A Microsoft security researcher has developed a Whisper Leak side-channel attack technique that allows the classification of topics in requests to large language model-based services through passive analysis of encrypted traffic transmitted via a TLS connection. Information about the size of network packets and delays between their transmission is sufficient to determine request topics for AI chatbots with over 98% accuracy. In practice, the proposed method can be used to identify certain request topics in user transit traffic, such as attempts to obtain information about illegal activities, without decrypting the content.
The toolkit for extracting data from traffic dumps, training models, and testing the method has been published on GitHub. The ability to carry out the attack has been demonstrated for 28 popular large language models from major producers. For example, the accuracy of identifying requests on the topic of 'money laundering' for many AI services was 100%, with 1 sought query present in the analyzed traffic and 10,000 queries unrelated to the desired topic.
The cause of the information leak is that models generate a response to a request step by step, one token at a time, with each step using the previous token as context to determine the next most likely word or phrase. Accordingly, a separate network packet is sent for each token, and the delay between packets corresponds to the delay in the model's determination of the next token.
In TLS, if data compression is not used, the ciphertext size equals the size of the plaintext plus a constant. When creating a model that correlates the desired sets of tokens with packet sizes and delays between their transmission, it is possible to fairly accurately determine the presence of desired topics in the traffic. During the study, three versions of such machine learning models were prepared, based on the LightGBM, Bi-LSTM, and BERT neural network architectures. Experiments were conducted for each model to determine the desired topic by analyzing only the packet sizes, only the delays between packets, and both criteria.
Az AI-szolgáltatások fejlesztői számára javasolt, hogy a keresési téma passzív elemzésének hatékonyságának csökkentése érdekében véletlenszerű kiegészítő kitöltést alkalmazzanak, bufferezzék a tokenek átvitelét, vagy hamis csomagok behelyettesítésével dolgozzanak.
Forrás: opennet.ru
