PaperlayerView exact revision on arXiv

Source-linked AI summary

Physical Side-Channel Attacks on Edge LLMs: Extracting Output Tokens and User Prompts

Najeh Alhalawani, Gunes Acar, Zhuoran Liu, Lejla Batina

arXiv:2610.14215v1cs.CR

TL;DR

This paper asks whether physical leakage from locally deployed LLMs can reveal generated tokens and user prompts. It uses EM measurements and learned token-classification and hidden-state-recovery attacks, reporting profiled-token accuracy and recovery of unseen tokens. The findings show that local execution alone does not guarantee privacy against physical side channels.

  • Problem

    It was unclear whether EM leakage from an edge LLM could reveal generated tokens or information about user prompts during inference.

    Source: §I · p. 1, §III · p. 3

  • Method

    The study analyzes EM leakage during edge LLM inference and trains attacks to classify tokens or recover hidden states used for token prediction and prompt reconstruction.

    Source: §I · pp. 1–2, C. Physical Side-Channel Leakage · p. 2

  • Results

    97.2% accuracy on profiled keywords; unseen tokens achieved 67.0% top-100 recovery with a median rank of 54.

    Source: §VIII · p. 12

  • Takeaways & Limitations

    Local execution alone does not guarantee privacy, and the findings provide a basis for countermeasures including EM shielding, LM Head masking, and execution randomization.

    Source: §VIII · p. 12

    Real-world deployment faces cross-session variation and dynamically shifting CPU frequencies, which the authors say require mitigation through broader profiling, trace alignment, or specialized equipment.

    Source: §VII · p. 12

Abstract

from arXiv · show

The deployment of large language models (LLMs) on edge devices is largely motivated by privacy concerns over sharing sensitive user data with cloud servers. In this paper, we demonstrate that keeping inference local does not eliminate privacy risks: an adversary with physical access to the device may exploit hardware leakage to recover sensitive information without compromising or modifying the software system. In particular, we present an electromagnetic (EM) side-channel attack targeting LLM inference on edge devices. Targeting LLaMA-3.2-1B-Instruct running on a Raspberry Pi 5, we demonstrate that EM traces collected during inference can leak both generated tokens and user prompts. We propose three attacks under different threat assumptions. First, a profiling attack that identifies generated tokens among 50 medical and privacy-related keywords with 97.2% accuracy on profiled words. Second, a reconstruction attack recovers the model's hidden representations and uses them to predict tokens from the full 128k-token vocabulary, achieving 94.3% accuracy on profiled classes. For unseen words, the correct token is ranked within the first 100 positions of the 128k-token vocabulary in 67% of cases, with a median rank of 54. Finally, we present a hidden-state inversion attack that uses the recovered hidden state to reconstruct user prompts semantically. Our proposed attacks require only passive EM side-channel measurements and a limited number of traces during model training. These results demonstrate that local execution alone may not guarantee the confidentiality of generated tokens and user inputs.

I. INTRODUCTION

Edge LLMs keep sensitive prompts and outputs on-device, but local execution does not remove physical side-channel risk. This study examines whether EM leakage can expose generated tokens and prompt information during inference.

I. INTRODUCTION

  • Prior work left open whether EM leakage from an edge LLM could reveal generated tokens or prompt information, despite local execution's privacy motivation.The study examines CPU emanations during inference as a physical side channel.Source: §I · p. 1
  • The study characterizes EM leakage, recovers generated tokens through classification or hidden-state reconstruction, and uses recovered representations to infer prompt semantics.Experiments target LLaMA-3.2-1B-Instruct on a Raspberry Pi 5 and trace the llama.cpp inference pipeline.Source: §I · pp. 1–2

A. Autoregressive LLM Inference

  • During decode, each forward pass produces a hidden state that predicts the next token, which is appended to the context for the following step.The repeated token-specific computation creates an opportunity to record emanations associated with the state determining the immediate output.Source: A. Autoregressive LLM Inference · p. 2

B. Attack Formulations

The attack formulations use the LM Head's mapping from a final hidden state to next-token scores. They differ in whether they classify among profiled tokens or recover a representation for full-vocabulary token ranking.

  • The LM Head multiplies the final hidden state by the vocabulary matrix to produce logits, which the runtime converts into probabilities for next-token sampling.For the studied model, the hidden representation is 2048-dimensional and the vocabulary contains 128 256 tokens.Source: B. Attack Formulations · p. 2
  • Closed-set classification maps an EM trace to one of a predefined set of profiled token classes, limiting recovery to those profiled words.The formulation can use a target set such as C = 50.Source: B. Attack Formulations · p. 2
  • Representation recovery estimates the hidden state from an EM trace and projects it through the public vocabulary matrix to rank tokens across the full vocabulary.This removes the fixed-class bottleneck and includes tokens absent from profiling.Source: B. Attack Formulations · p. 2

C. Physical Side-Channel Leakage

The LM Head's deterministic, data-dependent matrix-vector computation creates a viable EM target. Unlike earlier work on model internals or LLM side channels, this study targets generated tokens using passive physical emanations.

