PaperlayerView exact revision on arXiv

Source-linked AI summary

A Large-Scale Benchmark and Risk Assessment of Traffic Analysis Attacks on Cloud LLM Services

Shahrooz Pouryousef, Jesus Lopez, Saeefa Rubaiyat Nowmi, Md Mahmuduzzaman Kamol, Moinul Hossain, Muoi Tran, Mohammad Saidur Rahman

arXiv:2609.31877v1cs.CRcs.AIcs.LG

TL;DR

Encrypted traffic analysis of LLM services raises the question of how much model, prompt, and task behavior a passive observer can infer, while current evidence is fragmented across datasets and settings. This paper constructs a unified benchmark spanning direct user–LLM and multi-agent executions and evaluates leakage using encrypted traffic metadata. Fingerprinting succeeds across these targets, and leakage persists under prompt reformulation and partial traffic observation.

  • Problem

    Evidence on encrypted LLM traffic is fragmented across datasets and settings, while passive observers may infer model, prompt, or task behavior from traffic metadata.

    Source: §I · p. 1

  • Method

    The paper builds a unified encrypted-traffic benchmark spanning direct user–LLM interactions and multi-agent executions, then evaluates fingerprinting and its robustness under varied conditions.

    Source: §I · p. 2, 1) Encrypted Traffic Leaks… · p. 5, 2) LLMs Can Be Reliably Fingerprinted · p. 5

  • Results

    Model fingerprinting reaches 97.7% balanced accuracy, prompt-category fingerprinting reaches 76.7% mean accuracy, and multi-agent task fingerprinting reaches up to 90.7% accuracy.

    Source: §I · p. 2

  • Takeaways & Limitations

    Encrypted packet metadata exposes model-, prompt-, and task-level behavior, and observed leakage persists beyond a single configuration.

    Source: §I · p. 2

Abstract

from arXiv · show

Cloud-based Large language model (LLM) services create a network-level traffic side channel that can expose model, prompt, and task behavior despite encryption. From packet sizes, directions, timing, and burst structure alone, a passive local observer can infer the serving model, the user's prompt category, and the task executed by a collaborative multi-agent system. Yet current evidence is fragmented across separate datasets and settings, limiting reproducibility and comparison. We present, to our knowledge, the first unified measurement study and public benchmark of encrypted LLM traffic across both user--LLM and multi-agent executions. The large-scale benchmark contains 60,000 user--LLM interactions across 10 models and 6 prompt categories, plus 2,838 multi-agent executions covering 10 task categories and two coordination topologies. Using only encrypted packet metadata, we assess the risk of traffic analysis attack by characterizing traffic signatures, identifying the features most associated with leakage, and testing robustness under prompt reformulation, decoding-temperature changes, larger candidate model sets, and partial traffic observation. Model fingerprinting achieves 97.7\% balanced accuracy, prompt-category fingerprinting reaches 76.7\% mean accuracy, and multi-agent task fingerprinting achieves up to 90.7\% accuracy. Prompt reformulation weakens but does not remove model-specific leakage, and task fingerprints remain detectable even from a single agent's traffic.

I. INTRODUCTION

Encrypted traffic metadata can reveal model, prompt, and task behavior, but prior studies use fragmented datasets and settings. This paper builds a shared benchmark and measures leakage across direct and collaborative LLM use.

I. INTRODUCTION

  • Prior LLM traffic studies address response reconstruction, topic inference, model identification, or user profiling, but use separate datasets, labels, and adversary assumptions.This fragmentation prevents common comparison of attacks and defenses across direct and collaborative interactions.Source: §I · p. 1
  • No public benchmark jointly supports model, prompt, and task inference across direct and collaborative LLM traffic under a common passive-observer model.The paper addresses this gap with a unified benchmark and privacy-leakage assessment.Source: §I · p. 1
  • The benchmark covers 60,000 direct user–LLM interactions across 10 models and 6 prompt categories, plus 2,838 successful MultiAgentBench executions across 10 task categories and graph and star coordination topologies.All traces are collected and labeled through the same pipeline under a common passive-observer model.Source: §I · p. 2
  • 97.7% balanced accuracy for model fingerprinting, 76.7% mean accuracy for prompt-category fingerprinting, and up to 90.7% accuracy for multi-agent task fingerprinting.Prompt reformulation weakens but does not eliminate model-specific leakage, and tasks remain detectable from one participating agent’s traffic.Source: §I · p. 2
  • The study tests prompt wording, decoding temperature, candidate model-set size, and visibility of agent–LLM traffic to assess whether leakage persists across conditions.The benchmark also supports inference of serving models, prompt categories, and multi-agent tasks, and identifies associated features.Source: §I · p. 2

