{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,28]],"date-time":"2026-07-28T04:12:13Z","timestamp":1785211933212,"version":"3.55.0"},"reference-count":61,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62272452"],"award-info":[{"award-number":["62272452"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Strategic Priority Research Program of Chinese Academy of Sciences","award":["XDB0690100"],"award-info":[{"award-number":["XDB0690100"]}]},{"DOI":"10.13039\/501100001809","name":"Research Grant from Huawei","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/tifs.2025.3622954","type":"journal-article","created":{"date-parts":[[2025,10,17]],"date-time":"2025-10-17T17:39:39Z","timestamp":1760722779000},"page":"11431-11446","source":"Crossref","is-referenced-by-count":4,"title":["The Early Bird Catches the Leak: Unveiling Timing Side Channels in LLM Serving Systems"],"prefix":"10.1109","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0009-0009-3703-4187","authenticated-orcid":false,"given":"Linke","family":"Song","sequence":"first","affiliation":[{"name":"State Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zixuan","family":"Pang","sequence":"additional","affiliation":[{"name":"University of Science and Technology of China, Hefei, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7294-2724","authenticated-orcid":false,"given":"Wenhao","family":"Wang","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-7620-4142","authenticated-orcid":false,"given":"Zihao","family":"Wang","sequence":"additional","affiliation":[{"name":"Nanyang Technological University, Singapore, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"XiaoFeng","family":"Wang","sequence":"additional","affiliation":[{"name":"Nanyang Technological University, Singapore, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hongbo","family":"Chen","sequence":"additional","affiliation":[{"name":"Indiana University Bloomington, Bloomington, IN, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5649-1580","authenticated-orcid":false,"given":"Wei","family":"Song","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8791-0597","authenticated-orcid":false,"given":"Yier","family":"Jin","sequence":"additional","affiliation":[{"name":"University of Science and Technology of China, Hefei, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dan","family":"Meng","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9215-7632","authenticated-orcid":false,"given":"Rui","family":"Hou","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","volume-title":"Chatgpt | OpenAI","year":"2024"},{"key":"ref2","volume-title":"Perplexity AI","year":"2024"},{"key":"ref3","volume-title":"Github Copilot \u00b7 Your AI Pair Programmer","year":"2024"},{"key":"ref4","first-page":"27168","article-title":"ZeroQuant: Efficient and affordable post-training quantization for large-scale transformers","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Yao"},{"key":"ref5","first-page":"17402","article-title":"Outlier suppression: Pushing the limit of low-bit transformer language models","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Wei"},{"key":"ref6","first-page":"38087","article-title":"SmoothQuant: Accurate and efficient post-training quantization for large language models","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Xiao"},{"key":"ref7","article-title":"Model compression and efficient inference for large language models: A survey","author":"Wang","year":"2024","journal-title":"arXiv:2402.09748"},{"key":"ref8","first-page":"16344","article-title":"FlashAttention: Fast and memory-efficient exact attention with IO-awareness","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Dao"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/3600006.3613165"},{"key":"ref10","article-title":"SGLang: Efficient execution of structured language model programs","author":"Zheng","year":"2023","journal-title":"arXiv:2312.07104v2"},{"key":"ref11","volume-title":"Prompt Template","year":"2024"},{"key":"ref12","volume-title":"Prompt Caching With Claude","year":"2024"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.nlposs-1.24"},{"key":"ref14","volume-title":"Langchain","year":"2024"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2025.241772"},{"key":"ref16","article-title":"InputSnatch: Stealing input in LLM services via timing side-channel attacks","author":"Zheng","year":"2024","journal-title":"arXiv:2411.18191"},{"key":"ref17","article-title":"Auditing prompt caching in language model APIs","volume-title":"arXiv:2502.07776","author":"Gu","year":"2025"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.03762"},{"key":"ref19","volume-title":"AnythingLLM: The All-in-One Desktop & Docker AI Application With Built-in Rag, AI Agents, and More","year":"2024"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00082"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-29959-0_14"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243831"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1515\/popets-2017-0016"},{"key":"ref24","first-page":"6275","article-title":"Hot pixels: