I Know What You Said: Unveiling Hardware Cache Side-Channels in Local Large Language Model Inference

I Know What You Said: Unveiling Hardware Cache Side-Channels in Local Large Language Model Inference

Speakers: Zibo Gao

Conference: USENIX Security

YouTube: https://www.youtube.com/watch?v=aNU7TidUMgE

Overview

This talk, presented by Zibo Gao at USENIX Security, introduces a groundbreaking cache side-channel attack targeting on-device inference of Large Language Models (LLMs). The research addresses a critical, previously underexplored vulnerability: while local LLMs are often perceived as a privacy-preserving solution, they remain susceptible to sophisticated hardware-level attacks that can bypass conventional software protections. The core of the work demonstrates how unprivileged malware, co-located on the same device, can reconstruct sensitive user prompts and model outputs purely by monitoring cache access patterns.

The significance of this research cannot be overstated, particularly as the on-device AI market is projected to reach $143 billion by 2032, driven largely by growing privacy concerns and the increasing efficiency of edge devices in running LLMs. This attack challenges the fundamental assumption of privacy in local AI deployments, revealing that the very mechanisms designed for efficient computation—CPU caches—can inadvertently leak highly sensitive data. By successfully demonstrating the reconstruction of both input and output tokens, this work demands a fundamental re-evaluation of LLM privacy, emphasizing the need for a comprehensive security strategy that spans the entire system stack, from silicon to operating systems and inference frameworks.

Gao's presentation details the intuitive basis of the attack, which exploits the predictable behavior of an LLM's embedding layer, functioning as a lookup table. The research meticulously outlines the technical challenges posed by cache side-channel noise and the non-deterministic execution order of LLM processes, and subsequently introduces a novel attack pipeline to overcome these hurdles. The successful validation across diverse hardware, multiple LLM families, and numerous inference frameworks underscores the pervasive nature of this vulnerability, highlighting a significant privacy threat that requires urgent attention from both hardware and software developers.

Background

▶ Watch: Introduction to cache side-channel attacks on local LLMs (0:00)

The rapid growth of on-device AI, particularly local Large Language Models (LLMs), is fueled by a dual imperative: the desire for enhanced privacy and the increasing computational efficiency of edge devices. Users often assume that by running LLMs locally, their interactions and data remain confined to their personal devices, thus mitigating privacy risks associated with cloud-based services. However, this assumption, while intuitively appealing, overlooks a crucial vector of attack: hardware side-channels. These channels, particularly cache side-channels, operate at a low level, often bypassing traditional software-based security mechanisms and memory isolation.

Previous studies on LLM security have primarily focused on higher-level vulnerabilities such as prompt injection, data poisoning, or model extraction. The realm of hardware-level threats, especially those exploiting microarchitectural features like CPU caches, remained largely uninvestigated in the context of on-device LLM inference. This research gap led to the central question posed by Gao and his team: Can a co-located, unprivileged malware reconstruct user prompts and model outputs purely via cache side-channels?

The threat model employed in this research is equivalent to the classic flush+reload attack. In this scenario, the adversary is assumed to:

1. Be able to execute arbitrary malicious code on the victim's machine. This implies the attacker has achieved some level of initial compromise, such as malware execution.
2. Obtain a shared memory mapping of the victim's model files. This is often possible on modern operating systems where processes can share memory pages for efficiency, or through vulnerabilities that allow memory mapping.
3. Invoke cache line flush instructions. These instructions (e.g., clflush or clwb) are typically available to unprivileged code on many architectures, allowing an attacker to evict specific cache lines.

Under these assumptions, and crucially, without any further interaction with the victim, the adversary attempts to recover both the model's inputs (user prompts) and outputs (LLM responses). This demonstrates a potent, stealthy attack vector where the LLM's privacy assurances are fundamentally undermined by the hardware's operational characteristics. The problem exists because the efficient memory access patterns of LLMs, particularly within their embedding layers, create predictable microarchitectural states that can be observed and exploited by a malicious co-resident process.

Key Findings

▶ Watch: Attack intuition: Token position leakage and timing signature (4:00)

The research unveils two primary forms of information leakage from local LLM inference via hardware cache side-channels: token value leakage and token position leakage. These findings collectively enable the reconstruction of both user prompts and model responses.

First, token value leakage is exploited through the LLM's embedding layer. The researchers observed that the embedding layer functions essentially as a large lookup table. Each unique token accessed by the LLM corresponds to a specific row in this embedding table. When the LLM processes a token, it accesses a particular memory location within this table, resulting in a unique cache access pattern. Since embedding layers are typically computed on the CPU, an unprivileged attacker operating on the same CPU can probe these cache access patterns. By monitoring cache hits, misses, or timing differences associated with specific cache lines, the adversary can infer exactly which rows of the embedding table were accessed, thereby deducing the underlying token index that was processed. This allows the attacker to recover the individual token values.

