A local model can keep everything off the cloud and still leak its answers through the CPU cache.

so sensitive deployments should keep untrusted software off the same physical CPU core.

The leak comes from a routine step: turning each generated token into readable text.

That lookup leaves a repeatable pattern in the CPU cache, and another local process can learn those patterns well enough to reconstruct later responses without reading the model’s memory.

Across the tests, full-response attack success ranged from about 56% to 93% on text tasks.

In one code setting it reached 95.87%, and an end-to-end attack on OpenClaw still reached 30.12%.

The attack targets a normal part of local LLM inference rather than a special model design.

There is an important limit.

The attacker must already be on the same machine, share the relevant CPU resources, and profile the same long-lived LLM process.

So keeping your model off the cloud is not a complete privacy guarantee.

For sensitive agents, the paper points to stronger CPU isolation, shorter-lived processes, and disabling SMT where the security tradeoff justifies it.