LeakyLMs: Timing Attacks Expose LLM Architecture and Inference Tricks

A new research paper introduces LeakyLMs, a set of side-channel attacks that extract proprietary architecture and deployment details from production language models using only token generation timing observed through remote APIs. The first attack detects whether a provider employs speculative decoding and pinpoints the context length of the draft model used, revealing for instance that Google Gemini Flash 2.5 runs speculative decoding with a draft context window of roughly 128K tokens.

The second attack builds a precise timing model of how token-generation latency scales with model configuration and NVIDIA GPU hardware, then searches the architecture space to recover key parameters such as transformer layer count, hidden dimension size, and attention head count. Tested against Llama models, the correct architecture configuration appeared among the top-10 guesses more than 90% of the time.

The findings highlight a practical threat: commercial LLM providers may unintentionally leak intellectual property and deployment secrets through API response timing alone, raising new questions for API design and model confidentiality.