Why can someone watching my encrypted LLM traffic still infer what I asked?
机会
Whisper Leak, disclosed in late 2025, demonstrated that analyzing packet timing and size patterns in encrypted streaming LLM responses classifies prompt topics with greater than 98% precision across 28 major providers. Some providers including OpenAI and Mistral deployed fixes, but those mitigations address token-length patterns only. A separate attack exploits speculative decoding: the number of tokens accepted per decoding step varies with output content, and that signal leaks through even padded connections because padding does not eliminate the acceptance-rate fluctuation. Proposed defenses such as token batching reduce attack accuracy by 50% but do not eliminate it, and random padding imposes up to 8.7x payload overhead with residual leakage. No provider has shipped a complete mitigation for the speculative decoding variant.
为什么重要
Any user querying a streaming LLM from a network that logs traffic is leaking the topic of their query regardless of TLS encryption, including users who believe they are communicating privately with a medical, legal, or financial assistant.
我如何评估机会
机会评分是我的个人判断，而非量化指标：痛苦程度、发生频率，以及当前解决方案的匮乏程度。分数越高，意味着我认为越值得去构建。
出现时造成的痛苦程度。
人们实际遇到它的频率。
当前针对它的优质工具有多匮乏。