SOURCE-LINKED INTELLIGENCE

Detokenization Leaks: Reconstructing Local LLM Outputs From Cache Traces

arXiv · AI, language, vision and robotics · article · Sep 6, 2026 · UTC

We present a new attack that reconstructs the text generated by locally hosted LLMs by observing CPU cache activity during detokenization. Unlike prior attacks that rely on deployment-specific assumptions, such as shared data memory, CPU offloading, or Mixture-of-Experts architectures, our approach targets the detokenizer, a component used in default LLM inference pipelines. To obtain clean signals, we use Flush+Reload on shared tokenizer code to detect when decoding occurs, which lets us perform Prime+Probe at the right moment and isolate token-dependent cache activity. We then apply a cluste

Read original source ↗ Open in workspace

recordType

paper

region

Global