Second, token position leakage is derived from the auto-regressive nature of LLM decoding. During the decoding process, both prompt tokens and response tokens pass through the embedding layer. By analyzing the timing signal of cache accesses, the researchers observed that response tokens unfold over several distinct time steps. This creates a steady, rhythmic timing signature that reveals the sequential position of each token. By combining the recovered token values with their inferred positions, the unprivileged malware can reconstruct the LLM prompt and response tokens piece by piece.

However, the researchers faced two significant challenges in realizing this attack:

1. Cache side-channel noise: Modern processors employ aggressive hardware prefetchers, which proactively load data into the cache, creating substantial noise. This noise can overwhelm the subtle cache signals generated by LLM operations, leading to a very low signal-to-noise ratio (estimated at roughly 1 to 50,000). Overcoming this required sophisticated techniques to distinguish legitimate signal from spurious prefetcher activity.
2. Scrambled input tokens: During the prefill stage of LLM inference, input tokens often appear in a scrambled order from the cache side-channel perspective. This is due to the inherently non-deterministic execution order of concurrent processes on the CPU. Reconstructing the original prompt sequence from these mixed-up pieces presents a challenge akin to solving a jigsaw puzzle with thoroughly shuffled components.

Despite these challenges, the research successfully developed a novel attack pipeline that addresses these issues, demonstrating a practical and effective method for reconstructing sensitive LLM conversations.

Technical Deep Dive

▶ Watch: Overview of the novel attacking pipeline (6:00)

The core of this research lies in a sophisticated, multi-stage attack pipeline designed to overcome the inherent noise and complexities of hardware cache side-channels when targeting LLM inference. The pipeline begins with raw cache traces and culminates in the reconstruction of coherent user prompts and model responses.

The Attack Pipeline

The proposed attack pipeline consists of six key steps:

1. Cache Tracing: Capturing raw cache access patterns from the victim LLM application.
2. Phase Identification and Splitting: Dividing the captured traces into distinct "prefill" and "decode" phases.
3. Token Sequence and Timing Signal Extraction: Reverse engineering token indices from cache accesses and assembling timing signals.
4. Pre-processing and Noise Handling: Applying advanced techniques to filter out noise, identify false positives, and insert missing tokens.
5. Response Reconstruction (LMA): Utilizing a fine-tuned LLM (LMA) to reconstruct the coherent response sequence.
6. Prompt Reconstruction (LMB): Employing another specialized LLM (LMB) to address scrambled prefill tokens and reconstruct the original user prompt.

Cache Tracing

The unprivileged malware initiates the attack by using the mm system call to obtain a shared memory mapping of the victim's LLM model file. This shared mapping is crucial because it allows the attacker to monitor cache lines that are also accessed by the victim. The primary side-channel technique employed is an improved flush+reload strategy. This strategy involves repeatedly flushing specific cache lines (using clflush or similar instructions) and then measuring the time it takes to access them. A fast access (cache hit) indicates the victim recently loaded the data into the cache, while a slow access (cache miss) suggests it was not recently accessed or was evicted. A key innovation here is the ability of their flush+reload strategy to overcome hardware prefetchers, which aggressively load data and can generate significant noise, leading to many false positives. By carefully designing their probe strategy, they effectively cut down on this spurious prefetcher activity.

The output of this stage is a cache trace, visualized as a heatmap where the x-axis represents the number of flush+reload runs (time), the y-axis indicates the probed embedding table row index, and color intensity encodes low latency (i.e., a cache hit).

Phase Identification and Splitting

LLM inference typically involves two distinct phases: prefill (processing the input prompt) and decode (generating the response token by token). These phases exhibit different cache access patterns. The prefill stage generally yields a much higher density of cache hits due to the simultaneous processing of multiple input tokens, whereas the decode stage shows a more rhythmic, lower-density pattern as tokens are generated sequentially. The researchers leverage this difference in cache hit density to partition the raw cache trace into separate prefill and decode segments, allowing for specialized processing for each.

Token Sequence and Timing Signal Extraction

Once the trace is partitioned, the next step is to reverse engineer token indices from the cache hits. Since each row of the embedding table corresponds to a unique token, a cache hit on a specific row directly reveals the token index. These raw token indices are then passed to a detokenizer (a component of the LLM framework) to convert them back into human-readable text. At this point, however, the recovered text is still noisy and potentially scrambled, especially during the prefill phase.

