TranScope: What the Software Hides About LLM Training Data, the Hardware Reveals at Scale, and Accelerators Magnify

T RAN S COPE: What the Software Hides About LLMs Training Data, the Hardware Reveals at Scale, and Accelerators Magnify Joshua Kalyanapu, Darsh Asher, Kaushal Mhapsekar, Bita Aslrousta, Rushiraj Chaitanyakumar Sheth, Maharshi Mukeshkumar Oza, Achyuta Kannan, and Samira Mirbagher Ajorpaz

Abstract—Membership is the root privacy primitive in machine learning: to date, no hardware-based out-of-distribution detection on black-box models has been demonstrated against constanttime, static neural networks with masked confidence. This paper performs the first cycle-level examination of how large language models (LLMs) and vision transformers interact with various modern microarchitecture components, including integrated accelerators, as LLMs scale in size and answers the question of whether the data that a model was trained on affects its execution footprint even without any input-dependent branch, dynamic optimization, or early exit and in constant-time models. The results confirm that the answer is yes and identify which modern hardware components, such as TLBs or on-core accelerators, reveal or amplify that effect. The results also answer whether the signal is informative enough to reliably classify the in-/vs/out-of-distribution property of membership. To understand why, we perform a systematic root cause analysis and find that the transformer’s tokenization steps, which happen during training, alter the locality of the accesses the model makes to fetch the vocabulary token later during inference and, as a result, change the page table access patterns and TLB in a previously unknown data-dependent way, causing microarchitectural state to vary significantly based on whether or not the input was in the distribution of the transformer training data. Building on the above observation, we introduce T RAN S COPE: the first microarchitecture tool for detecting membership information with low cost, no need for a surrogate model, and significantly higher robustness, e.g., 0.6 AUC for PETAL (best previously reported) vs 0.9 AUC (ours). This reintroduces hardware as both an opportunity, e.g., a tool for checking copyright violation for the first time, and a new channel for inferring membership (MIA). TranScope achieves a surprisingly high outof-distribution detection accuracy of 98% (1.5% FPR, 2.5% FNR) across large-scale models ranging from 4.4 million to 1.1 billion parameters.

I. I NTRODUCTION Membership inference attacks on generative LLMs have proven to be not as straightforward as in classifier models. Duan et al. [1] shows how natural language lends itself to having a high degree of overlap between members and nonmembers, due to common phraseology appearing in natural language making members and non-members inherently similar. Meeus et al. [2] shows that most membership inference attacks on large-language models, particularly those benchmarking on the standard benchmark WikiMIA [3], rely on distributional shifts between members and nonmembers, reducing recent LLM membership inference attacks to outof-distribution detection instead. The equivalence is intuitive: from a safety standpoint, we are much more concerned with

(a) None

(b) Top-k

(c) Rounded

(d) Label

100

Attack accuracy (%)

arXiv:2610.06848v1 [cs.CR] 5 Oct 2026

North Carolina State University

90 80 70 60 chance

50

Traditional MIA

T RAN S COPE

Fig. 1: T RAN S COPE accuracy compared to the software MIA [6] against machine learning, under confidence-hiding defenses: (a) none, (b) top-k logits, (c) rounded confidences, and (d) label-only outputs. T RAN S COPE remains impervious to all software-level confidence-score-based defenses [6]; the dotted line marks chance accuracy.

whether a user John Doe’s social security number was used to train a model rather than whether the model was trained on the precise sentence ”John Doe’s social security number is X”. Therefore for language models, we treat out-of-distribution detection as equivalent to membership inference attacks as in prior work [3]–[5]. Traditional MIAs rely on confidence scores or logits. The standard defense is output discretization—rounding, quantizing, or binarizing confidence scores [6]. In production, logits are typically hidden, and many deployed MLaaS systems expose only labels. Figure 1 shows how output discretization has a devastating effect on traditional software-level MIAs, while T RAN S COPE is unaffected by them since T RAN S COPE does not use model outputs or confidences. Recently, due to the proliferation of label-only model APIs research has shifted towards label-only membership inference attacks that do not rely on model internals or confidence scores. Instead, the model’s robustness to an input, or how much noise is required to change the model output given a specific input, is measured via random perturbations and the robustness is used as a proxy for confidence, and therefore membership. Choquette-Choo et al. [16] first presented a labelonly attack on image classification models, finding comparable accuracy to confidence-based MIAs but required querying the expensive target model thousands of times. OSLO [12] overcame this limitation with a one-shot membership inference

Adaptive NN

Coresidency

White-box

Surrogate Model

One-shot input

LLM Membership

CNN Membership

MLP Membership

Model params

Victim data

Top-k logits

Rounded conf.

