arXiv cs.AI· Shahrooz Pouryousef, Jesus Lopez, Saeefa Rubaiyet Nowmi, Md Mahmuduzzaman Kamol, Moinul Hossain, Muoi Tran, Mohammad Saidur Rahman·· 14 小时前AI 评分42
首个加密 LLM 流量分析攻击大规模基准：模型指纹识别准确率达 97.7%
A Large-Scale Benchmark and Risk Assessment of Traffic Analysis Attacks on Cloud LLM Services
AI 导读
研究者构建了首个覆盖用户—LLM 与多智能体执行的加密 LLM 流量统一测量基准与公开数据集，含 10 个模型的 60,000 次用户交互和 2,838 次多智能体执行。仅凭加密数据包元数据，模型指纹识别达到 97.7% 平衡准确率，提示词类别识别平均准确率 76.7%，多智能体任务指纹识别最高 90.7%。提示词改写会削弱但无法消除模型泄漏，任务指纹即使只观察单个智能体的流量仍可被检测。
正文 · 原文
Abstract:Cloud-based Large language model (LLM) services create a network-level traffic side channel that can expose model, prompt, and task behavior despite encryption. From packet sizes, directions, timing, and burst structure alone, a passive local observer can infer the serving model, the user's prompt category, and the task executed by a collaborative multi-agent system. Yet current evidence is fragmented across separate datasets and settings, limiting reproducibility and comparison. We present, to our knowledge, the first unified measurement study and public benchmark of encrypted LLM traffic across both user--LLM and multi-agent executions. The large-scale benchmark contains 60,000 user--LLM interactions across 10 models and 6 prompt categories, plus 2,838 multi-agent executions covering 10 task categories and two coordination topologies. Using only encrypted packet metadata, we assess the risk of traffic analysis attack by characterizing traffic signatures, identifying the features most associated with leakage, and testing robustness under prompt reformulation, decoding-temperature changes, larger candidate model sets, and partial traffic observation. Model fingerprinting achieves 97.7\% balanced accuracy, prompt-category fingerprinting reaches 76.7\% mean accuracy, and multi-agent task fingerprinting achieves up to 90.7\% accuracy. Prompt reformulation weakens but does not remove model-specific leakage, and task fingerprints remain detectable even from a single agent's traffic.
| Comments: | 11 pages, 9 figures, and 4 tables |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Machine Learning (cs.LG) |
| Cite as: | arXiv:2609.31877 [cs.CR] |
| (or arXiv:2609.31877v2 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2609.31877 arXiv-issued DOI via DataCite |
Submission history
From: Mohammad Saidur Rahman [view email]
[v1]
Fri, 25 Sep 2026 18:13:58 UTC (3,403 KB)
[v2]
Sat, 24 Oct 2026 05:04:44 UTC (3,403 KB)
来源：arXiv cs.AI · arxiv.org