II. RELATED WORK

Prior work shows that encrypted traffic can reveal activities and LLM-related information, while this study considers both direct and collaborative LLM interactions. Its observation model limits the adversary to encrypted agent–LLM traffic and excludes agent-to-agent communication.

II. RELATED WORK

  • Website-fingerprinting research shows that packet sequences and timing can reveal activity despite encryption, and later work studies real traffic, network changes, and adaptive defenses.LLM traffic studies have examined response reconstruction, topic and model inference, and timing leakage; the paper extends the scope to collaborative task inference.Source: §II · p. 2
  • Prior agent-traffic studies examine individual agents or external browsing, whereas this study infers tasks from collaborative executions across graph and star topologies.The study also considers partial visibility of agent–LLM flows.Source: §II · p. 2

A. System and Observation Model

  • In the direct setting, a passive on-path observer records encrypted user–LLM traffic without decrypting or modifying it, and neither endpoint is compromised.Collaborative executions use multiple agents and star or graph-mesh coordination; agent-to-agent communication is not observable.Source: A. System and Observation Model · pp. 2–3
  • The observer sees packet timestamps, sizes, and directions, but not payloads, prompts, responses, IP addresses, endpoint identities, or agent-to-agent communication.Figure 1 contrasts direct user–LLM traffic with encrypted agent–LLM traffic in the collaborative setting.Source: A. System and Observation Model · p. 3, Figure 1 · p. 3

B. Adversary Knowledge, Objectives, and Scope

The attack is evaluated in a supervised closed-world setting, where labeled reference traces train classifiers to infer models, prompt categories, or collaborative task categories. The dataset combines direct interactions and multi-agent executions, with task and topology variation in the latter.

B. Adversary Knowledge, Objectives, and Scope

  • Under a supervised closed-world setting, the adversary trains on labeled candidate traces and predicts a model, prompt category, or collaborative task; topology is not an inference target.For multi-agent tasks, the input is aggregated traffic observed from monitored agents during one execution.Source: B. Adversary Knowledge, Objectives,… · p. 3

C. Traffic Fingerprinting Workflow

  • The common workflow segments each interaction, extracts packet- and flow-level features, and applies a trained classifier to predict the selected target label.Training and deployment use the same segmentation and feature-extraction procedure.Source: C. Traffic Fingerprinting Workflow · p. 3

A. Dataset Generation

  • The user–LLM dataset uses 60 prompts across six semantic categories, with each prompt submitted to every candidate model over 100 fresh sessions and labeled by model, prompt, category, and trial.Categories include summarization, code generation, mathematical and logical reasoning, technical explanation, and adversarial requests.Source: A. Dataset Generation · p. 3
  • The multi-agent dataset includes 10 task categories, each executed under graph and star coordination by teams of 2–5 role-specialized agents using the same Llama 3.2 3B model.Using one model isolates task and topology effects from model variation.Source: A. Dataset Generation · pp. 3–4
  • Of 4,070 successful and 42 failed multi-agent executions, 3,970 had valid encrypted-traffic captures and were retained.Tasks were independently repeated up to 15 times; database tasks also interacted with a containerized PostgreSQL system containing performance anomalies.Source: A. Dataset Generation · p. 4
  • Task categories can produce different communication structures, including differences in rounds, request and response sizes, and tool or environment activity between calls.These workflows yield distinct packet-count, size, burst, and timing patterns without access to encrypted content.Source: A. Dataset Generation · p. 4

B. Traffic Collection and Preprocessing

Traffic captures are synchronized to individual executions, anonymized, and preprocessed before feature extraction. The evaluation section characterizes traffic, assesses fingerprinting risk and associated features, and tests attack practicality using balanced accuracy and macro-F1.