Frequency, power, and temperature attacks on GPUs and ARM SoCs","volume-title":"Proc. 32nd USENIX Secur. Symp. (USENIX Secur.)","author":"Taneja"},{"key":"ref25","volume-title":"Samsung Bans Staff\u2019s AI Use After Spotting ChatGPT Data Leak","year":"2025"},{"key":"ref26","volume-title":"System Prompts in Large Language Models","year":"2024"},{"key":"ref27","volume-title":"Llamaindex is a Data Framework for Your LLM Applications","year":"2024"},{"key":"ref28","volume-title":"Jpmorgan Rolls Out In-House GenAI-Based Chatbot To Employees","year":"2024"},{"key":"ref29","volume-title":"Text Generation and Prompting","year":"2024"},{"key":"ref30","article-title":"Judging LLM-as-a-judge with MT-bench and chatbot arena","volume-title":"arXiv:2306.05685","author":"Zheng","year":"2023"},{"key":"ref31","article-title":"BloombergGPT: A large language model for finance","author":"Wu","year":"2023","journal-title":"arXiv:2303.17564"},{"key":"ref32","volume-title":"System Prompt Leakage Dataset","year":"2024"},{"key":"ref33","article-title":"UMAP: Uniform manifold approximation and projection for dimension reduction","author":"McInnes","year":"2018","journal-title":"arXiv:1802.03426"},{"key":"ref34","volume-title":"Flush Cache","year":"2024"},{"key":"ref35","volume-title":"LLM Side-Channel Demo","year":"2025"},{"key":"ref36","volume-title":"Medquad","year":"2019"},{"key":"ref37","volume-title":"All-MPNET-Base-V2","year":"2024"},{"key":"ref38","volume-title":"AI Document Summarization","year":"2024"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-emnlp.536"},{"key":"ref40","article-title":"CacheBlend: Fast large language model serving for RAG with cached knowledge fusion","author":"Yao","year":"2024","journal-title":"arXiv:2405.16444"},{"key":"ref41","volume-title":"Lmcache: Supercharge Your LLM With the Fastest KV Cache Layer","year":"2025"},{"key":"ref42","article-title":"KVShare: An LLM service system with efficient and effective multi-tenant KV cache reuse","author":"Yang","year":"2025","journal-title":"arXiv:2503.16525"},{"key":"ref43","article-title":"SemShareKV: Efficient KVCache sharing for semantically similar prompts via token-level LSH matching","volume-title":"arXiv:2509.24832","author":"Zhao","year":"2025"},{"key":"ref44","volume-title":"Presidio","year":"2022"},{"key":"ref45","article-title":"Ignore previous prompt: Attack techniques for language models","author":"Perez","year":"2022","journal-title":"arXiv:2211.09527"},{"key":"ref46","article-title":"Prompts should not be seen as secrets: Systematically measuring prompt extraction attack success","author":"Zhang","year":"2023","journal-title":"arXiv:2307.06865"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3670370"},{"key":"ref48","first-page":"6831","article-title":"Privacy side channels in machine learning systems","volume-title":"Proc. 33rd USENIX Secur. Symp.","author":"Debenedetti"},{"key":"ref49","article-title":"What was your prompt? A remote keylogging attack on AI assistants","author":"Weiss","year":"2024","journal-title":"arXiv:2403.09751"},{"key":"ref50","article-title":"Remote timing attacks on efficient language model inference","author":"Carlini","year":"2024","journal-title":"arXiv:2410.17175"},{"key":"ref51","article-title":"Wiretapping LLMs: Network side-channel attacks on interactive LLM services","author":"Soleimani","year":"2025"},{"key":"ref52","article-title":"Stealing neural networks via timing side channels","author":"Duddu","year":"2018","journal-title":"arXiv:1812.11720"},{"key":"ref53","first-page":"2003","article-title":"Cache telepathy: Leveraging shared resource attacks to learn DNN architectures","volume-title":"Proc. 29th USENIX Secur. Symp. (USENIX Secur.)","author":"Yan"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833743"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/DAC18072.2020.9218707"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/JETCAS.2024.3485133"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/DSN48063.2020.00031"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3106169"},{"key":"ref59","first-page":"4383","article-title":"Can one hear the shape of a neural network?: Snooping the GPU via magnetic side channel","volume-title":"Proc. USENIX Secur. Symp.","author":"Maia"},{"key":"ref60","article-title":"Barracuda: Bringing electromagnetic side channel into play to steal the weights of neural networks from NVIDIA GPUS","author":"Horvath","year":"2023","journal-title":"arXiv:2312.07783"},{"key":"ref61","first-page":"1973","article-title":"Hermes attack: Steal DNN models with lossless inference accuracy","volume-title":"Proc. 30th USENIX Secur. Symp. (USENIX Secur.)","author":"Zhu"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/10810755\/11206380.pdf?arnumber=11206380","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,31]],"date-time":"2025-10-31T17:11:11Z","timestamp":1761930671000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11206380\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":61,"URL":"https:\/\/doi.org\/10.1109\/tifs.2025.3622954","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]}}}