Concurrently, the timestamps of each cache hit are extracted and assembled into a time series, which forms the timing signal. This signal is critical for understanding the auto-regressive nature of the LLM's output and for subsequent noise reduction.

Pre-processing and Noise Handling

Addressing the substantial noise in cache side-channels is a major technical hurdle. The researchers employ a multi-pronged approach:

1. Power Spectral Density (PSD) Analysis: They analyze the decoding trace using PSD, which helps distinguish valid signal peaks (representing genuine token accesses) from background noise. While PSD can identify signal, it struggles with distinguishing false negatives (missed tokens) from false positives (spurious cache hits).

1. PSD-based First-Order Temporal Difference: To overcome the limitations of raw PSD, a novel technique called PSD-based first-order temporal difference is introduced. This technique analyzes the waveform of the timing signal. The key observation is that false positives tend to occur near the valleys of the signal, whereas false negatives appear near the peaks. This allows for a more robust identification of legitimate token accesses. Furthermore, this method is designed to be agnostic to specific decoding speeds. By estimating the actual decoding cycle via PSD and using it to normalize the first-order temporal difference (constraining its values to roughly 0 to 2), the technique generates hardware-independent training data.

1. LLM for Token Prediction (LMA): The noise handling culminates in a two-fold strategy:

• Removal of Spurious Tokens: Tokens occurring in the "valley regions" of the signal (identified as likely false positives) are predicted and removed.
• Insertion of Missing Tokens: Tokens missing near the "signal peaks" (identified as likely false negatives) are predicted and inserted.

This process closely resembles a masked language modeling (MLM) or cloze task, where missing words in a sentence need to be predicted based on context. Therefore, a specialized LLM, dubbed LMA, is leveraged for this token prediction task.

Response Reconstruction (LMA)

The LMA model is specifically designed to reconstruct the LLM's response. The pipeline for response reconstruction involves:

1. Collecting raw cache traces from the victim.
2. Feeding these traces into the PSD-based pre-processing module for noise reduction and signal enhancement.
3. Fusing the cleaned timing signal and tokens.
4. Feeding the fused data into the fine-tuned LMA.

Crucially, LMA is trained entirely on synthetic data. This synthetic data generation process begins with a large corpus of text. Noise is randomly simulated and injected into this text, mimicking true positives and various types of cache side-channel noise, using a large set of synthetic traces. Thanks to the PSD-based pre-processing, the generated signals are no longer dependent on a particular CPU's decoding speed, making the training data hardware-agnostic. The LMA learns to recover the original text from these simulated noisy traces.

Prompt Reconstruction (LMB)

Reconstructing the original prompt presents an additional challenge due to the scrambled order of prefill tokens. To address this, a second specialized LLM, LMB, is introduced. LMB's solution consists of two parts:

1. Contextual Dependency: It leverages the inherent contextual dependency between the LLM prompt and its subsequent response. The recovered response provides crucial contextual cues.
2. Guided Reconstruction: The prefill tokens (which are still scrambled) are fused with this recovered context. Guided by the contextual information from the response, LMB then reconstructs the original, coherent prompt. This effectively solves the "jigsaw puzzle" of scrambled input tokens by using the output as a guiding reference.

This comprehensive technical pipeline demonstrates a highly sophisticated approach to exploiting a subtle hardware vulnerability, transforming noisy, low-level signals into meaningful, high-level linguistic information.

Demo / Proof of Concept

▶ Watch: Pipeline step 1 & 2: Cache tracing and phase division (6:30)

The efficacy and broad applicability of the proposed cache side-channel attack were rigorously validated through extensive experimental evaluation in real-world deployments. The researchers deployed their attack on a diverse range of hardware platforms, utilizing multiple LLM families and various inference frameworks.

The evaluation encompassed:

• Hardware Platforms: From consumer-grade CPUs to GPU-accelerated systems, including Intel 12th generation i7 and 14th generation i9 processors. This demonstrated the attack's persistence across different microarchitectures and processing capabilities.
• LLM Families: Five distinct LLM families were tested, showcasing the attack's generalizability across different model architectures and sizes.
• Inference Frameworks: Ten popular inference frameworks were included in the evaluation, such as Hugging Face Transformers and llama.cpp. A significant finding was that the attack succeeded across all 10 frameworks without requiring retraining of the attacker models (LMA and LMB). This indicates a high degree of agnosticism to the specific implementation details of the inference engine.

