When Encryption Still Has a Shape
The subject is PromptEcho, a passive attack against the way modern LLM services stream responses, and the specific question is what a network observer can learn from encrypted response traffic without decrypting it. The answer matters because “encrypted” and “metadata-free” are not synonyms. This series will build a bounded model of the risk: first the part TLS protects, then the application behavior that preserves a length signal, then the inference method that turns that signal into partial meaning. The practical judgment is not whether every response can be read. It is whether a service’s delivery pattern can reveal a user’s topic, a sensitive entity, or an intent that the user reasonably expected the encrypted channel to conceal.
The puzzle is not a broken cipher
PromptEcho was introduced in the paper From Length to Content: Token-Length Side-Channel Attacks on LLM API Merged Outputs. Its target is not TLS’s encryption algorithm. It is the relationship between an LLM’s generated text and the chunks in which an API sends that text. A service may generate output token by token internally, yet transmit several adjacent tokens together. The network observer does not see those tokens. They see encrypted records and their sizes.
That distinction seems reassuring at first. Earlier side-channel attacks could exploit a fine-grained stream in which each token produced a distinguishable transmission event. Aggregating tokens removes the obvious one-token-at-a-time pattern. But aggregation does not make the transmitted chunk independent of its contents. If one chunk contains several tokens, its payload still has a length. Across a response, the sequence of chunk sizes can preserve a coarse outline of the text even though the text itself is hidden.
The paper calls this residual signal a merged-token length side channel. PromptEcho treats each observed value as a constraint on a contiguous span of the response. It then searches for text whose token lengths fit those constraints and whose language remains plausible in context. The result is not necessarily a transcript. It can be a semantically similar sentence, a recognizable topic, a key entity, or merely the discourse structure around a sensitive request. That is enough to turn a transport observation into a privacy concern.
The distinction between a side channel and a decryption failure is essential. In the evaluated threat model, the observer is passive. They may be positioned on a shared network, a compromised router, or an upstream provider path, and they can monitor the sizes and ordering of response-carrying records. They cannot decrypt the victim’s payload, modify the exchange, inject prompts, or inspect the LLM’s internal probabilities. The study also allows calibration using the observer’s own ordinary interactions with a service. That is a very different capability from possessing the victim’s keys or taking control of the API.
TLS therefore remains successful at its primary job. It prevents the observer from reading the protected bytes and detects unauthorized modification. The side channel asks a narrower question: how much information does the way those bytes are packaged still carry? A sealed envelope can protect its letter while revealing whether the letter is one page or twenty. In an LLM stream, the pattern is more structured than that simple analogy: the lengths reflect tokenization, formatting, buffering, and the service’s response habits. The observer does not obtain a direct dictionary from size to word. They obtain constraints that may become useful when combined with the regularities of language.
Why partial meaning is enough
Privacy loss does not require perfect reconstruction. A verbatim response about a medical condition would be an obvious disclosure, but an observer may not need those exact words. If the reconstruction preserves the treatment context, the name of a condition, or the topic of a political question, the user’s situation may already be identifiable. A paraphrase can expose the thing that the user meant to keep private even while changing the wording.
PromptEcho’s reported cases make this continuum visible. At one end is exact recovery. In the middle are partial entity leakage and semantic leakage: a treatment context survives while descriptive words change, or a sensitive political subject remains clear while a location is substituted. Farther down the scale, a reconstruction may preserve only a discourse frame, such as a sentence about a crisis, while losing the specific event. There are also failures in which a generic answer template is recovered but the sensitive payload disappears. These outcomes are not equivalent, but neither should they be collapsed into a single “read” or “did not read” category.
This is why topic-level inference matters. LLM interactions often concentrate a user’s intent in the beginning of a response. An answer may open by naming the subject before adding qualifications, examples, or a long list. If the first transmitted segment is more recoverable than later segments, the attacker does not need to reconstruct the whole answer to learn what the conversation was about. The paper’s headline evaluation reports correct topic inference for 42.5 percent of sessions and reconstruction of 25.5 percent of responses above a cosine-similarity threshold of 0.9 across the evaluated GPT-4o and DeepSeek-V3 setting. Those are study results, not universal properties of encrypted APIs, but they are large enough to make “the text is encrypted” an inadequate privacy conclusion.