B. Traffic Collection and Preprocessing

  • Captures are synchronized with execution start and end times so continuously running captures can later be sliced into per-execution traces.Traffic is captured at the client-facing interface for single-agent interactions and the proxy-facing loopback interface for multi-agent executions.Source: B. Traffic Collection and Preprocessing · p. 4
  • Preprocessing restricts packets to each execution window, normalizes timestamps, labels packet direction, and removes byte-identical duplicates while retaining genuine retransmissions.Executions with captures recording no packets due to transient tooling faults were discarded and re-executed.Source: B. Traffic Collection and Preprocessing · p. 4

C. Experimental Environment

  • The experimental pipeline ran on a high-performance computing server with two Intel Xeon Gold 6430 processors, 512 GB RAM, and two NVIDIA H100 NVL GPUs.GPU workloads used CUDA 12.8 and NVIDIA driver 595.71.05.Source: C. Experimental Environment · p. 4

V. RISK ASSESSMENT AND BENCHMARK EVALUATION

  • The evaluation characterizes encrypted traffic, assesses model, prompt-category, and task fingerprinting risk, identifies associated traffic features, and tests attack practicality.Unless otherwise stated, experiments use a Random Forest classifier and report balanced accuracy and macro-averaged F1.Source: §V · p. 4
  • Balanced accuracy is the average recall across classes, while macro-F1 is based on class-level precision and recall.The section reports both metrics for evaluation.Source: §V · p. 4

A. User–LLM Fingerprinting

A single encrypted traffic stream can carry signals about both the serving model and prompt category. The study extracts packet-level features and examines how timing and streaming patterns vary across prompts and models.

A. User–LLM Fingerprinting

  • A passive capture supports model and prompt-category inference because the model shapes response streaming while the prompt category shapes generation amount and duration.The evaluation isolates each risk by fixing the prompt for model fingerprinting and fixing the model for prompt-category fingerprinting.Source: A. User–LLM Fingerprinting · p. 4
  • The evaluation covers direct interactions with 10 Hugging Face models, with 10 additional models used to assess scalability.Unless noted otherwise, experiments use traffic from the original 10 models.Source: A. User–LLM Fingerprinting · p. 4

1) Encrypted Traffic Leaks Distinguishable Signals:

  • 176 content-independent traffic statistics are extracted per trace, spanning packet direction, payload length, arrival time, rate, bursts, idle periods, and packet ordering.After removing 8 constant features, each interaction has a 168-dimensional representation; a directional burst is a maximal sequence of consecutive payload-bearing packets in one direction.Source: 1) Encrypted Traffic Leaks… · p. 5
  • For a fixed LLM, prompt categories differ in response timing; for a fixed prompt, models differ in packet rates, durations, and streaming patterns.The observed timing cannot separate token-generation time from serving and packetization effects.Source: 1) Encrypted Traffic Leaks… · p. 5

2) LLMs Can Be Reliably Fingerprinted:

Model fingerprints reflect streamed-response packetization and timing, with burst features carrying most of the predictive signal. The results identify serving-system behavior—not architecture alone—as the fingerprint source.

2) LLMs Can Be Reliably Fingerprinted:

