. InputSnatch differs by using timing to infer user inputs from cache behavior in complex LLM systems.
- 7.1. Side-channel Attacks on AI Systems: Side-channel attacks infer sensitive model information from timing, power, electromagnetic emissions, caches, memory access, and resource contention.These attacks exploit indirect system information rather than only model outputs.
- 7.1. Side-channel Attacks on AI Systems: Large-model side-channel attacks remain relatively rare because of system complexity, while prior work reconstructed encrypted chatbot responses from transmitted token lengths.InputSnatch instead analyzes cache-sharing dynamics through response timing.
- 7.2. Adversarial Prompts: Adversarial prompting has been used to extract sensitive system-prompt information by misaligning a model’s intended goals.This line of work treats prompt leakage as an output- or interaction-driven threat.
- 7.3. Prompt Inversion: Embedding vectors, next-token probabilities, generated images, and generated text have all been used to reverse-engineer input content.These approaches rely on residual information exposed through model representations or outputs.
- 7.4. Memorization and Privacy: Memorization enables language models to retain and expose sensitive training information, creating copyright and privacy risks.Prior studies examine training-data extraction, membership inference, PII disclosure, and privacy-preserving fine-tuning defenses.