Versatile AI Risk Assessment

AI threat catalogue Attacks on the Running Model and Service Production

Side-Channel Attacks (Timing Analysis)

Attackers infer hidden information about the model, its prompts or its state from observable side effects of operation, such as response times or the timing of the output.

As of: October 2026 · Catalogue version 2026.10.24.2 · 6 mitigations · 6 verified sources

Description

Even without direct access, a running system gives away information through measurable side effects known as side channels. Attackers measure, for example, how long an answer takes (inference latency), the rhythm in which the output appears word by word (token streaming), or whether a computation returns strikingly fast from a cache (cache hit). From such timing patterns they can draw conclusions about the model's design, about parts of a hidden system prompt (the internal instructions given to the model), or about which data the system has processed. All they need is to observe externally visible timing signals; no break-in is required.

Possible impact

By way of timing measurement, model and configuration details, parts of confidential system prompts or hints about processed data can leak without any conventional intrusion. The insights gained reinforce reconnaissance and model theft. Because the timing signals are part of normal operation, such attacks are hard to prevent completely.

Example

A service streams its answers word by word. An attacker measures the tiny delays between the words and can infer whether a test input hit parts of the hidden system prompt that the operator meant to keep secret.

Recommended mitigations (6)

Compare effects and implementation levels. Expand each entry for the additional classification and rationale.

  • Constant-time inference where possible

    Technical
    Effect
    Preventive
    Implementation level
    Application, API & agents, Infrastructure
    Classification and rationale

    Primarily technical: Minimization, randomization, uniform processing, or query limits reduce information gained from repeated observations.

  • Timing noise injection

    Technical
    Effect
    Preventive
    Implementation level
    Application, API & agents, Infrastructure
    Classification and rationale

    Primarily technical: Minimization, randomization, uniform processing, or query limits reduce information gained from repeated observations.

  • Batch processing to mask individual timing

    Technical
    Effect
    Preventive
    Implementation level
    Application, API & agents, Infrastructure
    Classification and rationale

    Primarily technical: Minimization, randomization, uniform processing, or query limits reduce information gained from repeated observations.

  • Rate limiting to prevent timing correlation

    Technical
    Effect
    Preventive, Impact-limiting
    Implementation level
    Application, API & agents, Infrastructure
    Classification and rationale

    Complementary control typeOrganizational & process-based

    Primarily technical: Minimization, randomization, uniform processing, or query limits reduce information gained from repeated observations; complemented by binding workflows.

  • Network-level timing protection (padding, delay)

    Technical
    Effect
    Preventive, Impact-limiting
    Implementation level
    Application, API & agents, Infrastructure
    Classification and rationale

    Primarily technical: Minimization, randomization, uniform processing, or query limits reduce information gained from repeated observations.

  • Side-channel-aware system design

    Technical
    Effect
    Preventive
    Implementation level
    Application, API & agents, Infrastructure
    Classification and rationale

    Primarily technical: Safe formats, restrictive defaults, or protective layers reduce unsafe execution paths and exploitable attack surface.

Framework mappings

Verified locations in OWASP, NIST AI RMF, MITRE ATLAS, the EU AI Act and further frameworks. The mappings are taxonomic, not evidence of compliance.

OWASP LLM Top 10 LLM02:2026NIST AI RMF MEASURE 2.7 · NISTAML.031MITRE ATLAS AML.T0040EU AI Act Article 55(1)(d) · Article 9(1), 9(2)(a), 9(2)(d)

Verified references (6)

Every reference states the framework, the exact location and the publishing organisation.

EU AI Act obligations related to this threat

The obligations from the obligations compass whose articles the catalogue maps to this threat. Each leads to its entry with core, action step and evidence; whether it applies to you depends on role and risk class.

  • Establish and operate a risk management system Art. 9 · applies from Annex III: 2 December 2027 · Annex I: 2 August 2028

    Statutory roles: Provider, Product manufacturer. Classes: High-risk under Annex III, High-risk as a product or safety component.

    This reference is a review prompt. A threat match alone does not establish applicability.

  • Evaluate and mitigate systemic risks Art. 55 · applies from 2 August 2025

    Statutory roles: Provider of a general-purpose AI model. Classes: Model with systemic risk.

    This reference is a review prompt. A threat match alone does not establish applicability.

All 62 obligations by role, risk class and deadline in the obligations compass

Terms on this page

Glossary terms that occur in this entry. Every link leads to the full explanation.

  • System prompt The fixed base instruction that sets a model’s role and limits.

More entries from the topic group Attacks on the Running Model and Service.

Model Theft Attackers create a working copy of a proprietary AI model, either by querying it at scale or by breaking into the infrastructure. Adversarial Inputs Attackers alter an input in a way that is minimal and imperceptible to humans, so that the AI model classifies it incorrectly. Model Denial of Service Attackers overload the AI model with especially expensive requests until the service slows down or fails.

Matching use cases

This list shows where to review this threat, rather than how high the risk is.

For 47 further use cases, relevance depends on the system design, for example whether it shares computing resources with other customers or applications or accepts queries directly through an interface. Show these use cases

Frequently asked questions

What is Side-Channel Attacks (Timing Analysis)?
Attackers infer hidden information about the model, its prompts or its state from observable side effects of operation, such as response times or the timing of the output.
Which mitigations help against Side-Channel Attacks (Timing Analysis)?
The catalogue lists 6 mitigations, each with control type, effect and implementation level. First among them are Constant-time inference where possible, Timing noise injection and Batch processing to mask individual timing.
Which EU AI Act obligations does Side-Channel Attacks (Timing Analysis) touch?
The catalogue maps this threat to Art. 9 and Art. 55 of the EU AI Act. In the obligations compass this leads to: Establish and operate a risk management system and Evaluate and mitigate systemic risks. Whether an obligation applies depends on role, risk class and deadline.

Assess this threat in your own system

The live demo contains all 52 threats of this catalogue, including the EU AI Act and GDPR assessment. The free single modules cover AI risk, the EU AI Act and GDPR. No sign-up; the assessment runs locally in your browser.

Start the live demo See the free modules

Cite this entry

For reports, policies or internal documents; the link leads directly to this entry.

“Side-Channel Attacks (Timing Analysis)”. Versatile AI Risk Assessment, AI threat catalogue, as of October 2026.
https://www.versatile-ai-risk-assessment.com/en/wissensbasis/threats/side-channel-attacks/

← Back to the full catalogue