Physical Side-Channel Attacks on Edge LLMs: Extracting Output Tokens and User Prompts

The deployment of large language models (LLMs) on edge devices is largely motivated by privacy concerns over sharing sensitive user data with cloud servers. In this paper, we demonstrate that keeping inference local does not eliminate privacy risks: an adversary with physical access to the device may exploit hardware leakage to recover sensitive information without compromising or modifying the software system. In particular, we present an electromagnetic (EM) side-channel attack targeting LLM inference on edge devices. Targeting LLaMA-3.2-1B-Instruct running on a Raspberry Pi 5, we demonstrate that EM traces collected during inference can leak both generated tokens and user prompts. We propose three attacks under different threat assumptions. First, a profiling attack that identifies generated tokens among 50 medical and privacy-related keywords with 97.2% accuracy on profiled words. Second, a reconstruction attack recovers the model's hidden representations and uses them to predict tokens from the full 128k-token vocabulary, achieving 94.3% accuracy on profiled classes. For unseen words, the correct token is ranked within the first 100 positions of the 128k-token vocabulary in 67% of cases, with a median rank of 54. Finally, we present a hidden-state inversion attack that uses the recovered hidden state to reconstruct user prompts semantically. Our proposed attacks require only passive EM side-channel measurements and a limited number of traces during model training. These results demonstrate that local execution alone may not guarantee the confidentiality of generated tokens and user inputs.