SparSEEty: Extracting Tokens from Sparsity-Exploiting LLM Serving Systems via Deterministic Side Channels
SparSEEty exploits side channels to reconstruct input tokens from sparse activations in confidential VM environments.
Key Findings
Methodology
SparSEEty combines page fault, block I/O, and memory allocation side channels to build a neuron activation oracle. It monitors sparse FFN weight accesses during inference, capturing binary activation traces. Using model probability distributions, it performs autoregressive inverse mapping from activation patterns to input tokens. The attack operates in online monitoring and offline reconstruction phases, employing selective neuron monitoring and chained page preloading to minimize detection risk. The offline phase uses a stepwise search to match activation traces with token candidates, ensuring high accuracy.
Key Results
- Across models like GPT-2 and LLaMA, SparSEEty achieves BLEU scores >0.95 in reconstructing prompt and response tokens, with monitoring overheads of only 3.7% to 7.2%.
- On datasets WikiText and OpenWebText, the method consistently performs well, with monitored neurons constituting less than 0.03% of FFN neurons, demonstrating high efficiency.
- Even with LoRA fine-tuned models, increasing monitored neurons to 400, the attack maintains high accuracy, showing robustness across model variants.
Significance
This work exposes a critical privacy vulnerability in sparsity-optimized LLM inference within confidential environments. It demonstrates that input tokens, including sensitive prompts and generated responses, can be covertly reconstructed without real-time query access, challenging assumptions about model confidentiality. The findings urge a reassessment of hardware and software defenses, emphasizing the need for side-channel resistant architectures and secure inference protocols, impacting both academia and industry.
Technical Contribution
The paper pioneers a multi-side-channel fusion approach to leak sparse neuron activation patterns, constructing a binary activation oracle without requiring full activation values. It introduces a novel selective monitoring strategy and a chained page preloading technique, reducing detection risk and system overhead. The core innovation lies in combining probabilistic search with partial binary traces, enabling end-to-end token reconstruction in a setting previously thought secure, thus expanding the attack surface for confidential model deployment.
Novelty
Unlike prior methods that rely on full-precision activation or query access, SparSEEty exploits the input-dependent nature of sparse activations via multiple deterministic side channels. It uniquely operates within Intel TDX CVMs, reconstructing tokens solely from binary activation traces, a significant leap in side-channel attack capability against privacy-preserving inference systems. This approach bridges hardware side-channel leakage with model sparsity, opening new avenues for security research.
Limitations
- The attack assumes specific hardware features (Intel TDX) and may not directly transfer to other architectures like AMD SEV or ARM-based systems. The effectiveness diminishes for dense, fully activated models or non-ReLU activations. In environments with high noise or extremely low activation sparsity, accuracy could decline. The approach also requires offline access to model weights, limiting real-time applicability.
Future Work
Future research will explore extending this attack to multi-modal models and different hardware platforms, enhancing robustness and generality. Developing countermeasures, such as side-channel resistant hardware or randomized activation schemes, is crucial. Additionally, integrating attack insights into privacy-preserving model design could help mitigate such vulnerabilities, fostering a more secure deployment ecosystem.
AI Executive Summary
Modern large language models (LLMs) leverage activation sparsity to significantly improve inference efficiency, reducing computational and memory costs. Techniques like sparse matrix multiplication in FFN layers enable serving larger models with fewer resources. However, this efficiency gain introduces new privacy vulnerabilities. Because sparse activations depend on input tokens, their memory access patterns become input-dependent, creating side channels that can be exploited by adversaries.
This paper presents SparSEEty, a novel side-channel attack that reconstructs input tokens by monitoring the sparse FFN weight accesses within a confidential VM environment. The attack combines multiple deterministic side channels—page faults, block I/O, and memory allocation—to build a neuron activation oracle. This oracle captures binary activation traces during inference, which are then inverted offline using a probabilistic search guided by the model's output distribution. The approach does not require real-time query access, making it highly covert.
Experimental results demonstrate that SparSEEty achieves high-fidelity token reconstruction across multiple models like GPT-2 and LLaMA, with BLEU scores exceeding 0.95. The attack incurs minimal overhead, between 3.7% and 7.2%, and remains effective even when models are fine-tuned with LoRA. These findings reveal a fundamental tension between efficiency and privacy in model deployment, urging the community to develop countermeasures.
