Microsoft Discloses Whisper Leak Side-Channel Attack on AI Chat Services
Microsoft security researchers disclosed Whisper Leak, a side-channel attack that infers the topics of encrypted AI chat conversations by analyzing network traffic metadata such as packet size and timing patterns. The vulnerability potentially affects users discussing sensitive topics, though AI vendors have begun deploying mitigation strategies following responsible disclosure.
What happened
Microsoft's security research team disclosed a high-risk privacy vulnerability called 'Whisper Leak', a side-channel attack targeting modern AI chat services.
Unlike traditional attacks requiring decryption, Whisper Leak analyzes metadata in encrypted network traffic—including packet size, timing, and sequence patterns—to infer user conversation topics. The attack exploits the token-by-token streaming transmission method used by AI services to improve user experience, which leaves identifiable communication 'fingerprints' at the network layer.
Researchers validated the attack by training machine learning models on encrypted data traces collected during AI responses, discovering systematic metadata pattern differences across conversation topics. For example, responses about sensitive topics like 'money laundering' showed distinct differences in packet size and transmission pace compared to ordinary conversations.
Reported impact
The vulnerability exposes AI chat services to systematic threats. Internet service providers and attackers on public Wi-Fi can observe user traffic and identify sensitive conversations.
Journalists, civil society activists, and users seeking legal or medical assistance face particular risk—even if conversation content is encrypted, the discussion topics may be exposed, potentially leading to censorship or personal threats.
Index analysis
In laboratory conditions, classifiers identifying specific sensitive topics achieved over 98% accuracy, demonstrating potential for high-precision, large-scale topic monitoring in real-world scenarios.
After Microsoft notified the industry following responsible disclosure principles, multiple mainstream AI vendors began deploying mitigation strategies including random padding, token batch transmission, and virtual traffic insertion to obscure metadata patterns. These defenses incur costs in increased response latency and bandwidth overhead.
Governance controls
Microsoft followed responsible disclosure practices by notifying the industry before public announcement, allowing multiple AI vendors time to develop and deploy mitigation strategies.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.