Attack Type

Side channel Research

Attacks exploiting indirect information leakage

20 matching entries

Side channel research results

20 entries

LLM Prefix Cache Reconstruction

Published 3/1/2026

Analyzed 4/10/2026

Automatic Prefix Caching (APC) in multi-tenant LLM serving systems introduces a timing side-channel vulnerability that permits cross-tenant data leakage. APC shares computed Key-Value (KV) tensors across different users when their requests share identical initial tokens. Because reusing cached tensors is significantly faster than recomputing them, a measurable difference in Time-To-First-Token (TTFT) exists between cache hits and misses. An attacker can exploit this shared cache by sending…

PrefixWall: Mitigating Prefix Caching Side Channels in Shared LLM Systems

Evaluated models: Gemma 3 4B IT, Llama 2 7B Chat, Llama 2 13B Chat +6 more

Source: arXiv

Efficient KV-Cache Prompt Leakage

Published 2/1/2026

Analyzed 3/8/2026

A vulnerability in multi-tenant LLM serving frameworks allows attackers to reconstruct the private prompts of other users via an active Key-Value (KV) cache side-channel. Frameworks that utilize shared KV caches alongside specific scheduling policies, such as Longest Prefix Match (LPM), prioritize waiting requests based on the length of their matched prefix tokens. An attacker can exploit this by iteratively sending batches of guessed tokens mixed with dummy queries. If a guessed token matches…

OptiLeak: Efficient Prompt Reconstruction via Reinforcement Learning in Multi-tenant LLM Services

Evaluated models: Llama 3.1 8B, Qwen 2.5 3B

Source: arXiv

Fill-Squeeze Scheduler DoS

Published 2/1/2026

Analyzed 2/21/2026

LLM serving frameworks utilizing continuous batching and PagedAttention (such as vLLM, SGLang, and Orca) are vulnerable to a resource exhaustion Denial-of-Service attack known as "Fill and Squeeze." An unprivileged remote attacker can exploit the deterministic state transitions of the scheduler's memory management to induce severe latency or service denial. The attack leverages a side-channel vulnerability where Inter-Token Latency (ITL) correlates linearly with global KV-cache usage due to…

Rethinking Latency Denial-of-Service: Attacking the LLM Serving Framework, Not the Model

Evaluated models: Qwen 3 8B, Gemma 3 12B IT, DeepSeek R1 Distill Llama 8B +1 more

Source: arXiv

LLM Edit Fingerprint Leak

Published 2/1/2026

Analyzed 2/21/2026

A side-channel information leakage vulnerability exists in the "locate-then-edit" paradigm of Large Language Model (LLM) knowledge editing, specifically affecting algorithms such as ROME, MEMIT, and AlphaEdit. The parameter update matrix ($\Delta W$) generated during the editing process preserves the algebraic structure of the edited data. Specifically, the row space of the parameter difference matrix encodes a mathematical fingerprint of the key vectors associated with the edited subjects. An…

Reverse-Engineering Model Editing on Language Models

Evaluated models: Llama 3 8B, Qwen 2.5 7B

Source: arXiv

Semantic Cache Collision Hijack

Published 1/1/2026

Analyzed 3/9/2026

Semantic caching mechanisms in LLM applications are vulnerable to cross-tenant cache key collision attacks (CacheAttack) due to the inherent mathematical conflict between locality-preserving fuzzy hashing and cryptographic collision resistance (the avalanche effect). An attacker can leverage gradient-based search algorithms to optimize an adversarial discrete suffix that, when appended to a malicious prompt, forces its output embedding vector to collide with the embedding of a targeted benign…

From Similarity to Vulnerability: Key Collision Attack on LLM Semantic Caching

Evaluated models: Llama 3.1 8B, Mistral 7B, DeepSeek R1

Source: arXiv

Logit Leakage Model Clone

Published 9/1/2025

Analyzed 12/9/2025

Large Language Model (LLM) inference APIs that expose top-k logits or log-probabilities are vulnerable to model extraction and cloning. An attacker can execute a two-stage attack to replicate the proprietary model without access to weights, gradients, or training data. First, by submitting fewer than 10,000 random queries and aggregating the returned unrounded logits, the attacker recovers the model's output projection matrix using Singular Value Decomposition (SVD). Second, the attacker…

Clone What You Can't Steal: Black-Box LLM Replication via Logit Leakage and Distillation

Evaluated models: GPT-3.5, Mistral 7B

Source: arXiv

Automated LLM Fingerprinting

Published 8/1/2025

Analyzed 12/9/2025

Large Language Models (LLMs) exposed via public APIs are vulnerable to model fingerprinting attacks where an attacker can identify the exact backend model family and version (e.g., distinguishing Mistral-7B-v0.1 from v0.3) by analyzing response patterns. While traditional fingerprinting relies on manual query curation, this vulnerability is exacerbated by Reinforcement Learning (RL) based query optimization. An attacker can train an RL agent (specifically using Proximal Policy Optimization) to…

Attacks and defenses against llm fingerprinting

Evaluated models: Mistral 7B, Qwen 2 5B, Gemma 2 2B +1 more

Source: arXiv

KV-Cache Sharing Timing Side-channel

Published 8/1/2025

Analyzed 1/14/2026

Multi-tenant Large Language Model (LLM) inference systems utilizing global Key-Value (KV) cache sharing are vulnerable to a timing side-channel attack. By measuring the Time-To-First-Token (TTFT) latency of crafted API requests, an unprivileged remote attacker can determine if specific token sequences have been previously processed and cached by the system for other users. This observable timing difference between cache hits (low TTFT) and cache misses (high TTFT) allows for the token-by-token…

Selective KV-Cache Sharing to Mitigate Timing Side-Channels in LLM Inference

Evaluated models: Phi-4 14B, Qwen 3 30B-A3B, Qwen 3 32B +3 more

Source: arXiv

LLM Agent TOCTOU Vulnerabilities

Published 8/1/2025

Analyzed 8/31/2025

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in LLM-enabled agentic systems that execute multi-step plans involving sequential tool calls. The vulnerability arises because plans are not executed atomically. An agent may perform a "check" operation (e.g., reading a file, checking a permission) in one tool call, and a subsequent "use" operation (e.g., writing to the file, performing a privileged action) in another tool call. A temporal gap between these calls, often used for LLM…

Mind the Gap: Time-of-Check to Time-of-Use Vulnerabilities in LLM-Enabled Agents

Evaluated models: GPT-4o

Source: arXiv

Activation Steering Leaks PII

Published 7/1/2025

Analyzed 7/14/2025

Large Language Models (LLMs) are vulnerable to activation steering attacks that bypass safety and privacy mechanisms. By manipulating internal attention head activations using lightweight linear probes trained on refusal/disclosure behavior, an attacker can induce the model to reveal Personally Identifiable Information (PII) memorized during training, including sensitive attributes like sexual orientation, relationships, and life events. The attack does not require adversarial prompts or…

PII Jailbreaking in LLMs via Activation Steering Reveals Personal Information Leakage

Evaluated models: Gemma 2 9B, GLM 9B, GPT-4 +4 more

Source: arXiv

Related research categories