While promising, the attack's effectiveness depends on specific hardware features and the presence of activation sparsity. Extending this work to other architectures and designing robust defenses are critical future directions. Overall, the research underscores the importance of considering side-channel risks in the era of resource-optimized, privacy-sensitive AI deployment.
Deep Analysis
Background
随着Transformer模型的不断发展，激活稀疏性逐渐成为提升推理效率的重要手段。早期工作如Sparse Transformer、ReLU激活机制，通过只激活部分神经元，显著降低了计算成本和能耗。大规模模型如GPT-3、LLaMA采用模型并行、KV缓存等技术优化推理速度。同时，侧信道攻击技术也逐步成熟，包括缓存攻击、页面故障和内存泄露，威胁模型安全。近年来，学界开始关注模型在硬件优化后潜在的隐私风险，尤其是在Confidential Virtual Machine（CVM）环境中，侧信道泄露成为新焦点。尽管如此，利用激活稀疏性进行Token重建的系统性研究仍较缺乏，特别是在多侧信道结合的复杂场景中。
Core Problem
激活稀疏性虽带来推理效率的提升，但也引入了输入依赖的内存访问模式，成为潜在的隐私泄露途径。在CVM环境中，攻击者可以利用页面故障、块I/O和内存分配侧信道，监控稀疏FFN层的权重访问，从而逆向推断输入Token。现有防御措施多关注于加密和访问控制，未充分考虑侧信道泄露风险。如何在保证模型性能的同时，防止激活稀疏性带来的信息泄露，成为亟待解决的关键问题。
Innovation
本研究提出SparSEEty，首次结合多侧信道技术（页面故障、块I/O、内存分配）实现稀疏激活的端到端Token反演。创新点包括：• 构建神经元激活Oracle，利用侧信道泄露的二值激活信息逆向推断Token；• 设计选择性监控策略，减少检测风险；• 引入链式页面预置技术，降低CVM退出成本；• 结合模型概率分布优化搜索策略，提高逆向效率。这一方案突破了以往依赖全精度激活值的限制，显著提升了攻击的实用性。
Methodology
- �� 识别神经元下投影权重的GPAs，结合页面故障、块I/O和内存分配侧信道实现监控。• 利用页面故障触发机制，捕获稀疏FFN层的二值激活信息。• 采用选择性监控策略，只监控关键神经元，降低检测风险。• 通过链式页面预置技术，减少CVM退出次数，确保连续监控。• 离线阶段，利用逐步逆推方法，将二值激活序列映射到对应Token，结合模型的概率分布，优化搜索过程。• 逐个Token逆向，重建完整输入序列。
Experiments
在GPT-2、LLaMA等多个Transformer模型上，使用WikiText和OpenWebText数据集，评估SparSEEty的重建效果。设置监控神经元数为100（第一层FFN），观察BLEU分数和监控开销。对比不同监控策略（全监控、选择性监控），验证鲁棒性。采用不同微调版本（如LoRA）测试适应性。通过消融实验，分析各技术组件对性能的影响。结果显示，少量神经元即可实现高精度重建，且监控成本低。
Results
SparSEEty在多模型、多数据集上实现BLEU分数>0.95，重建Prompt和Response。监控开销控制在3.7%-7.2%，远低于全监控方案。加入LoRA微调后，监控神经元数提升至400，仍保持高准确率。消融实验验证选择性监控和链式预置技术在降低检测风险的同时不影响重建效果。整体表现优于现有方法，验证了其在实际环境中的应用潜力。
Applications
该攻击揭示了在模型优化过程中潜在的隐私风险，适用于模型部署安全评估、隐私保护技术验证。行业可借助此技术检测模型在稀疏优化下的隐私泄露风险，推动安全设计。未来，结合防御机制，提升模型在实际应用中的安全性，确保敏感信息不被侧信道泄露。
Limitations & Outlook
攻击依赖特定硬件环境（如Intel TDX），在不同平台上可能效果有限。对非稀疏模型或激活函数非ReLU的模型效果较差。逆向过程在极低激活率或高噪声环境下存在误差。未来需扩展多平台适应性和增强鲁棒性。
Plain Language Accessible to non-experts
想象你在一个工厂里工作，工厂里有很多机器（神经元），每个机器在不同的任务（输入）下会开启或关闭。为了让工厂更快工作，工厂老板（模型优化者）让只有部分机器在工作（激活稀疏）。但如果有人偷偷观察工厂的电力使用（侧信道），就能猜出哪些机器在工作，从而知道工厂在做什么。这就像有人通过观察电灯的亮灭，推测工厂的生产内容（Token）。这篇文章的攻击方法就是利用这些电灯变化，反向推算出工厂的生产计划（输入Token），即使工厂试图隐藏信息，也难以避免被观察到。
ELI14 Explained like you're 14
