mlsanityData to 14 Oct 2026

SparLeak: Privacy Leakage from Sparse Attention in LLM Inference on Shared GPUs

arXiv 2609.38830 ↗First posted 30 Sep 2026cs.LG cs.CRcited by 0

On the map: Efficient LLM inference and serving → KV cache optimization

Abstract (arXiv)

Sparse attention is widely used to accelerate long-context inference in modern large language models (LLMs), but its input-dependent execution behavior introduces previously unexplored privacy risks. We identify a new GPU micro-architectural side channel, termed Sparsity-Induced Memory Access (SIMA), which arises from secret-dependent key-value cache access patterns induced by sparse attention. Based on this observation, we present SparLeak, a phase-aware side-channel attack that extracts SIMA traces during LLM inference and enables two practical privacy extractions: query attribute inference from prefill-phase traces and autoregressive response reconstruction from decoding-phase traces. By reconstructing approximate token-level sparsity profiles from page-level observations and applying profiling-based learning, SparLeak accurately recovers sensitive information, including user-query attributes and private LLM response content. Extensive evaluation across three LLM architectures, three sparse attention mechanisms, and three privacy-sensitive datasets shows that SparLeak achieves average attack success rates of 90.9% for attribute inference and 87.3% for response reconstruction under real-world LLM serving settings, highlighting the significance to account for SIMA leakage when deploying sparse-attention-based LLM systems. We provide anonymized SIMA traces, trained attack models, evaluation scripts, and documentation as artifacts at https://anonymous.4open.science/r/Janus_artifacts/.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in KV cache optimization, one of 12 directions in Efficient LLM inference and serving. Builds on 30 of its 53 references that are in the map. First posted on arXiv 30 Sep 2026.

Builds on

30 of 53 references.

Closest ancestors · 6

Same direction, newest first

  1. 2025Shadow in the Cache: Unveiling and Mitigating Privacy Risks of KV-cache in LLM Inference13 Aug
  2. 2025Selective KV-Cache Sharing to Mitigate Timing Side-Channels in LLM Inference11 Aug
  3. 2024DuoAttention: Efficient Long-Context LLM Inference with Retrieval and Streaming Heads14 Oct
  4. 2024InfiniGen: Efficient Generative Inference of Large Language Models with Dynamic KV Cache Management28 Jun
  5. 2024Quest: Query-Aware Sparsity for Efficient Long-Context LLM Inference16 Jun
  6. 2023Efficient Memory Management for Large Language Model Serving with PagedAttention12 Sep

Other references · 24

  1. 2017Attention Is All You Needcited by 60,361
  2. 2024The Llama 3 Herd of Modelscited by 14,715
  3. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,132
  4. 2022FlashAttention: Fast and Memory-Efficient Exact Attention with IO-Awarenesscited by 3,673
  5. 2024DistServe: Disaggregating Prefill and Decoding for Goodput-optimized Large Language Model Servingcited by 617
  6. 2025XAttention: Block Sparse Attention with Antidiagonal Scoringcited by 137
  7. 2024PLeak: Prompt Leaking Attacks against Large Language Model Applicationscited by 127
  8. 2024SeerAttention: Learning Intrinsic Sparse Attention in Your LLMscited by 124
  9. 2024Blind Baselines Beat Membership Inference Attacks for Foundation Modelscited by 69
  10. 2020Differentially Private Representation for NLP: Formal Guarantee and An Empirical Study on Privacy and Fairnesscited by 67
  11. 2024SampleAttention: Near-Lossless Acceleration of Long Context LLM Inference with Adaptive Structured Sparse Attentioncited by 39
  12. 2024What Was Your Prompt? A Remote Keylogging Attack on AI Assistantscited by 26
12 more
  1. 2024PreCurious: How Innocent Pre-Trained Language Models Turn into Privacy Trapscited by 23
  2. 2024Generated Data with Fake Privacy: Hidden Dangers of Fine-tuning Large Language Models on Generated Datacited by 22
  3. 2025Prompt Inference Attack on Distributed Large Language Model Inference Frameworkscited by 14
  4. 2024Evaluating LLM-based Personal Information Extraction and Countermeasurescited by 12
  5. 2024PRSA: Prompt Stealing Attacks against Real-World Prompt Servicescited by 10
  6. 2024Time Will Tell: Timing Side Channels via Output Token Count in Large Language Modelscited by 7
  7. 2025SpeContext: Enabling Efficient Long-context Reasoning with Speculative Context Sparsity in LLMscited by 6
  8. 2025You Can't Steal Nothing: Mitigating Prompt Leakages in LLMs via System Vectorscited by 4
  9. 2025Leaner Training, Lower Leakage: Revisiting Memorization in LLM Fine-Tuning with LoRAcited by 3
  10. 2025NetEcho: From Real-World Streaming Side-Channels to Full LLM Conversation Recoverycited by 3
  11. 2019Pacer: Comprehensive Network Side-Channel Mitigation in the Cloudcited by 2
  12. 2024GPUVM: GPU-driven Unified Virtual Memorycited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Privacy-Aware Split Inference with Speculative Decoding for Large Language Models over Wide-Area Networks
  2. 2026SpliTEE: Fast and Private LLM Inference by Coupling GPU-Assisted Trusted Execution Environments with Differential Privacy
  3. 2025ShadowNPU: System and Algorithm Co-design for NPU-Centric On-Device LLM Inference
  4. 2025Towards Confidential and Efficient LLM Inference with Dual Privacy Protection
  5. 2026Unifying Sparse Attention with Hierarchical Memory for Scalable Long-Context LLM Serving
  6. 2025Comet: Accelerating Private Inference for Large Language Model by Predicting Activation Sparsity
  7. 2025SOFT: Selective Data Obfuscation for Protecting LLM Fine-tuning against Membership Inference Attacks
  8. 2025Breaking the Boundaries of Long-Context LLM Inference: Adaptive KV Management on a Single Commodity GPU