Bits Leaked per Query: Information-Theoretic Bounds on Adversarial Attacks against LLMs
This work addresses the transparency–security trade-off for LLM auditors and defenders, providing a principled yardstick to gauge attack risks, though it is incremental in applying information theory to a known bottleneck in adversarial robustness.
The paper tackles the problem of quantifying information leakage in adversarial attacks on large language models (LLMs) by introducing an information-theoretic framework that computes leaked bits per query, showing that even modest increases in disclosure can reduce attack costs from quadratic to logarithmic scaling with accuracy. Experiments on seven LLMs demonstrate that exposing answer tokens requires about a thousand queries, adding logits reduces it to about a hundred, and revealing the full thinking process cuts it to a few dozen.
Adversarial attacks by malicious users that threaten the safety of large language models (LLMs) can be viewed as attempts to infer a target property $T$ that is unknown when an instruction is issued, and becomes knowable only after the model's reply is observed. Examples of target properties $T$ include the binary flag that triggers an LLM's harmful response or rejection, and the degree to which information deleted by unlearning can be restored, both elicited via adversarial instructions. The LLM reveals an \emph{observable signal} $Z$ that potentially leaks hints for attacking through a response containing answer tokens, thinking process tokens, or logits. Yet the scale of information leaked remains anecdotal, leaving auditors without principled guidance and defenders blind to the transparency--risk trade-off. We fill this gap with an information-theoretic framework that computes how much information can be safely disclosed, and enables auditors to gauge how close their methods come to the fundamental limit. Treating the mutual information $I(Z;T)$ between the observation $Z$ and the target property $T$ as the leaked bits per query, we show that achieving error $\varepsilon$ requires at least $\log(1/\varepsilon)/I(Z;T)$ queries, scaling linearly with the inverse leak rate and only logarithmically with the desired accuracy. Thus, even a modest increase in disclosure collapses the attack cost from quadratic to logarithmic in terms of the desired accuracy. Experiments on seven LLMs across system-prompt leakage, jailbreak, and relearning attacks corroborate the theory: exposing answer tokens alone requires about a thousand queries; adding logits cuts this to about a hundred; and revealing the full thinking process trims it to a few dozen. Our results provide the first principled yardstick for balancing transparency and security when deploying LLMs.