Overview
This series explains how PromptEcho infers partial meaning from encrypted LLM API streams without decrypting them. It traces the chain from TLS record lengths and token aggregation through service calibration, segmentation, symbolic constraints, and language-guided reconstruction, then tests the evidence across models, response structures, and thresholds. The studies indicate strongest exposure in early, regular natural-language segments; longer, unusual, or changed traffic weakens it. Defenses trade leakage reduction against bandwidth, latency, and interactivity.
Learning outcomes
- TLS hides record contents and detects tampering, but it does not automatically hide record lengths or delivery structure.
- PromptEcho can turn service-calibrated merged lengths into partial semantic hypotheses without decrypting the victim’s traffic.
- In the evaluated GPT-4o and DeepSeek-V3 setting, early natural-language segments exposed more semantic signal than full responses; the result is not universal.
- Padding, randomized obfuscation, and coarser aggregation can weaken leakage, but they trade privacy against bandwidth, latency, or interactivity.
Keywords
Preview every chapter · Unlock full text, audio, and video from chapter 4
PlansFAQ
Does TLS prevent PromptEcho from learning what an LLM response is about?
No. TLS hides the response bytes, but record size and delivery structure can remain correlated with content when the service’s streaming behavior is stable enough to model.
How does PromptEcho infer meaning from encrypted LLM traffic?
PromptEcho estimates content-dependent merged lengths, represents their hidden token boundaries, and ranks language candidates that satisfy the constraints and fit the context.
When is PromptEcho most effective?
It is strongest under the evaluated service-specific calibration conditions, especially for early, regular natural-language segments with concentrated topic or intent.
How can an LLM API reduce length-based leakage?
An API can add fixed or randomized padding, vary aggregation, or batch more output before sending it; each option can cost bandwidth, latency, responsiveness, or calibration stability.