C. Physical Side-Channel Leakage

  • The LM Head projection is a viable EM target because its large, deterministic matrix-vector operation on fixed quantized layouts creates a prolonged computation window correlated with hidden-state values.A near-field probe above the processor package can passively capture the resulting time-domain trace.Source: C. Physical Side-Channel Leakage · p. 2

III. RELATED WORK

  • Earlier machine-learning side-channel work recovered architectures, weights, or inputs, but did not target information generated by LLMs during inference.Prior LLM attacks used cache or network observations, unlike this physical-emanation approach.Source: §III · p. 3
  • The profiling overview contrasts labeled traces from a reference device with an unlabeled victim trace analyzed to infer its generated token.Source: Figure 1 · p. 3
  • Cache attacks require shared-resource access and network attacks require traffic observation, leaving passive physical proximity to an offline device as a distinct threat setting.The paper states that prior work had not demonstrated token recovery from raw physical EM emanations.Source: §III · p. 3

IV. THREAT MODEL

The threat model assumes passive physical proximity and no access to the victim’s software, memory, or network. The methodology traces EM leakage and constructs aligned token datasets on a Raspberry Pi 5 running LLaMA 3.2 1B Instruct.

IV. THREAT MODEL

  • The attack distinguishes closed-set classification from full-vocabulary recovery, where profiled traces map leakage to hidden-state space for predicting arbitrary vocabulary tokens.During the attack, the adversary passively captures traces without interacting with the victim’s software.Source: §IV · pp. 3–4

V. METHODOLOGY

  • The platform is a Raspberry Pi 5 running quantized LLaMA 3.2 1B Instruct through llama.cpp, with the LM Head using Q6 K weights and Q8 K activations.The LM Head matrix-vector multiplication executes through optimized ARM NEON dot-product instructions.Source: §V · p. 4

A. Dataset Construction

  • Traces target a known keyword emitted as the second token, fixing its computation position for direct comparison across captures.The primary dataset contains 120,750 traces across 50 health- and privacy-sensitive keywords; a 17-template dataset varies the preceding context while keeping keyword position fixed.Source: A. Dataset Construction · pp. 4–5
  • A single-token trace exposes the embedding lookup, 16 transformer blocks, final RMSNorm, and LM Head in sequence, allowing the LM Head window to be isolated.The probe is positioned above the processor die, and the CPU frequency is fixed at 1500 MHz for a stable LM Head computation window.Source: A. Dataset Construction · p. 5, Figure 3 · p. 5

B. Leakage Validation

The section validates token-dependent leakage with TVLA and compares trace representations for extracting it. The selected pipeline uses STFT spectrograms with pretrained vision backbones.

B. Leakage Validation

  • The measured traces exceed the |t| = 4.5 TVLA threshold, indicating statistically detectable differences between token trace populations.Welch’s t-statistic is computed at each sample of the window.Source: B. Leakage Validation · p. 5, Figure 6 · p. 6
  • The evaluation compares raw 1D traces, STFT spectrograms, and Morlet wavelet scalograms as inputs for leakage extraction.Time-frequency representations expose signal structure to convolutional networks and support standard pretrained vision models.Source: B. Leakage Validation · pp. 5–6
  • The final pipeline uses 256 × 256 STFT spectrograms replicated across three channels, the configuration reported to provide the highest feature extraction accuracy.Unlike the STFT’s fixed window, the Morlet wavelet uses longer windows for low frequencies and shorter windows for high frequencies to resolve short transients, at greater computational cost.Source: B. Leakage Validation · p. 6

C. Semantic Prompt Recovery

The prompt-recovery attack maps a predicted hidden state into pseudo-token embeddings for a sequence-to-sequence model. It trains on prompt-state pairs generated offline and evaluates recovery on held-out prompts, including templates excluded from training.

