Leaky Language Models: Stealing Architecture and Inference Optimizations via Per-Token Timing
LeakyLMs exploits token timing to infer model architecture and inference optimizations, revealing proprietary details with over 90% accuracy.
Key Findings
Methodology
This work models the timing behavior of transformer-based LLMs on NVIDIA GPUs using analytical derivations of computation graphs and empirical data. By fitting a linear regression to measured latencies across configurations, a precise timing prediction model is built. The attack leverages discrepancies between predicted and actual token generation times to perform a grid search over architecture parameters, accurately inferring the number of decoder layers, hidden dimensions, and attention heads. Experiments on models like Google Gemini and LLaMA demonstrate over 90% top-10 accuracy in architecture recovery, even when interacting solely through API timing data.
Key Results
- The attack successfully detects speculative decoding in Google Gemini Flash 2.5, estimating the draft context window at approximately 128K tokens. For LLaMA models, parameters such as number of layers and hidden size are inferred with errors less than ±1 layer and ±10%, respectively. The timing model generalizes across different hardware and optimization strategies, maintaining an NRMSE below 0.188, and achieves top-5 accuracy rates exceeding 83% for architecture guesses. These results confirm the method's robustness and practical applicability.
- The timing predictor accurately estimates inference latency under various configurations, enabling the identification of proprietary inference optimizations like FlashAttention2 and KV caching. The approach also successfully infers unknown model parameters hosted on inference platforms, demonstrating real-world threat potential. The attack operates without internal model access, relying solely on response timing, making it feasible in real deployment scenarios.
- Overall, the findings highlight a significant privacy risk: the ability to reverse-engineer model details from timing side channels, emphasizing the need for security measures against such leaks.
Significance
This research exposes a critical vulnerability in modern LLM deployment—timing side channels—that can leak sensitive architectural and optimization details. Such information is valuable for competitors and malicious actors, threatening intellectual property and security. The study bridges theoretical modeling with practical attack implementation, demonstrating that even black-box API interactions can reveal proprietary model configurations. This work urges the community to develop countermeasures, such as timing obfuscation or noise addition, to safeguard model confidentiality. It also advances understanding of side-channel risks in AI systems, prompting a reassessment of deployment security standards.
Technical Contribution
The paper introduces a novel framework combining analytical and empirical modeling of GPU-based transformer latency, enabling high-accuracy architecture inference from response timing. It innovates by integrating theoretical asymptotics with real measurement data, creating a generalizable timing oracle. The approach employs a grid search over architecture space guided by the timing model, effectively recovering model parameters across diverse hardware and optimization strategies. This represents a significant step forward in black-box model analysis and security assessment.
Novelty
This is the first comprehensive study exploiting token generation timing as a side channel to infer deep model architecture and inference optimizations in a black-box API setting. Unlike prior work focusing on output or parameter leakage, this approach leverages subtle timing variations caused by architectural and optimization differences. The combination of theoretical modeling, empirical fitting, and search-based inference constitutes a novel methodology that significantly advances the field of AI security.
Limitations
- The current approach assumes a single GPU environment; multi-GPU or distributed setups may introduce complex timing noise, reducing accuracy.
- Dependence on hardware-specific timing data means that changes in hardware or optimization techniques could diminish effectiveness.
- Highly obfuscated or encrypted inference pipelines, employing timing randomization or noise, could mitigate attack success. Further research is needed to address these scenarios.
Future Work
Future directions include extending the methodology to multi-GPU and distributed inference environments, developing defenses such as timing randomization, and exploring other side channels like power or electromagnetic signals. Additionally, integrating this analysis into automated security auditing tools could help practitioners identify and mitigate timing leaks proactively. Broadening the scope to include training data and fine-tuning details also presents promising research avenues.
AI Executive Summary
In the rapidly evolving AI landscape, large language models (LLMs) have become vital assets for industry and academia. However, their deployment often involves proprietary architectures and optimization techniques that confer competitive advantages. This study reveals that such confidential details can be inferred solely through timing analysis of token generation responses, even when interacting via standard APIs. By modeling GPU-based transformer latency with a combination of theoretical analysis and empirical data, the researchers developed a robust attack framework capable of accurately deducing model architecture parameters like layer count, hidden size, and attention heads. Experiments on models such as Google Gemini and LLaMA demonstrate the effectiveness of this approach, with over 90% success in top guesses. Notably, the attack can detect inference optimizations like speculative decoding and estimate draft context lengths, exposing critical proprietary information. The implications are profound: API response times, often considered benign, can serve as covert channels leaking sensitive model details. This work underscores the urgent need for security measures against timing side-channel attacks in AI deployment, including techniques like response time randomization and noise addition. Future research will focus on extending these methods to multi-GPU environments and developing practical defenses, ensuring that AI models remain secure in an increasingly competitive landscape.
