AI threat catalogueAttacks on the Running Model and ServiceProduction
Side-Channel Attacks (Timing Analysis)
Attackers infer hidden information about the model, its prompts or its state from observable side effects of operation, such as response times or the timing of the output.
Description
Even without direct access, a running system gives away information through measurable side effects known as side channels. Attackers measure, for example, how long an answer takes (inference latency), the rhythm in which the output appears word by word (token streaming), or whether a computation returns strikingly fast from a cache (cache hit). From such timing patterns they can draw conclusions about the model's design, about parts of a hidden system prompt (the internal instructions given to the model), or about which data the system has processed. All they need is to observe externally visible timing signals; no break-in is required.
Possible impact
By way of timing measurement, model and configuration details, parts of confidential system prompts or hints about processed data can leak without any conventional intrusion. The insights gained reinforce reconnaissance and model theft. Because the timing signals are part of normal operation, such attacks are hard to prevent completely.
Example
A service streams its answers word by word. An attacker measures the tiny delays between the words and can infer whether a test input hit parts of the hidden system prompt that the operator meant to keep secret.
Recommended mitigations (6)
Every mitigation states its control type, effect, implementation level and the reason for the classification.
Constant-time inference where possibleTechnical
- Effect
- Preventive
- Implementation level
- Application, API & agents, Infrastructure
- Reason for the classification
- “Constant-time inference where possible” is primarily technical: Minimization, randomization, uniform processing, or query limits reduce information gained from repeated observations.
Timing noise injectionTechnical
- Effect
- Preventive
- Implementation level
- Application, API & agents, Infrastructure
- Reason for the classification
- “Timing noise injection” is primarily technical: Minimization, randomization, uniform processing, or query limits reduce information gained from repeated observations.
Batch processing to mask individual timingTechnical
- Effect
- Preventive
- Implementation level
- Application, API & agents, Infrastructure
- Reason for the classification
- “Batch processing to mask individual timing” is primarily technical: Minimization, randomization, uniform processing, or query limits reduce information gained from repeated observations.
Rate limiting to prevent timing correlationTechnical
- Effect
- Preventive, Impact-limiting
- Implementation level
- Application, API & agents, Infrastructure
- Complementary control type
- Organizational & process-based
- Reason for the classification
- “Rate limiting to prevent timing correlation” is primarily technical: Minimization, randomization, uniform processing, or query limits reduce information gained from repeated observations; complemented by binding workflows.
Network-level timing protection (padding, delay)Technical
- Effect
- Preventive, Impact-limiting
- Implementation level
- Application, API & agents, Infrastructure
- Reason for the classification
- “Network-level timing protection (padding, delay)” is primarily technical: Minimization, randomization, uniform processing, or query limits reduce information gained from repeated observations.
Side-channel-aware system designTechnical
- Effect
- Preventive
- Implementation level
- Application, API & agents, Infrastructure
- Reason for the classification
- “Side-channel-aware system design” is primarily technical: Safe formats, restrictive defaults, or protective layers reduce unsafe execution paths and exploitable attack surface.
Framework mappings
Verified locations in OWASP, NIST AI RMF, MITRE ATLAS, the EU AI Act and further frameworks. The mappings are taxonomic, not evidence of compliance.
Verified references (7)
Every reference states the framework, the exact location and the publishing organisation.
- OWASP LLM Top 10 LLM02:2025 Sensitive Information DisclosureLLM02:2025 Sensitive Information Disclosure, official category page OWASP FoundationOriginal
- OWASP LLM Top 10 LLM10:2025 Unbounded ConsumptionLLM10:2025 Unbounded Consumption, official category page OWASP FoundationOriginal
- NIST AI RMF MEASURE 2.7 MEASURE 2.7MEASURE 2.7, p. 30 National Institute of Standards and Technology (NIST)Original
- NIST AI RMF NISTAML.031 Model ExtractionTaxonomy Index, p. x; Section 2.4.4, pp. 31–32; Section 3.3.2, p. 47 National Institute of Standards and Technology (NIST)Original
- MITRE ATLAS AML.T0040 AI Model Inference API AccessATLAS.yaml technique object with id AML.T0040 (pinned release v5.6.0) MITREOriginal
- EU AI Act Article 55(1)(d) Obligations of providers of general-purpose AI models with systemic riskArticle 55(1)(d) European Union (EUR-Lex)Original
- EU AI Act Article 9(1), 9(2)(a), 9(2)(d) Risk management systemArticle 9(1), 9(2)(a), 9(2)(d), read with Article 9(3) European Union (EUR-Lex)Original
Terms on this page
Glossary terms that occur in this entry. Every link leads to the full explanation.
- System prompt The fixed base instruction that sets a model’s role and limits.
Related threats
More entries from the topic group Attacks on the Running Model and Service.
Assess this threat in your own system
The live demo contains all 52 threats of this catalogue, including the EU AI Act and GDPR assessment. The free single modules cover AI risk, the EU AI Act and GDPR. No sign-up; the assessment runs locally in your browser.
Cite this entry
For reports, policies or internal documents; the link leads directly to this entry.
“Side-Channel Attacks (Timing Analysis)”. Versatile AI Risk Assessment, AI threat catalogue, as of July 2026. https://www.versatile-ai-risk-assessment.com/en/wissensbasis/threats/side-channel-attacks/