The experimental results demonstrated high accuracy in reconstructing both user prompts and model responses. The attack proved to be largely agnostic to the specific LLM architecture, inference framework, and underlying hardware. In striking examples presented during the talk, the researchers were able to recover specific, sensitive details from the noise-corrupted cache traces. One particular example highlighted the recovery of "specific grains" from the noisy signal, illustrating the attack's potential to leak personally identifiable information (PII). This comprehensive validation underscores the practical threat posed by this vulnerability, confirming that it is not an esoteric theoretical possibility but a tangible risk in current on-device LLM deployments.

Defensive Implications

▶ Watch: Leveraging LLMs for robust token prediction and reconstruction (10:00)

The findings of this research necessitate a re-evaluation of LLM privacy and demand a multi-layered defensive strategy spanning the entire system stack. Mitigations can be broadly categorized into hardware and software approaches, each with its own set of challenges and trade-offs.

On the hardware side, cache partitioning offers a direct mechanism to prevent such side-channel attacks. Technologies like Intel's Cache Allocation Technology (CAT) can be used to isolate the victim LLM application's cache usage from potential attackers. By dedicating specific cache ways or slices to sensitive applications, it becomes significantly harder for a co-located adversary to monitor the victim's cache access patterns. However, a major limitation is that features like Intel CAT are generally unavailable on consumer CPUs, which are precisely the devices where local LLMs are gaining traction. This leaves a vast segment of the on-device AI market vulnerable.

Moving to software mitigations, several strategies can be considered:

1. Disable Zero-Copy Loading: Many LLM inference frameworks employ zero-copy loading to enhance performance, where model weights or embedding tables are directly mapped into memory without an intermediate copy. While efficient, this practice facilitates the shared memory mapping crucial for the flush+reload attack. Disabling zero-copy loading would block these direct cache leaks by forcing data to be copied, thus breaking the shared memory prerequisite. However, this comes with a significant extra memory overhead and potential performance degradation, which might negate some of the benefits of on-device inference.
2. Enforce Row-Based Access Control: A more granular approach would be to enforce row-based access control on sensitive data structures like the embedding table. This would require the operating system (OS) to mediate access to individual rows or segments of the embedding table, preventing an unprivileged attacker from directly probing specific entries. In practice, implementing such fine-grained access control would require substantial OS support and modifications, which are currently not standard.
3. Cache Randomization/Obfuscation: While not explicitly detailed as a mitigation in the talk, common side-channel defenses include techniques like cache randomization or obfuscating memory access patterns to make them less predictable. However, applying these to the highly structured access patterns of LLM embedding layers without significant performance impact remains an open research challenge.

The authors conclude that effective LLM privacy requires coverage of the full system stack, encompassing the silicon (hardware), the operating system, and the inference frameworks. A holistic approach is necessary, as relying solely on software protections proves insufficient against hardware-level exploits, and hardware solutions are often not universally available. Future work might also explore extending these techniques to other CPU side-channels like prime+probe or adapting the attack to GPUs using techniques like invad+reload against token embeddings, suggesting that the defensive landscape will need to continuously evolve.

Key Takeaways

• Local LLMs are vulnerable to hardware cache side-channel attacks: Despite the perception of enhanced privacy, on-device LLM inference can leak sensitive user prompts and model responses through microarchitectural vulnerabilities.
• Embedding layer is the primary target: The LLM's embedding layer, functioning as a lookup table, creates predictable cache access patterns that enable the recovery of individual token values.
• Timing signals reveal token positions: The auto-regressive nature of LLM decoding produces a rhythmic timing signature, allowing adversaries to infer the sequential position of tokens.
• Sophisticated pipeline overcomes noise and scrambling: A novel attack pipeline, incorporating PSD analysis, temporal difference techniques, and fine-tuned LLMs (LMA, LMB), effectively addresses significant challenges posed by cache prefetchers and scrambled input tokens.
• Attack is highly agnostic and effective: The demonstrated attack achieves high accuracy across diverse hardware (Intel 12th-14th gen i7/i9), five LLM families, and ten popular inference frameworks (e.g., Hugging Face Transformers, llama.cpp) without retraining.
• Comprehensive mitigations are required: Effective defense demands a full-system stack approach, integrating hardware solutions (like Intel CAT, if available) and software adjustments (disabling zero-copy, OS-level row-based access control), though these often come with performance or availability trade-offs.

About the Speaker(s)

Zibo Gao is the speaker who presented this significant research at USENIX Security. While the transcript does not provide extensive biographical details, his presentation of this detailed and technically profound work on cache side-channel attacks against large language models indicates expertise in computer security, particularly in microarchitectural attacks and the privacy implications of emerging AI technologies. His work highlights a critical area of concern for the future of on-device AI.