I Know What You Said: Unveiling Hardware Cache Side-Channels in Local Large
summary
Shows a practical local attack that recovers LLM inputs and outputs by observing CPU cache behavior: embedding lookups leak token values via unique cache-line access, and autoregressive timing leaks token positions. Implementation uses mmap and flush+reload to collect traces, a PSD-based first order temporal difference preprocessor, and two fine-tuned models (LMA/LMB models) trained on synthetic traces. Evaluated on Llama, Falcon and Gemma across five LMs and 10 frameworks on consumer Intel CPUs, achieving 5.2% edit distance for outputs (17.3% for inputs) and ~98% cosine similarity; mitigations (CAT, disabling zero-copy) incur hardware or memory costs.
AI-written summary · about
chapters (14)
- 0:00Cache side-channel attacks on LLMs
- 1:18Research questions and assumptions
- 2:01Token value leakage intuition
- 4:09Token position leakage in decoding
- 5:37Signal recovery challenges
- 6:44Attack pipeline overview
- 8:30Noise analysis and PSD techniques
- 10:15Response reconstruction with LMA
- 11:19Prompt reconstruction with LMB
- 11:59Experimental results
- 13:02Real-world attacks and privacy risks
- 13:23Mitigation strategies and future work
- 14:27Conclusion and privacy measures
- 14:49Q&A
related talks
27mTranslation Leak-aside Buffer: Defeating Cache Side-channel Protections
35mPage Cache Attacks: Microarchitectural Attacks on Flawless Hardware
01h 01mTutorial: Side-Channel Attacks and Transient Execution Vulnerab...
43mUsing Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the Process
23mMalicious Management Unit: Why Stopping Cache Attacks in Software is Harder Than You Think
24mSide-Channel Attacks on Everyday Applications
13mExposing Cache Timing Side-Channel Leaks through Out-of-Order Symbolic Execution
36mCollide+Power: The Evolution of Software-based Power Side-Channels Attacks