Wild paper from Microsoft and colleagues.
They show a new attack that reconstructs the text a local LLM generates by watching CPU cache activity while it detokenizes.
Earlier cache attacks needed something unusual in the deployment, such as shared data memory, CPU offloading, or a Mixture-of-Experts architecture. This work targets the detokenizer, which runs in default inference pipelines.
The method has two stages.
- Flush+Reload on shared tokenizer code detects when decoding happens, which lets the attacker fire Prime+Probe at the right moment and isolate token-dependent cache activity.
- A clustering and language-model pipeline then recovers readable text from the noisy observations.
They evaluate across datasets, hardware platforms, inference frameworks and model families, including real local deployments and agentic systems.
The widely used tokenizer implementations are susceptible, and they are embedded in many popular local LLM products and agent frameworks. OpenClaw is demonstrated directly.