InputSnatch: Stealing Input in LLM Services via Timing Side-Channel Attacks

TL;DR

This paper introduces a timing-based side-channel attack called InputSnatch that exploits cache-sharing mechanisms in LLM inference to steal user inputs, revealing privacy vulnerabilities in widely used language models.

Contribution

It presents a novel attack method combining machine learning and statistical analysis to effectively extract private inputs from LLM services via timing side-channels.

Findings

High success rate in input theft across different cache mechanisms

Effective input reconstruction using machine learning and statistical techniques

Highlights security risks in performance optimization strategies

Abstract

Large language models (LLMs) possess extensive knowledge and question-answering capabilities, having been widely deployed in privacy-sensitive domains like finance and medical consultation. During LLM inferences, cache-sharing methods are commonly employed to enhance efficiency by reusing cached states or responses for the same or similar inference requests. However, we identify that these cache mechanisms pose a risk of private input leakage, as the caching can result in observable variations in response times, making them a strong candidate for a timing-based attack hint. In this study, we propose a novel timing-based side-channel attack to execute input theft in LLMs inference. The cache-based attack faces the challenge of constructing candidate inputs in a large search space to hit and steal cached user queries. To address these challenges, we propose two primary components. The input constructor employs machine learning techniques and LLM-based approaches for vocabulary correlation learning while implementing optimized search mechanisms for generalized input construction. The time analyzer implements statistical time fitting with outlier elimination to identify cache hit patterns, continuously providing feedback to refine the constructor's search strategy. We conduct experiments across two cache mechanisms and the results demonstrate that our approach consistently attains high attack success rates in various applications. Our work highlights the security vulnerabilities associated with performance optimizations, underscoring the necessity of prioritizing privacy and security alongside enhancements in LLM inference.