Your Model Is Leaking: Covert Information Transfer through LLM Residual Streams
A residual-stream covert-channel attack hides sensitive information in LLM intermediate activations, recoverable with a simple linear decoder without retraining or weight modification.
This research describes a residual-stream covert-channel attack that hides sensitive information in LLM intermediate activations, enabling recovery with a simple linear decoder without model retraining or weight modification.
- A residual-stream covert-channel attack hides sensitive information in LLM intermediate activations
- Attack requires no model retraining, weight modification, or attacker-controlled egress
- Recovers information via a simple linear decoder across eleven LLMs from seven architecture families
- Products
- large language models (LLMs)
- Malware
- covert-channel attack
- Organizations
- privacy-sensitive organizations
- Countries
- privacy-sensitive organizations
- AI models
- LLMlarge language models (LLMs)
From the original article
1 min read at arxiv.orgPrivacy-sensitive organizations may run large language models (LLMs) in restricted or air-gapped environments while exporting selected diagnostic artifacts. We show that a compromised runtime component can hide sensitive information in intermediate activations that are allowed to leave the restricted environment. An offline observer can recover this information with a simple linear decoder.
By Mingyuan Li · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.