On 7 November 2025, Microsoft's security researchers disclosed Whisper Leak, a side-channel attack that can infer the topic of a conversation with a cloud language model even though the traffic is encrypted with TLS. The attack does not break encryption. It observes the sizes and timing of the encrypted packets produced when a model streams its answer token by token, and uses a classifier to recognize topics from that pattern. Microsoft says it worked with several providers, including OpenAI, Mistral, xAI and its own Azure service, to deploy mitigations before publishing. For developers who stream LLM output, it is a reminder that metadata can leak what encryption hides.

Key Facts#

  • Published: 7 November 2025 on the Microsoft Security Blog by the Microsoft Defender Security Research Team, with a full technical report and open-source code.
  • Attack surface: Streaming responses from remote language models. An observer who can see encrypted traffic, such as someone at an internet service provider, on the same local network or on the same Wi-Fi, can attempt it.
  • Proof of concept: A classifier learned to distinguish questions about one sensitive topic, the legality of money laundering, from 11,716 unrelated questions drawn from the Quora Question Pairs dataset.
  • Results: For many tested models, the attack scored above 98% on the area under the precision-recall curve, a metric suited to imbalanced data.
  • Realistic scenario: Among 10,000 simulated conversations containing a single target conversation, many models allowed 100% precision while still catching 5% to 50% of target conversations.
  • Mitigations: OpenAI, Mistral, Microsoft and xAI had deployed protections at the time of publication. OpenAI and Azure add random-length padding to streamed responses.

What Happened#

Microsoft's researchers started from a simple observation. Language models generate text one token at a time, and most chat services stream output in small chunks so that users see text immediately. Modern TLS ciphers such as AES-GCM and ChaCha20 behave like stream ciphers, so the size of each encrypted record closely tracks the size of the plaintext it carries. The sequence of packet sizes and the gaps between packets therefore form a fingerprint of the response.

To test whether that fingerprint reveals the topic of the prompt, the team generated 100 variants of questions about its target topic, using 80 for training and validation and holding out 20 to test generalization. It captured the encrypted traffic of each service with tcpdump and trained three kinds of classifiers, a LightGBM model, a bidirectional LSTM and a DistilBERT-based model, using packet sizes, timings or both. The best combinations separated target conversations from background traffic with high reliability across many providers.

The researchers stress that their precision estimates are projections limited by the volume and variety of their data, and that real-world results depend on actual traffic patterns. They also warn that this is a starting point rather than a ceiling: in extended tests with one model, attack accuracy kept improving as more training data was collected, and an attacker could also combine signals across multiple turns or conversations.

Background#

Whisper Leak builds on several side-channel studies of language models published in 2024. They include a token-length attack that reconstructed responses from packet sizes, a timing attack against speculative decoding, a timing attack based on output token counts and an attack exploiting shared caches in LLM serving. What Whisper Leak adds is a practical demonstration that topic classification works across many commercial services, even when tokens are grouped into larger chunks.

Microsoft coordinated disclosure before publishing. It reports that OpenAI added an obfuscation field containing random text of variable length to its streaming responses, that Microsoft Azure mirrored the change, and that Mistral introduced a new parameter, p, with a similar effect. Microsoft says it directly verified that the Azure mitigation reduces attack effectiveness to a level it no longer considers a practical risk. The data collection code and models are available in an MIT-licensed GitHub repository that includes drivers for dozens of models from many providers.

Why It Matters for Developers#

Provider-side padding protects the hop between your server and the model API. It does not automatically protect the hop between your server and your users. If your ASP.NET Core application relays tokens to a browser as they arrive, through server-sent events or SignalR, you may be recreating the same fingerprint on the last mile. That is our inference from the research, not a finding Microsoft tested, but the mechanics are identical.

For features that handle sensitive subjects, such as health, legal or HR assistants, consider these measures:

  • Coalesce tokens into larger frames before sending them, so that individual token sizes and timings are not visible.
  • Add random padding to each frame, which is the approach the providers chose.
  • Offer a non-streaming mode. Microsoft lists non-streaming responses among the options for privacy-conscious users.
  • Keep prompts out of URLs and logs. Post the prompt in the request body rather than a query string.

Here is a sketch using IChatClient from Microsoft.Extensions.AI in a minimal API:

C#
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;
using Microsoft.Extensions.AI;

var builder = WebApplication.CreateBuilder(args);
// Register an IChatClient for your model provider here.
var app = builder.Build();

app.MapPost("/chat/stream", async (ChatRequest request, IChatClient chat,
    HttpResponse response, CancellationToken ct) =>
{
    response.ContentType = "text/event-stream";
    var pending = new StringBuilder();

    var updates = chat.GetStreamingResponseAsync(request.Prompt, cancellationToken: ct);
    await foreach (var update in updates)
    {
        pending.Append(update.Text);
        if (pending.Length < 64) continue; // coalesce tokens into larger frames

        await WriteFrameAsync(response, pending.ToString(), ct);
        pending.Clear();
    }

    if (pending.Length > 0) await WriteFrameAsync(response, pending.ToString(), ct);
});

app.Run();

static async Task WriteFrameAsync(HttpResponse response, string text, CancellationToken ct)
{
    // Random padding hides the exact size of each frame on the wire.
    var pad = new string('~', RandomNumberGenerator.GetInt32(0, 32));
    await response.WriteAsync($"data: {JsonSerializer.Serialize(new { text, pad })}\n\n", ct);
    await response.Body.FlushAsync(ct);
}

record ChatRequest(string Prompt);

Frame-level padding reduces, but does not eliminate, leakage from timing and total response length, so measure the trade-off against user experience. The SignalR guide covers real-time delivery options, and the Responsible AI and LLM security guide covers the wider set of LLM privacy and security controls.

What's Next#

Microsoft presents its results as a baseline risk that could grow as attackers collect more data and use richer models. Expect side-channel resistance to become a checklist item in AI security reviews, alongside prompt injection and data retention. That is an expectation, not an announced standard. For now, check whether each model provider you use has deployed padding, and treat your own streaming endpoints as part of the same threat model.

Sources#