Sparse attention on GPUs leaks private data from language models
SparLeak: Privacy Leakage from Sparse Attention in LLM Inference on Shared GPUs
Machine LearningCryptography and Security
Summary
Modern large language models use a trick called sparse attention to speed up processing long texts, but this causes a hidden side effect where secret information can leak through how the computer accesses its memory. The authors found a new way to spy on these memory patterns during model runs, allowing them to guess what users asked and what the model replied. They tested this spying method across several models and privacy-sensitive datasets, successfully uncovering sensitive details most of the time. This shows a new privacy risk for language models running on shared GPUs that use sparse attention.
What this means in practice
- •For cloud service operators: Detect and prevent private data leaks when hosting large language model inference using sparse attention on shared GPUs.
- •For gpu hardware designers: Design GPU memory systems that mitigate or block side-channel leakage caused by sparse attention patterns during model inference.
Authors
Fahao Chen, Linkang Du, Jinhao Zhou, Peng Li, Zhou Su
Abstract
Sparse attention is widely used to accelerate long-context inference in modern large language models (LLMs), but its input-dependent execution behavior introduces previously unexplored privacy risks. We identify a new GPU micro-architectural side channel, termed Sparsity-Induced Memory Access (SIMA), which arises from secret-dependent key-value cache access patterns induced by sparse attention. Based on this observation, we present SparLeak, a phase-aware side-channel attack that extracts SIMA traces during LLM inference and enables two practical privacy extractions: query attribute inference from prefill-phase traces and autoregressive response reconstruction from decoding-phase traces. By reconstructing approximate token-level sparsity profiles from page-level observations and applying profiling-based learning, SparLeak accurately recovers sensitive information, including user-query attributes and private LLM response content. Extensive evaluation across three LLM architectures, three sparse attention mechanisms, and three privacy-sensitive datasets shows that SparLeak achieves average attack success rates of 90.9% for attribute inference and 87.3% for response reconstruction under real-world LLM serving settings, highlighting the significance to account for SIMA leakage when deploying sparse-attention-based LLM systems. We provide anonymized SIMA traces, trained attack models, evaluation scripts, and documentation as artifacts at https://anonymous.4open.science/r/Janus_artifacts/.