Microsoft Threat Intelligence Podcast Whisper Leak: How Threat Actors Can See What You Talk to AI About
6 snips
Dec 17, 2025 Jeff McDonald, a Microsoft security research lead specializing in ML model protections, and Jonathan Barr Orr, a hacker and vulnerability researcher, discuss Whisper Leak. They explain how token-by-token streaming and packet size/timing patterns can reveal topics in encrypted AI traffic. The conversation covers which models show signals, real-world adversaries, and developer mitigation approaches.
AI Snips
Chapters
Transcript
Episode notes
Encryption Isn't All You Think
- WhisperLeak shows encrypted AI traffic can leak topic signals via packet size and timing patterns.
- Side-channel leaks persist despite TLS because metadata like sizes/timings reveal structure.
Token Streaming Creates Patterns
- Tokens vary in length (1–7 chars) and LLM streaming sends those tokens incrementally.
- That per-token streaming maps to observable packet-size patterns attackers can exploit.
Obfuscation Alone Isn't Sufficient
- Prior work reconstructed outputs from token-length sequences, but that defense is incomplete.
- Obfuscating individual token lengths doesn't fully prevent topic inference attacks.