Remote Timing Attacks on Efficient Language Model Inference
This exposes a security vulnerability in widely used language models like ChatGPT and Claude, posing risks to user privacy by enabling attackers to infer sensitive information from encrypted network traffic.
The paper tackles the problem of data-dependent timing characteristics in efficient language model inference techniques, showing that these can be exploited to mount timing attacks that learn information about user messages, such as topics with over 90% precision or specific content like PII.
Scaling up language models has significantly increased their capabilities. But larger models are slower models, and so there is now an extensive body of work (e.g., speculative sampling or parallel decoding) that improves the (average case) efficiency of language model generation. But these techniques introduce data-dependent timing characteristics. We show it is possible to exploit these timing differences to mount a timing attack. By monitoring the (encrypted) network traffic between a victim user and a remote language model, we can learn information about the content of messages by noting when responses are faster or slower. With complete black-box access, on open source systems we show how it is possible to learn the topic of a user's conversation (e.g., medical advice vs. coding assistance) with 90%+ precision, and on production systems like OpenAI's ChatGPT and Anthropic's Claude we can distinguish between specific messages or infer the user's language. We further show that an active adversary can leverage a boosting attack to recover PII placed in messages (e.g., phone numbers or credit card numbers) for open source systems. We conclude with potential defenses and directions for future work.