想象你在学校的厨房里做饭，厨房里有很多厨师（神经元），每次做不同的菜（输入）时，只有一些厨师会出现在厨房（激活）。为了让做饭更快，厨师们只叫出一部分人（稀疏激活），而你可以偷偷观察厨房的灯光（侧信道），知道哪些厨师在工作。通过观察灯光的亮灭，你可以猜出他们在做什么菜（Token）。这就像有人在暗中看你做饭，虽然你试图隐藏，但他们还是能猜出你的菜单。本文的方法就是利用这些灯光变化，反推你在厨房做的菜，揭示了隐藏的秘密。
Glossary
Side Channel (侧信道)
通过非直接途径（如缓存、页面故障）泄露信息的技术，常用于攻击或监控系统。
本文利用页面故障和块I/O侧信道泄露稀疏激活信息。
Activation Sparsity (激活稀疏性)
神经网络中部分神经元在推理时被激活，导致大部分神经元值为零，提升效率。
模型利用激活稀疏性优化推理，但也引发隐私风险。
Confidential Virtual Machine (CVM, 保密虚拟机)
在硬件层面提供安全隔离的虚拟机环境，保护运行中的敏感数据。
攻击目标是在CVM中实现的稀疏模型推理系统。
Token (Token, 词元)
文本中的基本单位，可为字、词或子词，用于模型输入输出。
攻击目标是重建输入和输出的Token序列。
Sparse Matrix-Vector Multiplication (稀疏矩阵-向量乘法)
只计算非零元素的矩阵与向量乘积，减少计算量。
用于FFN层的稀疏下投影计算。
Open Questions Unanswered questions from this research
- 1 如何在不同硬件平台（如GPU、ARM）上实现类似攻击，是否存在平台特异性差异。
- 2 未来如何设计防御机制，有效抵抗此类多侧信道联合反演攻击。
Applications
Immediate Applications
模型安全评估
安全团队可以利用此技术检测模型在稀疏优化下的隐私泄露风险，优化模型设计，增强隐私保护措施。
Long-term Vision
隐私保护技术发展
推动开发抗侧信道的模型架构和硬件设计，确保大模型在优化效率的同时，保障用户隐私。
Abstract
Modern large language models (LLMs) exhibit activation sparsity, wherein only a subset of their neurons is activated for given input tokens. Researchers have leveraged this property to optimize LLM serving systems by omitting weight accesses and computations pertaining to inactive neurons. Unfortunately, however, such optimizations create input-dependent weight accesses, which can be leaked over side channels. We present SparSEEty, a new token extraction attack that exploits input-dependent neuron weight accesses introduced by sparsity-exploiting LLM serving systems. SparSEEty first constructs a neuron-activation oracle using neuron weight access side channels during LLM inference, and then inverts the activation traces to reconstruct the input tokens, forming an end-to-end token extraction attack. We instantiate SparSEEty against an LLM serving system protected inside an Intel TDX confidential virtual machine (CVM), addressing three key challenges: (i) constructing a neuron-activation oracle using a combination of side channels exposed by CVMs, (ii) reducing inference-time overheads of neuron activation monitoring for covertness, and (iii) accurately inverting partial binary activation traces back to tokens. Our evaluation shows that SparSEEty can reconstruct both prompt and response tokens with consistently high BLEU scores (>0.95) across various models and datasets, while incurring monitoring overheads of 3.7% to 7.2%.