Floating-point biases reveal hidden language model output details
Logit Leakage through Floating-Point Bias Addition
Cryptography and SecurityArtificial Intelligence
Summary
Language model APIs often hide some of their internal calculations, like exact token scores, but the authors found a way to uncover hidden details by studying how computers handle numbers. They discovered subtle quirks in the way floating-point numbers add biases that leak extra information through just the tokens the model outputs. This allows recovery of full score details that were believed hidden, using only a small number of queries. The authors also tested their method on many models and suggested how to prevent this leakage.
What this means in practice
- •For machine learning engineers: Diagnose and recover hidden logit information from language model APIs for debugging and analysis using token queries alone.
- •For ai security teams: Detect and mitigate subtle numerical side channels that leak internal language model scores via API outputs.
Authors
Shaomin Chen, Xiaorui Gong
Abstract
Language model APIs can expose token-specific biases while withholding logits and token probabilities. Existing bias-based extraction recovers relative logits, leaving a common additive component undetermined in ideal arithmetic. We identify a numerical side channel in floating-point bias addition that exposes information about this component through token identities alone. The channel distinguishes score vectors with identical complete unperturbed log probabilities. Our method exploits changes in representable spacing at binary exponent boundaries. Under the stated binary32 arithmetic assumptions and a known reachable score interval, it recovers a logit pair and its unknown tie-breaking priority exactly in at most 52 token queries. Given complete relative logits, one recovered anchor determines the original logit vector. We evaluate recovery across 11 public checkpoints from seven model families and extend the local method with adaptive interval search and anchor selection. In end-to-end experiments with vLLM, SGLang, and llama.cpp, adaptive recovery succeeds on all 128 Qwen3-0.6B inputs per system, including 64 held-out inputs. A separate token-only experiment extracts a pretrained small model's complete output-head representation up to an invertible hidden-basis transformation. We also establish a sufficient condition for suppressing common-shift disclosure by subtracting the maximum before bias addition. In controlled experiments, this mitigation eliminates all observed distinctions between common-shift variants and preserves token decisions under the tested random biases.