Remote Timing Attacks on Efficient Language Model Inference

TL;DR

This paper demonstrates that data-dependent timing variations in efficient remote language model inference can be exploited to infer user information, including conversation topics and PII, through network traffic analysis.

Contribution

It reveals a novel side-channel attack exploiting timing differences in optimized language model inference, highlighting privacy risks and proposing potential defenses.

Findings

Timing attacks can identify conversation topics with over 90% accuracy.

Attackers can distinguish specific messages on commercial systems like ChatGPT.

Active attacks can recover sensitive PII such as phone numbers and credit card info.

Abstract

Scaling up language models has significantly increased their capabilities. But larger models are slower models, and so there is now an extensive body of work (e.g., speculative sampling or parallel decoding) that improves the (average case) efficiency of language model generation. But these techniques introduce data-dependent timing characteristics. We show it is possible to exploit these timing differences to mount a timing attack. By monitoring the (encrypted) network traffic between a victim user and a remote language model, we can learn information about the content of messages by noting when responses are faster or slower. With complete black-box access, on open source systems we show how it is possible to learn the topic of a user's conversation (e.g., medical advice vs. coding assistance) with 90%+ precision, and on production systems like OpenAI's ChatGPT and Anthropic's Claude we can distinguish between specific messages or infer the user's language. We further show that an active adversary can leverage a boosting attack to recover PII placed in messages (e.g., phone numbers or credit card numbers) for open source systems. We conclude with potential defenses and directions for future work.