A new attack reconstructs what a locally run LLM generates just by watching CPU cache timing during decoding.
Researchers built an attack that spies on CPU cache activity during detokenization, the step where a model's token IDs become readable text. They use Flush+Reload on shared tokenizer code to catch the exact moment decoding happens, then run Prime+Probe to capture cache patterns tied to specific tokens. A clustering-and-language-model pipeline turns those noisy cache traces back into semantically accurate text. The team tested the technique across multiple datasets, hardware platforms, inference frameworks, and model families, and demonstrated it working against OpenClaw, an agentic LLM framework.
The attack skips the usual crutches prior side-channel work needed, like shared data memory, CPU offloading, or Mixture-of-Experts routing. It targets the detokenizer itself, a component built into most default local inference pipelines, so this isn't a niche misconfiguration. It's the default path most local LLM setups already run.
The paper doesn't mention a patch or any vendor response. The technique still requires cache-level access to the same machine as the target process, since Flush+Reload and Prime+Probe are both co-residency attacks. But the tokenizer implementations named in the study are embedded in many popular local LLM products and agent frameworks, which is what makes the exposure broader than one demo app.