New side channel attack Whisper Leak snoops on encrypted conversations with LLMs

A new side channel attack called Whisper Leak can reveal the topics of encrypted conversations between users and large language models (LLMs). What’s more, access to the underlying text isn’t even needed.

According to researchers at Microsoft, this discovery highlights a growing blind spot in AI security where encryption alone no longer guarantees privacy in model interactions.

That’s because metadata patterns – network packet sizes and timings – can be exploited to infer sensitive subjects and corporate intent, said Microsoft’s Defender Security Research team.

Metadata as a new attack surface

In other words, encryption is good at protecting content but not context. And if someone is extremely good at analyzing context, metadata becomes a new attack surface.

For instance, a nation-state actor at the internet service provider layer, someone on the local network, or someone connected to the same WiFi router can observe the encrypted traffic and use it to infer whether the user’s prompt is on a specific topic, the researchers said.

“This especially poses real-world risks to users by oppressive governments where they may be targeting topics such as protesting, banned material, election process, or journalism,” the Microsoft team explains in a blog post.

Whisper Leak exploits a side channel in network communication rather than a flaw in encryption itself – unlike traditional data breaches or model leaks.

What actually happens? LLMs generate responses step by step, by producing one token at a time instead of the entire response at once. Besides, communications with the chatbots are often encrypted with HTTPS (Hypertext Transfer Protocol Secure), ensuring authenticity and security.

However, while Transport Layer Security successfully encrypts the content of communications, it reveals the size of the underlying data chunks being transmitted. For an LLM that streams responses token by token, this information reveals patterns about the tokens being generated.

Combined with timing information between packets, these leaked patterns form the basis of the Whisper Leak attack, as sufficient information is leaked to enable topic classification, Microsoft’s Defender Security Team explained in the technical report.

This, again, means these aren’t usual data breaches. Files aren’t stolen directly: attackers observe what’s going on around the data and look for small clues like timing or lags. They don’t actually need to break encryption or code.

Good at identifying topics

Researchers at Microsoft simulated a real-world scenario in which the adversary could observe encrypted traffic but not decrypt it. They chose “legality of money laundering” as the target topic for the proof-of-concept.

For positive samples, the team utilized a language model to generate 100 semantically similar variants of questions related to this topic. For negative noise samples, it randomly sampled 11,716 unrelated questions from the Quora Questions Pair dataset, covering a wide variety of topics.

OpenAI and Microsoft Azure soon added a random sequence of text of variable length to each response to mitigate the effectiveness of Whisper Leak.

The collected data was trained using LightGBM, Bi-LSTM, and BERT-based models, and evaluated in time-only, packet-size-only, or both modes.

Results are revealing. The research team demonstrated the attack across 28 popular LLMs from major providers, achieving near-perfect classification and high precision even at an extreme class imbalance (a 10,000:1 noise-to-target ratio).

For many models, they achieved 100% precision in identifying sensitive topics while recovering 5-20% of target conversations.

“Without strong privacy protections, users may be targeted or hesitate to share information, limiting the chatbot’s usefulness and raising ethical concerns,” Microsoft’s team said.

“Implementing robust anonymization techniques, encryption, and strict data retention policies is essential to trust and safeguarding user privacy in an era where AI-powered interactions are becoming the norm.”

The researchers shared their findings with OpenAI, Mistral, Microsoft, xAI, and other firms. OpenAI and Microsoft Azure soon added a random sequence of text of variable length to each response to mitigate the effectiveness of Whisper Leak.

However, models from providers such as Anthropic, AWS, Google, and DeepSeek haven’t been fixed yet, putting both individual private users and enterprise communications at risk.

Unlock more exclusive Cybernews content on YouTube.