通过输出词元数量泄露LLM推理输入的敏感信息
Time Will Tell: Timing Side Channels via Output Token Count in Large Language Models
- 利用输出词元数构建侧信道攻击
- 翻译任务精度超75%，分类任务超70%
- 适用于开源与商用大模型，适合安全研究者
本文揭示了一种新型侧信道攻击，攻击者可通过大语言模型（LLM）响应中的输出词元数量，推断推理输入的敏感信息。在机器翻译和文本分类任务中，该方法可分别实现超过75%的翻译目标语言恢复准确率（基于Tower、M2M100、MBart50三类模型），以及超过70%的分类类别泄露准确率（覆盖Llama-3.1、Llama-3.2、Gemma2及GPT-4o等开源与商用模型）。由于自回归生成机制，攻击者即使在网络环境下也能可靠地通过时间通道获取输出词元数。论文进一步提出基于分词器、系统级和提示工程的防御策略。
原文摘要 · Abstract (English)
This paper demonstrates a new side-channel that enables an adversary to extract sensitive information about inference inputs in large language models (LLMs) based on the number of output tokens in the LLM response. We construct attacks using this side-channel in two common LLM tasks: recovering the target language in machine translation tasks and recovering the output class in classification tasks. In addition, due to the auto-regressive generation mechanism in LLMs, an adversary can recover the output token count reliably using a timing channel, even over the network against a popular closed-source commercial LLM. Our experiments show that an adversary can learn the output language in translation tasks with more than 75% precision across three different models (Tower, M2M100, MBart50). Using this side-channel, we also show the input class in text classification tasks can be leaked out with more than 70% precision from open-source LLMs like Llama-3.1, Llama-3.2, Gemma2, and production models like GPT-4o. Finally, we propose tokenizer-, system-, and prompt-based mitigations against the output token count side-channel.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。