The paper’s threat model also clarifies what the result does not mean. It does not show that any observer can recover any user’s complete answer. It does not show that TLS keys can be derived from packet sizes. It does not establish equal exposure across languages, protocols, providers, or workloads. The reported risk depends on the service’s streaming behavior, the observer’s ability to identify the relevant flow, a compatible tokenizer and calibration data, and the linguistic regularity of the response. Those conditions narrow the claim without making it trivial.
A useful way to state the issue is this: encryption can hide the message while leaving a measurable relationship between the message and its delivery. Privacy is weakened when that relationship is stable enough to support inference. The strength of the inference will vary. A short, conventional answer may offer stronger clues than a long piece of creative writing; a common sentence may be easier to predict than a rare legal name. But a side channel need not work uniformly to matter. It can be valuable precisely when the exposed content is concentrated and sensitive.
A layered model of the risk
The rest of the problem can be understood as a chain of five layers. The first is the generated response: an LLM produces a sequence of text units, not a single opaque object. The second is tokenization: those units may be words, subwords, punctuation, or fragments that include whitespace, and different model families divide the same text differently. The third is application streaming: the service packages adjacent output into chunks to balance responsiveness and transmission efficiency. The fourth is the encrypted transport: TLS protects each record’s contents but does not automatically conceal its length. The fifth is inference: PromptEcho combines the observed length constraints with language regularities to propose meaning.
No single layer is sufficient by itself. TLS explains why a length is observable, but not why that length maps to an LLM response. Tokenization explains why a length-to-text mapping is ambiguous, but not how an observer obtains a clean sequence from a live network. The service’s framing supplies the bridge: fixed metadata and recurring response patterns can sometimes be separated from the variable content portion. PromptEcho supplies the final step by narrowing many compatible strings to candidates that make semantic and contextual sense.
A small example shows why the signal is neither useless nor definitive. Suppose an encrypted stream yields a merged length that could be explained by two short tokens, one longer token, or several fragments with spaces and punctuation. The number does not identify the original words. But once neighboring observations suggest that the response is beginning a sentence, ordinary language makes some decompositions far more plausible than others. A candidate such as “That could be a sign of infection” can fit a sequence of merged length constraints because its token boundaries and character counts are compatible with the observations. Other strings may fit the same totals, yet sound unnatural, break the sentence, or conflict with the preceding context. PromptEcho’s advantage comes from ranking this narrowed set with linguistic expectations; the length constraint supplies structure, while the language model supplies probability. Neither component alone proves what the victim received.
The same distinction applies to extraction before reconstruction. A network capture can contain protocol overhead, a preamble, multiple TLS records in one transport segment, or one record split across several segments. The observer must first estimate which bytes belong to variable response content and which belong to stable service framing. That is why the paper’s results depend on service-specific calibration and on assumptions about padding and encoding. The attack is not “read the packet and read the answer.” It is a chain of inferences, each of which can be weakened by a changed interface or a deliberate obfuscation policy.
That layered view also shows where the attack can fail. Extra padding can break the relationship between content and record size. Changed buffering or batching can make a calibration model stale. Missing packets, rare terminology, numerals, code, and strict mathematical structure can enlarge the candidate space. A provider can change the stream without changing its encryption algorithm at all. Conversely, a provider can keep using strong TLS while exposing a stable application pattern that remains useful to an observer.
The central security question is therefore not simply, “Is the response encrypted?” It is, “Which properties of the response remain correlated with what an observer can measure?” PromptEcho gives that question a concrete form. The paper’s evidence concerns particular API services and controlled evaluation conditions, but the design lesson is broader: confidentiality protects content bytes; traffic-analysis resistance requires deliberate attention to the shape of delivery.
The next step is to make the transport boundary precise. TLS 1.3 states plainly that it does not hide the length of the data it transmits, while also providing a mechanism for padding records. Understanding that boundary prevents two opposite mistakes: treating record sizes as if they were plaintext, and assuming that encryption alone removes every useful signal.