Whisper Leak: A novel side-channel attack on remote language models

Microsoft has disclosed a novel side-channel attack, dubbed Whisper Leak, that could let an attacker observe encrypted network traffic and infer the topic of language model conversations despite TLS protections.

The researchers trained classifiers to distinguish a target topic from background traffic by analysing encrypted packet sizes and inter-arrival times during streaming responses, achieving high accuracy in controlled tests—with some models showing up to 100% precision while flagging 5-50% of target conversations. They emphasise that real-world performance depends on traffic patterns and dataset diversity, but the results suggest a practical risk.

Mitigations have been implemented by several providers, with OpenAI, Mistral, Microsoft, and xAI deploying protections; in particular, OpenAI and later Microsoft Azure added a field under the streaming response called obfuscation to randomise token length and mitigate the attack, with Microsoft noting Azure’s mitigation reduces effectiveness to no longer a practical risk. Mistral also introduced a similar mitigation parameter, named “p”.

Users are advised to avoid discussing highly sensitive topics on untrusted networks, consider using VPNs, and prefer providers that have implemented mitigations or non-streaming models.