AI chat privacy at risk: Microsoft details Whisper Leak side-channel attack

Microsoft has revealed Whisper Leak, a side-channel attack that lets attackers who monitor network traffic infer what users discuss with remote language models, even when the data is encrypted. According to Microsoft, the researchers trained a binary classifier to detect when a chat involved a topic such as the legality of money laundering, using 100 topic-related prompts and more than 11,000 unrelated ones, and captured data with tcpdump while randomising samples to avoid cache bias.

They evaluated time, size and combined data with LightGBM, Bi-LSTM and BERT models, reporting that many models achieved over 98% accuracy (AUPRC) and that the unique digital fingerprints left by conversations can be recognised by an AI-powered eavesdropper.

In a simulation of a realistic surveillance scenario, monitoring 10,000 random conversations with only one about a sensitive topic still allowed attackers to identify targets with alarming precision, with many tested models delivering 100% precision for flagged conversations and 5–50% detection of all target conversations.

Microsoft shared its findings with OpenAI, Mistral, Microsoft, and xAI, which implemented mitigations, and OpenAI and later Microsoft Azure added an obfuscation field to streaming responses to mask token lengths and reduce attack effectiveness, with Mistral introducing a similar mitigation via a new “p” parameter. Users are urged to avoid sensitive topics on untrusted networks, use VPNs, choose providers with mitigations, consider non-streaming models and stay informed about security practices.