  • 94.2% accuracy from burst features alone is close to 95.7% from all 168 features, indicating packetization and streaming carry more signal than traffic volume.Packet-size and timing features achieve 87.83% and 66.50% in isolation, respectively, but add little beyond bursts because they capture overlapping information.Source: 2) LLMs Can Be Reliably Fingerprinted · p. 5
  • Family-only accuracy measures each complete feature family's predictive sufficiency, while removing a family and retraining measures its unique contribution.Because feature families contain different numbers of features, family-only results are not cardinality-controlled comparisons.Source: 2) LLMs Can Be Reliably Fingerprinted · p. 5
  • 95.67% accuracy with all 168 features exceeds the 10% random-guessing baseline; burst features achieve 94.17% alone, and removing them reduces accuracy by 9.33%.Table I reports feature-family analysis for model fingerprinting using one repetition per model–prompt pair and mean ± standard deviation across five prompt-grouped folds.Source: 2) LLMs Can Be Reliably Fingerprinted · p. 5, Table I · p. 5
  • Directional bursts combine the volume and duration of same-direction packets with their separation from adjacent transmissions, capturing response packetization and temporal structure.The analysis groups features by flow, packet, burst, and sequence granularity; ordering features describe packet positions, traffic concentration, and sequence-order statistics.Source: 2) LLMs Can Be Reliably Fingerprinted · p. 5
  • Streaming exposes model-dependent chunk sizes and emission intervals because output text structure, tokenization, and decoding speed affect transmitted chunks and their timing.The server sends each decoded text chunk as a separate Server-Sent Events message over a persistent HTTP connection.Source: 2) LLMs Can Be Reliably Fingerprinted · p. 6
  • The fingerprint reflects the deployed serving system, not architecture alone: same-backbone Qwen models have 100% and 96.7% recall, while common confusions cross architectures.The measured signature combines architecture, post-training, tokenization, and generation behavior.Source: 2) LLMs Can Be Reliably Fingerprinted · p. 6

3) Prompt-category fingerprinting:

With request traffic excluded and prompts held out, response packetization and timing reveal prompt categories, though performance and confusion vary across categories. Response-only features outperform request-only and all-traffic settings.

3) Prompt-category fingerprinting:

  • Request traffic alone reaches 51.68% accuracy, a shortcut associated with widely varying median encrypted prompt sizes across categories.The analysis therefore focuses on response-only features to avoid relying on prompt length, which can change without changing task semantics.Source: 3) Prompt-category fingerprinting · p. 6
  • With request packets excluded and test prompts held out, response packetization and timing identify prompt categories at 67.4% accuracy versus a 16.7% baseline.The authors attribute this leakage to generated response structure and decoding behavior, rather than prompt length.Source: 3) Prompt-category fingerprinting · p. 6
  • 67.37% accuracy with response-only traffic exceeds request-only (51.68%) and all-traffic (65.10%) settings.Packet size contributes the most unique information, reducing accuracy by 8.34 percentage points when removed; timing reduces it by 7.26 points.Source: 3) Prompt-category fingerprinting · p. 6, Table II · p. 6
  • C2 and C3 are most frequently confused, and their responses have the smallest average category-pair Wasserstein distance, 0.786.Their timing statistics are especially similar, although response length, byte volume, and duration differ substantially.Source: 3) Prompt-category fingerprinting · p. 7
  • The t-SNE embeddings show clearer local separation for models than for prompt categories, consistent with classification accuracies of 95.67% and 67.37%.The visualization is qualitative because t-SNE preserves local neighborhoods but distorts global distances.Source: 3) Prompt-category fingerprinting · p. 7, Figure 5 · p. 7

5) Information Leakage Is Concentrated in a Few Feature Families:

The information-theoretic analysis finds that model-identity leakage is concentrated in response burst-byte features, with timing a secondary signal. Burst structure captures model-specific traffic segmentation, while total response volume alone is much less informative.

5) Information Leakage Is Concentrated in a Few Feature Families:

4) Feature-space Visualization:

  • The Fano-derived accuracy upper bound is compared with held-out Random Forest accuracy, but the bound is generally loose and not Bayes-optimal.The reported gap also reflects finite-sample leakage estimation, not distance from Bayes-optimal performance.Source: 4) Feature-space Visualization · pp. 7–8
  • 3.02 bits of the 3.32-bit maximum leak through response burst-byte features, which achieve 86.85% test accuracy versus 23.08% for total response volume alone.The authors interpret burst statistics as capturing how encrypted responses are segmented into application exchanges, and the resulting signature as a deployed-system fingerprint.Source: 4) Feature-space Visualization · p. 7, Figure 6 · p. 7
  • 1.68 bits of leakage and 59.4% accuracy place response inter-arrival features second, while rate features reach 31.65% and packet-size features 23.35%.Inter-arrival timing varies continuously with decoding speed and network delivery; packet size discards burst structure.Source: 4) Feature-space Visualization · p. 7

B. Encrypted Traffic Reveals Multi-Agent Tasks

Encrypted multi-agent traffic reveals task identity through workflow structure as well as packetization and response volume. Fingerprints persist across topology changes and remain detectable when only one agent's traffic is visible, though cross-topology transfer is weaker.

