I’ve spent the last few days around the idea of generation and processing time in LLMs. It started with my thinking about how easy it is to distinguish whether a prompt injection attack worked or not – purely based on the time it takes for the LLM to respond!

Anyway, this idea completely sucked me in, and I haven’t slept well in a couple of days trying to untangle my thoughts.

Finally, I’ve shared a rough analysis of them here.

tl;dr: I’ve researched three attack vectors I thought of:

1. SLM (Slow Language Model) – I show that an attacker could create a large automation of checking prompt injection success against LLMs by simply creating a baseline of the time it takes to get rejection messages (“Sorry, I can’t help with that”), and then send payloads and wait for one of them to exit the baseline.
2. FKTA (Forbidden Knowledge Timing Attack) – I show that an LLM would take different amount of time to conceal known information versus revealing it. My finding is that concealing information is about 60% faster than revealing it! Meaning, one could create a baseline of time to reveal information, then probe for actual intelligence and extract information based on time to answer.
3. LOT (Latency of Thought) – I show that an LLM shows only a small difference in process time when processing different types of questions under different conditions. I specifically wanted to measure processing time, so I asked the model to respond with ‘OK’, regardless of what it wanted to answer. When checked for differences in truthy, falsy, short answers, and long answers, it appears that no drastic timing difference exists.

Anyway, this whole thing has been done between my work time and my study time for my degree, in just a few hours. I invite you to test these ideas yourself, and I’d be happy to be disproven.

Note I: These are not inherent vulns, so I figured that no responsible disclosure was necessary. Regardless, LLMs are used everywhere and by everyone, and I figured that it’s best for the knowledge and awareness of these attacks be out there for all.

Note II: Yes, the Medium post was heavily “inspired by” an LLMs suggestions. It’s 2 am and I’m tired. Also, will publish the FKTA post tomorrow, reached max publication today.