{"id":5730,"date":"2025-11-10T11:47:46","date_gmt":"2025-11-10T11:47:46","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=5730"},"modified":"2025-11-10T11:47:46","modified_gmt":"2025-11-10T11:47:46","slug":"whisper-leak-uses-a-side-channel-attack-to-eavesdrop-on-encrypted-ai-conversations","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=5730","title":{"rendered":"Whisper Leak uses a side channel attack to eavesdrop on encrypted AI conversations"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Researchers at Microsoft have revealed a new side channel attack named Whisper Leak that can reveal the topic of encrypted conversations between users and language models, even without access to the underlying text.<\/p>\n

The discovery highlights a growing blind spot in AI security where encryption alone no longer guarantees privacy in model interactions.<\/p>\n

Microsoft\u2019s Security Defender Security Research team said<\/a> that attackers are in a position to exploit\u202flarge language models that use metadata such as network packet sizes and timings. For instance, a nation-state actor at the internet service provider layer, someone on the local network, or someone connected to the same Wi-Fi router can observe the encrypted traffic and use it to infer if the user\u2019s prompt is on a specific topic.<\/p>\n

Metadata becomes the new attack surface<\/h2>\n

Unlike traditional data breaches or model leaks, Whisper Leak exploits a side channel<\/a> in network communication rather than a flaw in encryption itself.<\/p>\n

LLM services generate responses step by step, by producing one token at a time instead of the entire response at once. Also, the communications with AI-powered chatbots are often encrypted with HPPS over TLS (HTTPS), ensuring the authenticity of the server and security through encryption.<\/p>\n

But while the Transport Layer Security successfully encrypts the content of communications, it leaks the size of the underlying data chunks being transmitted. For an LLM that streams responses token by token, this size information reveals patterns about the tokens being generated.<\/p>\n

Combined with timing information between packets, these leaked patterns form the basis of the Whisper Leak attack as sufficient information is leaked to enable topic classification, explained Microsoft Defender Security Team in the technical report<\/a>.<\/p>\n

\u201cThese are not usual data breaches either. They do not steal the files directly; they observe what is happening around the data,\u201d said Devroop Dhar<\/a>, co-founder & MD at Primus Partners. \u201cThey don\u2019t have to break encryption or code. What they do instead is look for small clues; timing, lags, maybe how quickly a system answers, and from that, they try to understand what\u2019s going on inside. It\u2019s very technical and tough to catch when it\u2019s happening,\u201d he added.<\/p>\n

Inside Microsoft\u2019s proof-of-concept<\/h2>\n

Researchers at Microsoft simulated a real-world scenario in which the adversary could observe encrypted traffic but not decrypt it. They chose \u201clegality of money laundering\u201d as the target topic for the proof-of-concept.<\/p>\n

For positive samples, the team used a\u202flanguage model\u202fto generate 100 semantically similar variants of questions about this topic. For negative\u202fnoise\u202fsamples,\u202fit randomly sampled 11,716 unrelated questions from the Quora Questions Pair dataset, covering a wide variety of topics.<\/p>\n

Once done, the collected data was trained using LightGBM, Bi-LSTM, and BERT-based models, evaluated in\u202ftime-only, packet-size only, or both modes.<\/p>\n

The research team demonstrated the attack across 28 popular LLMs from major providers, and achieved near-perfect classification (often >98% Area Under the Precision-Recall Curve (AUPRC)) and high precision even at extreme class imbalance (10,000:1 noise-to-target ratio). For many models, they achieved 100% precision in identifying sensitive topics while recovering 5-20% of target conversations, noted the report.<\/p>\n

Plugging the leaks<\/h2>\n

The findings were shared with OpenAI<\/a>, Mistral<\/a>, Microsoft, and xAI<\/a>, and mitigation measures were implemented to minimise the risk. To mitigate the effectiveness of cyberattacks, OpenAI, and\u202flater Microsoft\u202fAzure, added a random sequence of text of variable length to each response.<\/p>\n

This obfuscation field masked the length of each token, reducing the attack\u2019s effectiveness. Similarly, Mistral included a new parameter called \u201cp\u201d that had a similar effect.<\/p>\n

CISO\u2019s next frontier<\/h2>\n

Even if the attack doesn\u2019t expose the exact prompt or content of a conversation, it can accurately classify its subject or intent, putting enterprises at major risk.<\/p>\n

\u201cIf an LLM is just handling public data, it is fine. But if it is processing data like client records, internal documents, financial data, etc, then even a small leak matters. The bigger worry is for companies that run their own AI models or connect them to cloud APIs. Like banks, healthcare, legal firms, defence, where data sensitivity is too high,\u201d Dhar said.<\/p>\n

While it is the AI providers that will have to address the issue, Microsoft researchers\u2019 recommendations include avoiding discussing highly sensitive topics over AI chatbots when on untrusted networks, using VPN services for adding an additional layer of protection, opting for providers that have already implemented mitigation, and using non-streaming models of large language model providers.<\/p>\n

Dhar pointed out that most AI security checklists do not even mention side channels yet. CISOs need to start asking their teams and vendors how they test for these kinds of probable issues.<\/p>\n

\u201cAlso, in order to be defensive, we need to keep models isolated, add a bit of random delay so timing data is not predictable, and watch for weird or repeated queries that look like probing. Basically, we need to treat the AI pipeline the way we would treat a critical server, by following a few simple steps like logging it, segmenting it, and not assuming that it is invisible just because it is encrypted,\u201d he added. Over time, we will need proper \u201cAI pen-testing<\/a>,\u201d like what happened when cloud APIs first became mainstream. It is the same pattern, once the tech matures, attackers get creative and then security always has to catch up, he noted.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Researchers at Microsoft have revealed a new side channel attack named Whisper Leak that can reveal the topic of encrypted conversations between users and language models, even without access to the underlying text. The discovery highlights a growing blind spot in AI security where encryption alone no longer guarantees privacy in model interactions. Microsoft\u2019s Security […]<\/p>\n","protected":false},"author":0,"featured_media":5731,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-5730","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/5730"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5730"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/5730\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/5731"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5730"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5730"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5730"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}