New Whisper Leak Toolkit Exposes User Prompts to Popular AI Agents within Encrypted Traffic
A sophisticated side-channel attack that exposes the topics of conversations with AI chatbots, even when traffic is protected by end-to-end encryption.
A sophisticated side-channel attack that exposes the topics of conversations with AI chatbots, even when traffic is protected by end-to-end encryption.
Dubbed “Whisper Leak,” this vulnerability allows eavesdroppers such as nation-state actors, ISPs, or Wi-Fi snoopers to infer sensitive prompt details from network packet sizes and timings. The discovery highlights growing privacy risks as AI tools integrate deeper into daily life, from healthcare queries to legal advice.
Researchers at Microsoft detailed the attack in a recent blog post, emphasizing its implications for user trust in AI systems. By analyzing streaming responses from large language models (LLMs) , attackers can classify prompts on specific topics without decrypting the data.
This is particularly alarming in regions with oppressive regimes, where discussions on protests, elections, or banned content could lead to targeting.
AI chatbots like those from OpenAI or Microsoft generate replies token by token, streaming output for quick feedback. This autoregressive process, combined with TLS encryption via protocols like typically shields content.
However, Whisper Leak targets the metadata: variations in packet sizes (tied to token lengths) and inter-arrival times reveal patterns unique to topics.
A sophisticated side-channel attack that exposes the topics of conversations with AI chatbots, even when traffic is protected by end-to-end encryption.
The methodology involved training classifiers on encrypted traffic. For a proof-of-concept, researchers focused on “legality of money laundering,” generating 100 prompt variants and contrasting them against 11,716 unrelated Quora questions.
Using tools like tcpdump for data capture, they tested models including LightGBM, Bi-LSTM, and BERT-based classifiers. Results were stark: many achieved over 98% accuracy on the Area Under the Precision-Recall Curve (AUPRC), distinguishing target topics from noise.
In simulated real-world scenarios, attackers monitoring 10,000 conversations could flag sensitive ones with 100% precision and 5-50% recall, meaning few false alarms and reliable hits on illicit queries.
The attack builds on prior research, like token-length inference by Weiss et al. and timing exploits by Carlini and Nasr, but extends to topic classification.
Microsoft collaborated with vendors including OpenAI, Mistral, xAI, and its own Azure platform to deploy fixes. OpenAI added an “obfuscation” field with random text chunks to mask token lengths, slashing attack viability.
Mistral introduced a “p” parameter for similar randomization, while Azure mirrored these changes. These updates reduce risks to negligible levels, per testing.
For users, experts recommend avoiding sensitive topics on public networks, using VPNs, opting for non-streaming modes, and choosing mitigated providers. The open-source Whisper Leak repository on GitHub includes code for awareness and further study.
This incident underscores the need for robust AI privacy as adoption surges. While mitigations address the immediate threat, evolving attacks could demand ongoing vigilance from the industry.
Follow us on Google News , LinkedIn , and X for daily cybersecurity updates. Contact us to feature your stories.
Based on reporting by Cyber Security News.