Wire flash
Study: CPU cache attack on local LLMs achieves up to 95.87% success rate in code tasks
Editorial responsibility
- No named human review is recorded for this page.
- Source reporting is collected, normalized, translated or condensed automatically when needed.
- Automatically published source-backed update
A new research finding reveals that running a large language model (LLM) locally, without cloud connectivity, does not guarantee privacy. The vulnerability stems from a routine step in token generation: converting each token into readable text leaves a repeatable pattern in the CPU cache. An attacker already on the same machine, sharing CPU resources, can learn these patterns to reconstruct model responses without accessing the model's memory. Across tests, full-response attack success rates ranged from approximately 56% to 93% on text tasks, reaching 95.87% in one code setting. An end-to-end attack on OpenClaw achieved 30.12%. The attack exploits a standard part of local LLM inference, not a specific model design. The source recommends stronger CPU isolation, shorter-lived processes, and disabling Simultaneous Multithreading (SMT) where security tradeoffs justify it, concluding that keeping a model off the cloud does not provide a complete privacy guarantee.
Source report
A newly identified vulnerability shows that running a large language model (LLM) locally—even entirely off the cloud—does not guarantee complete privacy. The attack exploits a routine step in token generation to leak model responses through the CPU cache.
How the Leak Works
The vulnerability stems from a standard operation: converting each generated token into readable text. This lookup process leaves a repeatable pattern in the CPU cache. A separate local process can learn these patterns well enough to reconstruct later responses without directly reading the model's memory.
Attack Success Rates
Across tests, full-response attack success rates ranged from approximately 56% to 93% on text tasks. In one code-related setting, the success rate reached 95.87%, while an end-to-end attack on OpenClaw still achieved 30.12%.
The attack targets a standard part of local LLM inference rather than relying on a specific model design.
Important Limitations
The attacker must already be on the same machine, share the relevant CPU resources, and profile the same long-lived LLM process. This means the attack is not remotely exploitable but poses a significant risk in shared or multi-tenant environments.
Recommendations for Sensitive Deployments
To mitigate this risk, the paper recommends:
- Stronger CPU isolation – Keep untrusted software off the same physical CPU core.
- Shorter-lived processes – Reduce the window of opportunity for profiling.
- Disabling Simultaneous Multithreading (SMT) – Where the security tradeoff justifies it.
Keeping your model off the cloud does not provide a complete privacy guarantee. For sensitive agents, these additional isolation measures are essential.
Source
rohanpaul_aiNeutral / independent