C. Semantic Prompt Recovery

  • Self-attention makes the hidden state at a given step aggregate preceding tokens, so the vector summarizes the prompt context.The attack adapts embedding inversion to operate directly on that continuous state.Source: C. Semantic Prompt Recovery · p. 6
  • A two-layer feed-forward network projects the 2,048-dimensional hidden state into 48 × d_model values, reshaped as 48 input embeddings.These vectors serve as pseudo-token embeddings for the encoder.Source: C. Semantic Prompt Recovery · p. 6, Figure 7 · p. 6
  • A pretrained T5-base encoder-decoder is trained with cross-entropy to generate the original prompt token by token.The decoder generates the prompt sequentially from the projected state.Source: C. Semantic Prompt Recovery · p. 6, Figure 7 · p. 6
  • The public model’s weights allow generation of 2,688,674 prompt-state pairs in software, with no physical profiling overhead.The corpus draws on instruction, question-answering, conversation, and domain-specific datasets.Source: C. Semantic Prompt Recovery · p. 6
  • The attack path converts the predicted state into 48 pseudo-tokens for the encoder, while the training path records prompt-state pairs produced offline by the public model.The decoder then generates the prompt one token at a time.Source: Figure 7 · p. 6
  • Roughly 95% of the prompt-state pairs are used for training and the remainder for evaluation.The source datasets provide diverse prompt phrasing.Source: C. Semantic Prompt Recovery · p. 6
  • All 17 templates used during EM trace collection are excluded from training, requiring semantic recovery of unseen phrasing.The held-out templates differ in instruction phrasing and lead-in word while preserving keyword position in the separate context-independence dataset.Source: C. Semantic Prompt Recovery · p. 6

A. Closed-Set Token Recovery

On the 50-class test set, the STFT spectrogram with pretrained ResNet-18 achieved 97.2% top-1 accuracy, while raw-trace models remained near chance. Masking localized the informative leakage to the middle of the LM Head window at 0–150 MHz, and unprofiled medical words could still reveal a medical topic.

A. Closed-Set Token Recovery

  • In the 30-class pilot, pretrained ResNet-18 scored 98.1% on 224 × 224 STFT versus 53.7% on scalograms; the best scratch model scored 23.9% versus 50.9% for the weakest pretrained model.ResNet-18 was the most consistent architecture across input configurations.Source: A. Closed-Set Token Recovery · p. 7
  • 97.2% top-1 and 99.95% top-5 accuracy were achieved by the 256 × 256 STFT with pretrained ResNet-18 on the 50-class test set.The same configuration scored 98.3% on the 30-class pilot.Source: A. Closed-Set Token Recovery · p. 7, Table II · p. 7
  • Raw 1D models achieved only 5–7% accuracy across tested sizes, versus 97.2% when the same signal was converted to a spectrogram.The comparison isolates input format; Table II identifies the 256 × 256 STFT with pretrained ResNet-18 as the image model.Source: A. Closed-Set Token Recovery · pp. 7–8, Table II · p. 7
  • Classification reached 89.0% with 250 traces per word and 93.8% with 500; the generative model reached 64.6% at 500 and 94.3% at 2,000 traces.The generative model remained at chance below 500 traces per word; Figure 8 shows the learning curves.Source: A. Closed-Set Token Recovery · p. 8, Table III · p. 8, Figure 8 · p. 8
  • Masking showed leakage concentrated in the middle third of the LM Head window at 0–150 MHz, where hiding a tile reduced accuracy to near zero.Grad-CAM independently highlighted the same region as the grid mask.Source: A. Closed-Set Token Recovery · p. 8, Figure 9 · p. 8, Figure 10 · p. 9
  • Unprofiled medical words retained high classifier confidence overlapping profiled words, so an unknown token could still disclose a medical topic.The fixed-vocabulary classifier has no mechanism to reject out-of-vocabulary inputs, motivating a generative approach for arbitrary text.Source: A. Closed-Set Token Recovery · p. 9

B. Open-Vocabulary Token Recovery

The open-vocabulary attack predicts hidden states from EM traces and projects them through the model’s output head to rank tokens across the full vocabulary. Target centering and full-vocabulary training objectives improve recovery of unseen words, while word-specific structure remains visible across prompt templates.

Open-Vocabulary Recovery

  • The classifier remains confident on out-of-vocabulary tokens, with the highest confidence on unseen medical words.Its confidence distributions for unseen medical words heavily overlap with those for profiled words.Source: Figure 11 · p. 9

Recovery on Profiled Words

  • 94.3% top-1 and 95.8% top-5 accuracy, with a median rank of 1, are achieved on profiled words using EfficientNet-B0 and cosine loss.The reported 94.3% uses 2,000 traces per word; the same configuration reaches 89.9% with 1,000 traces per word.Source: B. Open-Vocabulary Token Recovery · p. 9

