早起的鸟儿抓到泄漏：揭示LLM服务系统中的计时侧信道
The Early Bird Catches the Leak: Unveiling Timing Side Channels in LLM Serving Systems
AI总结：
本文首次揭示LLM服务中由KV缓存与语义缓存引发的计时侧信道，提出基于计时测量、分类模型和逐token搜索的提示窃取攻击，并通过黑盒实验验证其现实风险。
摘要：
大语言模型（LLM）的广泛部署引发了优化其推理性能的强烈需求。如今，服务于这一目的的技术主要通过算法和硬件增强来降低延迟并提高吞吐量，却在很大程度上忽视了其隐私副作用，尤其是在多用户环境中。在我们的研究中，我们首次发现了LLM系统中一组由共享缓存和GPU内存分配引发的新型计时侧信道，这些信道可被利用来推断机密系统提示以及其他用户发出的提示。这些漏洞呼应了传统计算系统中观察到的安全挑战，凸显出迫切需要解决LLM服务基础设施中潜在的信息泄漏问题。在本文中，我们报告了旨在利用LLM部署中固有的此类计时侧信道的新型攻击策略，专门针对被广泛用于提升LLM推理性能的Key-Value（KV）缓存和语义缓存。我们的方法利用计时测量和分类模型来检测缓存命中，使攻击者能够以高准确率推断私有提示。我们还提出了一种逐token搜索算法，以高效恢复缓存中的共享提示前缀，证明了窃取系统提示和同级用户所产生提示的可行性。我们针对流行在线LLM服务进行黑盒测试的实验研究表明，此类隐私风险完全现实存在，并会造成严重后果。我们的发现强调，需要强有力的缓解措施来保护LLM系统抵御此类新兴威胁。
英文摘要：
The wide deployment of Large Language Models (LLMs) has given rise to strong demands for optimizing their inference performance. Today's techniques serving this purpose primarily focus on reducing latency and improving throughput through algorithmic and hardware enhancements, while largely overlooking their privacy side effects, particularly in a multi-user environment. In our research, for the first time, we discovered a set of new timing side channels in LLM systems, arising from shared caches and GPU memory allocations, which can be exploited to infer both confidential system prompts and those issued by other users. These vulnerabilities echo security challenges observed in traditional computing systems, highlighting an urgent need to address potential information leakage in LLM serving infrastructures. In this paper, we report novel attack strategies designed to exploit such timing side channels inherent in LLM deployments, specifically targeting the Key-Value (KV) cache and semantic cache widely used to enhance LLM inference performance. Our approach leverages timing measurements and classification models to detect cache hits, allowing an adversary to infer private prompts with high accuracy. We also propose a token-by-token search algorithm to efficiently recover shared prompt prefixes in the caches, showing the feasibility of stealing system prompts and those produced by peer users. Our experimental studies on black-box testing of popular online LLM services demonstrate that such privacy risks are completely realistic, with significant consequences. Our findings underscore the need for robust mitigation to protect LLM systems against such emerging threats.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
