Whisper Leak: Attack Infers Encrypted AI Chat Topics with 98%+ Accuracy

Microsoft’s Threat Intelligence team has disclosed a novel side-channel attack, Whisper Leak, showing that an attacker observing encrypted network traffic could infer the topics of AI chatbot conversations despite TLS protection. The attack relies on subtle patterns in packet sizes and timing intervals from AI responses streaming token-by-token, enabling classifiers to identify conversation topics in controlled experiments with very high accuracy.

Across multiple models, attack accuracy exceeded 98%, and in tests with a single sensitive session hidden among 10,000 random sessions, researchers achieved 100% precision for flagged conversations. The researchers warn that nation-state actors, internet service providers, or local network eavesdroppers could monitor AI traffic for politically sensitive or banned topics, even when encryption is used.

Microsoft coordinated with vendors including OpenAI, Mistral, and xAI to deploy countermeasures such as randomising packet patterns and obfuscating token lengths, with OpenAI and Azure adding an obfuscation field and Mistral introducing a parameter to mask token sizes; Azure mitigation reportedly reduces attack effectiveness to levels no longer regarded as a practical risk.