Robustness of the Hidden State to Prompt Variations

Isolating the Shared Component for Unseen-Word Recovery

  • Centering predicts the residual after subtracting the shared mean hidden state, then restores that mean before decoding; residual states still rank the correct profiled token first for 92.9% of states.Distinct-word mean cosine similarity is 0.596 before centering and near zero after centering.Source: B. Open-Vocabulary Token Recovery · p. 10, Table V · p. 10
  • Target centering improves unseen-word recovery from a median rank of 1,327 to 443 and Top-100 recovery from 11.8% to 28.7%.Top-1 accuracy remains 0%, but predictions shift toward the true word’s semantic neighborhood.Source: B. Open-Vocabulary Token Recovery · p. 10, Table VI · p. 11

Optimizing for Open-Vocabulary Recovery

  • 67.0% Top-100 recovery and a median rank of 54 are achieved for unseen words with full-vocabulary cross-entropy and a hardest-negative margin.This improves on cosine similarity with a hardest-negative margin, which yields 28.7% Top-100 recovery and a median rank of 443.Source: B. Open-Vocabulary Token Recovery · p. 11, Table VII · p. 11

C. Semantic Prompt Recovery

The prompt-recovery attack uses EM-predicted hidden states to reconstruct the user’s prompt semantically. On prompts phrased in a way excluded from training, it recovers semantic intent and often the embedded keyword.

Semantic Prompt Recovery

  • The end-to-end attack infers user prompts from EM measurements, producing text that captures their semantic content.The recovered prompts use a phrasing the recovery model was never trained on.Source: C. Semantic Prompt Recovery · p. 11, Table VIII · p. 11
  • 88.7% of evaluated traces yield the exact embedded secret keyword, while recovered prompts have a mean cosine similarity of 0.82 to the original prompts.The evaluation covers 1,024 prompts, and the capture templates were excluded from training.Source: C. Semantic Prompt Recovery · p. 11, Table VIII · p. 11
  • Among the 11.3% of cases with mismatch errors, target words are frequently truncated, and those errors cluster near the correct answer semantically.The authors interpret this proximity as evidence that the predicted hidden state captures broad token meaning despite not resolving the exact word.Source: C. Semantic Prompt Recovery · p. 11

VII. DISCUSSION

The most token-discriminative leakage occurs during the LM Head matrix-vector products. The discussion also identifies cross-session, CPU-frequency, and GPU deployment conditions that constrain real-world application.

Origins of the Leakage

  • The most discriminative leakage occurs in the middle of the trace, during LM Head matrix-vector dot products; the later de-quantization portion carries significantly less token-specific information.The trace begins with CPU scheduling overhead and loading model weights.Source: §VII · p. 11

Limitations

  • Cross-session variation and dynamically shifting CPU frequencies are practical deployment challenges, though the authors describe mitigation through multi-session profiling, trace alignment, or specialized measurement equipment.Automated pattern matching can align sequential decode phases without hardware triggers.Source: §VII · p. 12
  • The study focuses on CPU inference, while GPU deployments may challenge attackers because of higher clock frequencies and parallelization.Adapting the methods to GPU-specific execution and emanation patterns is identified as future work.Source: §VII · p. 12

VIII. CONCLUSION

The paper concludes that EM side channels can expose generated tokens and user inputs during edge LLM execution, and that local execution alone does not guarantee privacy. It frames the attack characterization as a basis for evaluating countermeasures and raising security awareness.

VIII. CONCLUSION

  • The three attacks achieve 97.2% accuracy on profiled keywords, 67.0% Top-100 recovery with a median rank of 54 for unseen tokens, and exact embedded-keyword recovery in 88.7% of prompt traces.The attacks cover closed-set token classification, open-vocabulary token recovery, and semantic prompt reconstruction.Source: §VIII · p. 12
  • The findings provide a basis for developers and hardware manufacturers to consider EM shielding, LM Head masking, and execution randomization against physical leakage.The conclusion argues that physical side-channel attacks and corresponding defenses warrant greater attention.Source: §VIII · p. 12

ETHICAL CONSIDERATIONS

  • The work aims to make an invisible leakage channel measurable and reproducible so developers and hardware manufacturers can account for physical leakage and evaluate countermeasures.The stated objective includes characterizing the attack’s practical limitations.Source: ETHICAL CONSIDERATIONS · p. 12

APPENDIX A CORPUS DETAILS

The prompt-recovery corpus pairs locally generated victim-model hidden states with source text, while excluding the victim’s exact capture templates from training.

APPENDIX A CORPUS DETAILS

  • 2,551,308 text–hidden-state pairs are used for training, with the remainder held out for evaluation.The text sources were run through the victim model locally to generate corresponding hidden states.Source: Table IX · p. 14
  • The corpus uses text sources run through the victim model locally to generate corresponding hidden states.Source: Table IX · p. 14
  • The victim’s exact capture templates are excluded from training.Source: Table IX · p. 14

Related papers

Loading 2610.14215v1…