ChatGPT side-channel attack has easy fix: Token obfuscation

Infosec in brief Almost as quickly as a paper came out last week revealing an AI side-channel vulnerability, Cloudflare researchers have figured out how to solve it: just obscure your token size. The paper [PDF], from researchers at the Offensive AI Institute at Israel's Ben Gurion University, found an issue with how all non-Google ChatGPT derivatives (including Microsoft Copilot) transmit chat sessions between LLM servers and users. When operating in streaming mode (a key component of this attack), ChatGPT and related AIs send tokens sequentially – meaning the response from the AI flows bit-by-bit to the user instead of all at once after the bot has decided how to answer. A malicious actor in the middle with the ability to intercept network traffic could sniff those LLM tokens. You may be thinking that those response tokens are encrypted, and you'd be right. Here's where the Ben Gurion researchers got crafty: they built their own specially trained LLMs designed to examine the packets and understand what they mean, with a decent degree of accuracy. "We were able to accurately reconstruct 29 percent of an AI assistant's responses and successfully infer the topic from 55 percent of them," the authors noted. Cloudflare, offers its own ChatGPT-based AIs in the form of products like Workers AI and AI Gateway, seems to have figured out how to address the issue with relative ease by padding its tokens. Cloudflare wrote that it was approached by the researchers through its bug bounty...