Microsoft Uncovers 'Whisper Leak' Attack That Identifies AI Chat Topics in Encrypted Traffic

Microsoft has disclosed details of a novel side-channel attack named Whisper Leak that could allow a passive observer of encrypted traffic to infer the topic of a conversation with remote language models. The researchers demonstrated that the sequence of encrypted packet sizes and inter-arrival times during a streaming language model response can be used to classify the initial prompt’s topic, even when responses are streamed in groups of tokens.

They trained classifiers using LightGBM, Bi-LSTM, and BERT, and found that many models from Mistral, xAI, DeepSeek, and OpenAI achieved scores above 98%. According to Microsoft, a government agency or internet service provider monitoring traffic could reliably identify users asking questions about specific sensitive topics, despite encryption.

Following responsible disclosure, OpenAI, Mistral, Microsoft, and xAI have deployed mitigations, with one effective countermeasure involving adding a random sequence of text to each response to obscure token lengths. The researchers note the attack’s effectiveness improves as more training samples are collected, turning Whisper Leak into a practical threat.