‘Whisper Leak’ LLM Side-Channel Attack Infers User Prompt Topics

Whisper Leak is a new AI side-channel attack that uses metadata patterns to infer the topic of a user’s conversation with a remote language model, even when the content is encrypted. The attack assumes an observer can monitor the network traffic between the victim and the LLM and relies on the size and timing of data chunks sent in a streaming response.

In tests, 17 of 28 models achieved over 98% accuracy in distinguishing the target topic, with some reaching over 99.9%, effectively enabling identification of one in 10,000 target conversations with near-zero false positives. According to Microsoft notes, the researchers suggest mitigations such as random padding, token batching, and packet injection, and OpenAI and Microsoft Azure have added a random sequence of text to streaming responses to mask token lengths, with Mistral adding a similar parameter.

Users are advised to avoid discussing sensitive topics on untrustworthy networks, use VPNs, and choose providers that have implemented mitigations or non-streaming models. The findings were reported by Ionut Arghire on 11 November 2025.