Researchers Demonstrate Timing-Based Attacks That Steal LLM Architecture Secrets

Summary

Academic researchers have published a new study on timing-channel attacks against production language models, demonstrating that proprietary architectural details and deployment strategies can be extracted from LLMs using only token generation timing data. The research, titled "LeakyLMs: Stealing Architecture and Inference Optimizations via Per-Token Timing," shows that these attacks work even when interacting with models through remote APIs, without requiring direct access to model weights or architecture specifications.

The researchers identify two core attack vectors: the first targets inference optimizations and deployment strategies, while the second recovers key architectural properties including the number of transformer layers, hidden dimension size, and number of attention heads. The team's concrete demonstration includes revealing that Google's Gemini Flash 2.5 uses speculative decoding with a draft context window of approximately 128K tokens. Testing on Meta's Llama models showed that the correct architectural configuration appeared in the top-10 guesses more than 90% of the time.

The attack exploits the fact that model latency is highly dependent on configuration and hardware parameters. By building a detailed model of token-generation timing on NVIDIA GPUs and performing a search over the architecture space, attackers can infer fundamental properties about a model's design without ever accessing proprietary information directly. This work opens a new category of security vulnerabilities for AI providers to consider.

• Timing-channel attacks represent a previously underappreciated vulnerability category for production LLM systems

Editorial Opinion

This research highlights a critical blind spot in LLM security: seemingly innocuous timing data can serve as a powerful side-channel for extracting proprietary model information. While the attacks require some tuning and knowledge of the GPU hardware, the fact that they work through remote APIs makes them practical threats to production systems. This work should compel LLM providers to implement timing normalization and other countermeasures to harden their inference pipelines, similar to defenses used in cryptographic systems. The research underscores that building production AI systems requires thinking deeply about information leakage through non-obvious channels.