mlsanityData to 14 Oct 2026

SparSEEty: Extracting Tokens from Sparsity-Exploiting LLM Serving Systems via Deterministic Side Channels

arXiv 2608.02995 ↗First posted 4 Aug 2026cs.CR cs.AIcited by 0

On the map: Efficient LLM inference and serving → Early exit and edge inference

Abstract (arXiv)

Modern large language models (LLMs) exhibit activation sparsity, wherein only a subset of their neurons is activated for given input tokens. Researchers have leveraged this property to optimize LLM serving systems by omitting weight accesses and computations pertaining to inactive neurons. Unfortunately, however, such optimizations create input-dependent weight accesses, which can be leaked over side channels. We present SparSEEty, a new token extraction attack that exploits input-dependent neuron weight accesses introduced by sparsity-exploiting LLM serving systems. SparSEEty first constructs a neuron-activation oracle using neuron weight access side channels during LLM inference, and then inverts the activation traces to reconstruct the input tokens, forming an end-to-end token extraction attack. We instantiate SparSEEty against an LLM serving system protected inside an Intel TDX confidential virtual machine (CVM), addressing three key challenges: (i) constructing a neuron-activation oracle using a combination of side channels exposed by CVMs, (ii) reducing inference-time overheads of neuron activation monitoring for covertness, and (iii) accurately inverting partial binary activation traces back to tokens. Our evaluation shows that SparSEEty can reconstruct both prompt and response tokens with consistently high BLEU scores (>0.95) across various models and datasets, while incurring monitoring overheads of 3.7% to 7.2%.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Early exit and edge inference, one of 12 directions in Efficient LLM inference and serving. Builds on 60 of its 113 references that are in the map. First posted on arXiv 4 Aug 2026.

Builds on

60 of 113 references.

Closest ancestors · 1

Same direction, newest first

  1. 2024Training-Free Activation Sparsity in Large Language Models26 Aug

Other references · 59

  1. 2017Attention Is All You Needcited by 60,361
  2. 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,380
  3. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  4. 2022OPT: Open Pre-trained Transformer Language Modelscited by 3,512
  5. 2019Megatron-LM: Training Multi-Billion Parameter Language Models Using Model Parallelismcited by 1,868
  6. 2022Fast Inference from Transformers via Speculative Decodingcited by 1,653
  7. 2022Toy Models of Superpositioncited by 971
  8. 2024Gemma: Open Models Based on Gemini Research and Technologycited by 916
  9. 2023FlexGen: High-Throughput Generative Inference of Large Language Models with a Single GPUcited by 575
  10. 2023LaMP: When Large Language Models Meet Personalizationcited by 437
  11. 2014Understanding Deep Image Representations by Inverting Themcited by 403
  12. 2023MedAlpaca -- An Open-Source Collection of Medical Conversational AI Models and Training Datacited by 286
38 more
  1. 2023Deja Vu: Contextual Sparsity for Efficient LLMs at Inference Timecited by 252
  2. 2024InfiniGen: Efficient Generative Inference of Large Language Models with Dynamic KV Cache Managementcited by 245
  3. 2023PowerInfer: Fast Large Language Model Serving with a Consumer-grade GPUcited by 217
  4. 2024From Persona to Personalization: A Survey on Role-Playing Language Agentscited by 212
  5. 2019Neural Legal Judgment Prediction in Englishcited by 209
  6. 2023LLM in a flash: Efficient Large Language Model Inference with Limited Memorycited by 177
  7. 2021MoEfication: Transformer Feed-forward Layers are Mixtures of Expertscited by 152
  8. 2024PLeak: Prompt Leaking Attacks against Large Language Model Applicationscited by 127
  9. 2022The Lazy Neuron Phenomenon: On Emergence of Activation Sparsity in Transformerscited by 122
  10. 2024PowerInfer-2: Fast Large Language Model Inference on a Smartphonecited by 103
  11. 2023ReLU Strikes Back: Exploiting Activation Sparsity in Large Language Modelscited by 94
  12. 2024Democratizing Large Language Models via Personalized Parameter-Efficient Fine-tuningcited by 90
  13. 2023Effective Prompt Extraction from Language Modelscited by 85
  14. 2023Language Model Inversioncited by 68
  15. 2024ReLU2 Wins: Discovering Efficient Activation Functions for Sparse LLMscited by 67
  16. 2020DarkneTZ: Towards Model Privacy at the Edge using Trusted Execution Environmentscited by 58
  17. 2024LLMmap: Fingerprinting For Large Language Modelscited by 58
  18. 2025Steering Large Language Model Activations in Sparse Spacescited by 58
  19. 2018Cache Telepathy: Leveraging Shared Resource Attacks to Learn DNN Architecturescited by 57
  20. 2025Personalized Generation In Large Model Era: A Surveycited by 45
  21. 2024Extracting Prompts by Inverting LLM Outputscited by 41
  22. 2020Learning to Embed Categorical Features without Embedding Tables for Recommendationcited by 38
  23. 2024The Early Bird Catches the Leak: Unveiling Timing Side Channels in LLM Serving Systemscited by 29
  24. 2023PIT: Optimization of Dynamic Sparse Deep Learning Models via Permutation Invariant Transformationcited by 25
  25. 2020ShadowNet: A Secure and Efficient On-device Model Inference System for Convolutional Neural Networkscited by 21
  26. 2023No Privacy Left Outside: On the (In-)Security of TEE-Shielded DNN Partition for On-Device MLcited by 21
  27. 2025Shadow in the Cache: Unveiling and Mitigating Privacy Risks of KV-cache in LLM Inferencecited by 21
  28. 2025Depth Gives a False Sense of Privacy: LLM Internal States Inversioncited by 17
  29. 2023Exploiting Activation Sparsity with Dense to Dynamic-k Mixture-of-Experts Conversioncited by 16
  30. 2024InputSnatch: Stealing Input in LLM Services via Timing Side-Channel Attackscited by 16
  31. 2022Machine Learning with Confidential Computing: A Systematization of Knowledgecited by 15
  32. 2024A Law of Next-Token Prediction in Large Language Modelscited by 15
  33. 2025Prompt Inversion Attack against Collaborative Inference of Large Language Modelscited by 15
  34. 2024Buffer Overflow in Mixture of Expertscited by 13
  35. 2025MoEcho: Exploiting Side-Channel Attacks to Compromise User Privacy in Mixture-of-Experts LLMscited by 13
  36. 2024Stealing User Prompts from Mixture of Expertscited by 12
  37. 2024Efficient LLM Inference using Dynamic Input Pruning and Cache-Aware Maskingcited by 11
  38. 2015Flush+Flush: A Fast and Stealthy Cache Attackcited by 10

50 most cited of 59 All 59 (JSON)

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025WINA: Weight Informed Neuron Activation for Accelerating Large Language Model Inference
  2. 2025Accelerating LLM Inference with Flexible N:M Sparsity via A Fully Digital Compute-in-Memory Accelerator
  3. 2025SparAMX: Accelerating Compressed LLMs Token Generation on AMX-powered CPUs
  4. 2026BadEngram: Backdoor Attack on Gated Memory Components in LLMs
  5. 2026WiSparse: Boosting LLM Inference Efficiency with Weight-Aware Mixed Activation Sparsity
  6. 2025R-Sparse: Rank-Aware Activation Sparsity for Efficient LLM Inference
  7. 2024Jailbreak Instruction-Tuned LLMs via end-of-sentence MLP Re-weighting
  8. 2026Activation Surgery: Jailbreaking White-box LLMs without Touching the Prompt