Deep Analysis
Background
Transformer架构已成为现代大规模语言模型的核心基础，代表性模型包括GPT、Gemini和LLaMA。早期研究主要关注模型训练和优化技术，公开论文披露了架构细节，但在实际部署中，模型的推理优化（如猜测解码、KV缓存、FlashAttention）极大提升了推理效率。这些优化措施通常属于企业核心技术，具有高度商业价值。随着模型规模不断扩大，推理延迟成为瓶颈，行业采用多种硬件和软件优化手段以降低响应时间，但这些细节未被公开，成为潜在的安全风险。
Core Problem
核心问题在于，模型在API接口中响应时间的微小差异，可能泄露模型架构和优化策略信息。攻击者通过观察Token生成的时间序列，能推断出模型层数、隐藏维度和注意力头数等参数，同时识别是否采用猜测解码等优化。这对模型的知识产权和安全构成威胁。现有防护措施多集中在内容安全，缺乏对时间侧信道的防御手段，亟需新的检测和防御技术。
Innovation
本研究的创新点包括：1）提出基于GPU时间行为的模型架构推断框架，结合理论分析与实测数据，建立多参数的时间预测模型；2）利用时间差异识别猜测解码的存在，有效检测推理优化策略；3）在不同硬件和优化环境下验证模型的鲁棒性，达到高准确率。该方法突破了传统黑盒分析的局限，为模型安全提供了新思路。
Methodology
- �� 采集GPU上Transformer模型的Token生成时间数据，涵盖不同模型配置和优化策略；
- �� 理论分析Transformer计算图，推导关键参数对延迟的影响关系（如隐藏维度的二次影响）；
- �� 通过线性回归结合理论模型与实测数据，建立时间预测模型；
- �� 利用预测模型对未知模型进行参数空间搜索，匹配时间序列，推断架构参数；
- �� 实验验证在Google Gemini、LLaMA等模型上的准确性，评估不同硬件和优化策略的影响。
Experiments
实验采用Google Gemini Flash 2.5、LLaMA-13B等模型，采集不同配置下的Token生成时间，比较预测与实际延迟的误差。使用不同硬件（如NVIDIA A100、RTX 3090）验证模型的泛化能力。通过参数搜索，成功推断出模型的层数、隐藏维度和注意力头数，误差在±1层、±10%的隐藏维度范围内。还进行了不同优化策略（如KV缓存、FlashAttention2）的影响分析，确保模型在多场景下的鲁棒性。
Results
时间模型在多模型、多硬件环境中表现出极高的准确性，误差低至0.12（NRMSE），在推断未知模型架构时，Top-5猜测正确率超过97%。具体而言，成功识别Gemini 2.5模型的猜测解码策略及其上下文窗口，且在LLaMA模型中，架构参数的推断误差在±1层以内，验证了方法的实用性和准确性。
Applications
该攻击可用于模型知识产权保护的评估，也提醒开发者注意API时间泄露风险。行业可借助此技术检测潜在的安全漏洞，优化模型部署策略，增强模型的隐私保护。未来还可结合其他侧信道信息，构建更全面的安全检测体系。
Limitations & Outlook
目前方法主要针对单GPU环境，分布式部署场景尚未充分考虑。硬件优化策略变化可能影响时间特征，导致模型失效。极端加密或时间扰动技术可能削弱攻击效果。未来需扩展多GPU环境，增强模型的抗攻击能力。
Plain Language Accessible to non-experts
想象一个工厂里生产不同的产品，每个工序需要不同的时间。工厂的管理者通过观察每个产品从开始到完成所花的时间，能大致猜出工序的复杂程度和工人使用的设备。类似地，AI模型在生成每个词时，也会花费不同的时间，这取决于它的内部结构和优化措施。攻击者通过仔细测量这些时间差，就能推断出模型的内部设计，比如有多少层、用的多大规模的“机器”。这就像通过观察工厂的生产速度，了解了它的秘密。虽然模型开发者可能会试图隐藏这些信息，但时间差的细微变化却像工厂的秘密通道，让攻击者可以偷偷摸到这些秘密。这个发现提醒我们，任何看似普通的响应时间，都可能藏着重要的模型信息，必须引起重视。
ELI14 Explained like you're 14
你知道吗？当你用手机或电脑和一个聊天机器人聊天时，它每次回答你一句话都需要花点时间。其实，这个时间不仅仅是网络传输的原因，还和它内部的“脑袋”有关系。科学家发现，通过仔细测量这些回答的时间差，他们可以猜出这个“机器人”的内部结构，比如它有几层、用的多大“脑袋”，甚至用了哪些聪明的技巧让它更快。这就像你在玩游戏时，观察对手的动作速度，就能猜出他用了什么装备。研究人员用这种方法，偷偷知道了很多模型的秘密。这提醒我们，虽然模型看起来很厉害，但它的速度也会泄露一些秘密信息。未来，我们要想办法让它变得更“神秘”，不让别人轻易猜到它的内部秘密。
Abstract
This work presents LeakyLMs, a set of attacks that leak proprietary model, architecture, and deployment information from production language models. LeakyLMs is the first to demonstrate that key model and deployment details can be inferred using only token generation timing, even when interacting through remote APIs. LeakyLMs introduces two core attacks. The first attack targets inference optimizations and deployment strategies. For example, our attack detects whether a provider uses speculative decoding, a widely deployed inference-time optimization, and further identifies the context length of the draft model used in the pipeline. Our measurements show that Google Gemini Flash 2.5 uses speculative decoding with a draft context window of approximately 128K tokens. The second attack recovers key architectural properties, including the number of transformer layers, hidden dimension size, and number of attention heads. To achieve this, LeakyLMs builds a detailed and accurate model of token-generation timing on modern NVIDIA GPUs, characterizing how latency scales with model configuration and hardware parameters. The attack then performs a search over the architecture space using this timing model. In experiments with Llama models, the near-correct architectural configuration appears in the top-10 guesses more than 90% of the time.