B. Encrypted Traffic Reveals Multi-Agent Tasks

  • Eight of the ten highest-ranked task features are shared across graph and star, with burst volume, packet size, and early outgoing traffic prominent in both.The shared features indicate that task identity is reflected in response packetization and execution structure.Source: B. Encrypted Traffic Reveals… · p. 8, Figure 7 · p. 8
  • 85.3% (graph) and 86.0% (star) balanced accuracy with all 247 features contrast with 54.0% and 58.7% using workflow features alone.Workflow-only features exclude packet-size, byte-volume, and burst-byte features; response volume and packetization provide complementary leakage.Source: B. Encrypted Traffic Reveals… · p. 8, Figure 7 · p. 8
  • With all features, within-topology accuracy reaches 83.0%, while cross-topology accuracy reaches 52.0%, showing weaker transfer between graph and star.The authors attribute the transfer gap partly to differences in coordination structure and the traffic signatures those structures produce.Source: B. Encrypted Traffic Reveals… · p. 8, Figure 8 · p. 9
  • One agent's traffic yields 66.5% accuracy under graph and 78.0% under star; observing up to four agents raises accuracy to 84.3% and 85.9%.The figure compares accuracy as visible agent traffic increases, with a 10% random-guessing baseline.Source: B. Encrypted Traffic Reveals… · p. 8, Figure 8 · p. 9

C. Fingerprinting Persists Under Realistic Conditions

Prompt reformulation and temperature variation weaken model fingerprints, but accuracy remains above random guessing. Expanding the candidate set also reduces accuracy only modestly, leaving model fingerprints highly discriminative in these evaluations.

C. Fingerprinting Persists Under Realistic Conditions

  • Prompt reformulation reduces model-fingerprinting accuracy by 24%, and temperature randomization reduces it by up to 18%, but both remain above the 10% random baseline.With prompt reformulation, accuracy falls from 93.2% to 69.5%; tested temperatures of 0.3, 0.5, and 1.5 yield 75.0%, 88.8%, and 80.0%.Source: C. Fingerprinting Persists Under… · p. 9, 1) Lightweight Countermeasures · p. 9
  • Expanding the candidate set from 5 to 20 LLMs lowers model-fingerprinting accuracy only from 98.5% to 92%.The authors conclude that fingerprints remain highly discriminative at the larger candidate-set size tested.Source: C. Fingerprinting Persists Under… · p. 9

2) Scalability:

The 168-feature representation retains high model-fingerprinting accuracy as the candidate set grows, while application- and network-level defenses can reduce fingerprintability but carry trade-offs. The paper identifies coordinated defenses across serving layers as future work and frames the benchmark as a resource for studying metadata privacy.

2) Scalability:

  • 98.5% to 92.2% accuracy for the 168-feature representation as the candidate set grows from five to twenty models, versus 76.0% to 48.8% for the 35-feature baseline.The figure compares the two representations under a matched protocol.Source: Figure 9 · p. 9, 2) Scalability · p. 9

A. Potential Countermeasures

  • Prompt crafting reduces model-fingerprinting accuracy from 93.2% to 69.5%, while temperature variation also reduces accuracy non-monotonically.The passage notes that application- and model-level adaptations reduce but do not eliminate fingerprintability; network defenses can add bandwidth, latency, or usability overhead.Source: A. Potential Countermeasures · p. 9

B. Future Work

  • Future work could test semantics-preserving prompt reformulations and randomized decoding, batching, padding, and traffic shaping while balancing privacy gains against overhead.The proposed directions span application, model-serving, and network layers.Source: B. Future Work · p. 9

VII. CONCLUSION

  • The study presents a systematic benchmark across direct user–LLM and collaborative multi-agent interactions, where encrypted traffic metadata reveals models, prompt categories, and tasks.The released benchmark is intended to support reproducible evaluation of future attacks and defenses.Source: §VII · p. 10

Related papers

Loading 2609.31877v1…