远程监控语言模型生成速度，可泄露用户对话内容与隐私信息。
Remote Timing Attacks on Efficient Language Model Inference
- 通过分析加密流量中响应时间差异，推断用户输入内容
- 在开源系统中识别对话主题准确率达90%以上
- 可恢复电话、信用卡等敏感信息，适合安全与隐私研究者
随着语言模型规模扩大，其能力显著提升，但推理速度变慢。为此，大量研究（如推测采样或并行解码）致力于提升生成效率。然而，这些技术引入了依赖数据的时序特征。我们证明，仅通过监控受害者与远程语言模型之间的加密网络流量，即可利用响应快慢差异获取消息内容。在完全黑盒条件下，对开源系统可实现90%以上的对话主题识别精度（如医疗建议与编程辅助）；对OpenAI ChatGPT和Anthropic Claude等生产系统，能区分具体消息或推断用户语言。进一步表明，主动攻击者可利用增强攻击恢复用户输入中的个人身份信息（如电话号码、信用卡号）。最后提出潜在防御措施与未来方向。
原文摘要 · Abstract (English)
Scaling up language models has significantly increased their capabilities. But larger models are slower models, and so there is now an extensive body of work (e.g., speculative sampling or parallel decoding) that improves the (average case) efficiency of language model generation. But these techniques introduce data-dependent timing characteristics. We show it is possible to exploit these timing differences to mount a timing attack. By monitoring the (encrypted) network traffic between a victim user and a remote language model, we can learn information about the content of messages by noting when responses are faster or slower. With complete black-box access, on open source systems we show how it is possible to learn the topic of a user's conversation (e.g., medical advice vs. coding assistance) with 90%+ precision, and on production systems like OpenAI's ChatGPT and Anthropic's Claude we can distinguish between specific messages or infer the user's language. We further show that an active adversary can leverage a boosting attack to recover PII placed in messages (e.g., phone numbers or credit card numbers) for open source systems. We conclude with potential defenses and directions for future work.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。