Metraipolis › archive › dc_fac4909ed41d

Detokenization Leaks: Reconstructing Local LLM Outputs From Cache Traces — arXiv:2609.06674

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.06674
License (as archived): CC0-1.0
Archived: 2026-10-16T13:40:13.005Z
SHA-256 of the archived text: cdcf7f41275f64f71d570ba8a3f55915594715b838ed66b7aaf67d413d3116ff
Stable URL of this page: https://metraipolis.com/documento/dc_fac4909ed41d

How to cite

Detokenization Leaks: Reconstructing Local LLM Outputs From Cache Traces — arXiv:2609.06674 — arXiv (en), https://arxiv.org/abs/2609.06674 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_fac4909ed41d (Metraipolis archive dc_fac4909ed41d, sha256 cdcf7f41275f64f71d570ba8a3f55915594715b838ed66b7aaf67d413d3116ff)

BibTeX

@misc{dcfac4909ed41d,
  title = {Detokenization Leaks: Reconstructing Local LLM Outputs From Cache Traces — arXiv:2609.06674},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.06674},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_fac4909ed41d; sha256 cdcf7f41275f64f71d570ba8a3f55915594715b838ed66b7aaf67d413d3116ff},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.06674. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

We present a new attack that reconstructs the text generated by locally hosted LLMs by observing CPU cache activity during detokenization. Unlike prior attacks that rely on deployment-specific assumptions, such as shared data memory, CPU offloading, or Mixture-of-Experts architectures, our approach targets the detokenizer, a component used in default LLM inference pipelines. To obtain clean signals, we use Flush+Reload on shared tokenizer code to detect when decoding occurs, which lets us perform Prime+Probe at the right moment and isolate token-dependent cache activity. We then apply a clustering-and-language-model pipeline to recover text from noisy cache observations. We evaluate the attack across multiple datasets, hardware platforms, inference frameworks, and model families, and show that it can recover semantically accurate outputs from real-world local LLM deployments, including agentic systems. This vulnerability is particularly significant because the most widely used tokenizer implementations are susceptible to the attack and are embedded in many popular local LLM products and agent frameworks, including systems such as OpenClaw (which we demonstrate), substantially broadening the practical attack surface.

Tema degli esploratori: fiducia digitale e crittografia (retro-catalogo arXiv: annunci del 2026-09-09 in cs.CR).
Categorie arXiv: Cryptography and Security (cs.CR) ; Artificial Intelligence (cs.AI).
Pagina del lavoro: https://arxiv.org/abs/2609.06674 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-16T13:09:48.434Z dalla pagina https://arxiv.org/catchup/cs.CR/2026-09-09?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).