Physical electromagnetic leaks reveal tokens and prompts on edge LLMs
Physical Side-Channel Attacks on Edge LLMs: Extracting Output Tokens and User Prompts
Cryptography and Security
Summary
Running large language models on local devices is thought to protect privacy by keeping data off the internet. However, this paper shows that someone who can physically access the device can read secret information like what you asked the model and what it outputs by measuring electromagnetic signals emitted during computation. The authors demonstrate this on a Raspberry Pi running a popular language model, recovering words with high accuracy just from those signals. This means running AI locally is not always enough to keep data private if attackers can measure the device’s hardware signals.
What this means in practice
- •For security engineers: Detect vulnerabilities in edge AI devices by monitoring for electromagnetic signal leaks exposing sensitive inference data.
- •For hardware designers: Design hardware and shielding methods for edge devices to reduce electromagnetic side-channel leakage in AI model inference.
Authors
Najeh Alhalawani, Gunes Acar, Zhuoran Liu, Lejla Batina
Abstract
The deployment of large language models (LLMs) on edge devices is largely motivated by privacy concerns over sharing sensitive user data with cloud servers. In this paper, we demonstrate that keeping inference local does not eliminate privacy risks: an adversary with physical access to the device may exploit hardware leakage to recover sensitive information without compromising or modifying the software system. In particular, we present an electromagnetic (EM) side-channel attack targeting LLM inference on edge devices. Targeting LLaMA-3.2-1B-Instruct running on a Raspberry Pi 5, we demonstrate that EM traces collected during inference can leak both generated tokens and user prompts. We propose three attacks under different threat assumptions. First, a profiling attack that identifies generated tokens among 50 medical and privacy-related keywords with 97.2% accuracy on profiled words. Second, a reconstruction attack recovers the model's hidden representations and uses them to predict tokens from the full 128k-token vocabulary, achieving 94.3% accuracy on profiled classes. For unseen words, the correct token is ranked within the first 100 positions of the 128k-token vocabulary in 67% of cases, with a median rank of 54. Finally, we present a hidden-state inversion attack that uses the recovered hidden state to reconstruct user prompts semantically. Our proposed attacks require only passive EM side-channel measurements and a limited number of traces during model training. These results demonstrate that local execution alone may not guarantee the confidentiality of generated tokens and user inputs.