Label-only

Hard. update

Const. time

Diff. privacy

Mitigation

Output

Work Shokri et al. [6] TLBleed [7] LiRA [8] Cache Telepathy [9] Akinsanya et al. [10] LOMIA [11] OSLO [12] GateBleed [13] Tong et al. [14] PETAL [5] GhostTrace [15] T RAN S COPE (this work)

Target

Confidence

Requirements

✓ × ✓ × × × × × × × × ×

✓ × ✓ × × ✓ ✓ × × ✓ × ×

× × × × ✓ × × ✓ × × × ×

× ✓ × ✓ × × × ✓ × × ✓ ✓

◦ × × × × × × × × × × ×

✓ × ✓ × × ✓ ✓ × ✓ ✓ × ×

✓ × × × × × ✓ ✓ ✓ × ✓ ✓

× × ✓ × ✓ ✓ × ✓ ✓ ✓ × ✓

✓ × ✓ ✓ ✓ × ✓ ✓ × × ✓ ✓

✓ × ✓ ✓ ✓ × × ✓ × × ✓ ×

× × × ✓ × × × × × × × ×

× ✓ × × × × × ✓ × × × ×

✓ × ✓ × × × × × × × × ×

✓ × ✓ × × × × × × × × ×

✓ × ✓ × × × × × × × × ×

✓ × × × × × × ✓ × × × ×

× × × × ✓ × × × × × × ×

✓ × ✓ × × ✓ × × × × × ×

TABLE I: T RAN S COPE comparison to prior works.

attack, using trained surrogate models to precisely apply the minimum amount of noise such that a nonmember will flip classification, but the methodology does not extend to large language models and requires training surrogate models. PETAL [5] presented the first label-only membership inference attack on language models, but requires running a comparablein-size surrogate model which is expensive. To date, no labelonly membership inference attack has been demonstrated that do not require expensive running of a surrogate model, function on language models, and do not require multiple queries to the model. In concurrent work, Tong et al. [14] showed how the training dataset is encoded in the tokenizer itself, using the presence of distinctive and domain-specific tokens in publicly available tokenizers to infer in-distribution data. Like T RAN S COPE, Tong et al. leak membership through the tokenizer rather than the model itself, but unlike T RAN S COPE, Tong et al. leaks through the presence of specific tokens whereas T RAN S COPE leaks through the inter-token distance inducing membershipdependent read strides on the hardware. Since T RAN S COPE does not depend on the presence of specific tokens in the tokenizer vocabulary but rather token distance strides, Tong et al.’s mitigation of adaptively removing distinctive tokens from the vocabulary is ineffective against T RAN S COPE. State-of-the-art membership inference attacks assume blackbox access to AI models, where only a model’s outputs are visible and the internals of the models are invisible which mirrors membership inference attacks against remote model APIs. However, AI companies are shifting towards binarizing models to run locally to adhere to data residency policies that restrict inputting sensitive information to a cloud AI model. The model weights and parameters constitute a large amount of the value of an AI company, prompting the AI company to

release models in binarized form instead of open-weight form. Therefore, we anticipate in the future that AI model releases will be closed-weight, and model users will have only blackbox access despite the model running on a machine that the user has root access to. Examples of deployed local inference models with only black-box access include Apple Foundation Models [17], LLMWare’s Model HQ [18], Nvidia TensorRTcompiled models [19], Microsoft’s Phi Silica [20] and Aion Instruct [21], and Adobe Firefly [22]. Downloadable, closedweight models that do not provide confidence scores disable confidence-based membership inference attacks and out-ofdistribution detection force us to rely on expensive label-only membership inference attacks which are infeasible on lowpower user hardware. The trend is clear - industry is moving towards binarized models, mitigating all white-box and confidence-score-based membership inference attacks and necessitating label-only attacks. Existing label-only attacks are expensive, requiring thousands of queries to a model, training a surrogate model, or running a surrogate model. Table I positions T RAN S COPE within the literature, showing it as the first attack to not use confidence scores or outputs, not require an adaptive neural network, functions on language models, bypasses all existing MIA mitigations, does not require training or querying an expensive surrogate model, and only requires querying the target model once making it suitable for real-time deployment. Limitations of prior hardware-assisted MIAs. GateBleed (MICRO 2025) [13] was the first to exploit hardware to bypass output-discretization defenses, achieving 81% accuracy via Intel AMX power-gating timing. However, GateBleed rests on a structural assumption that disqualifies it from the majority of modern systems: the target model must contain an

Normalised power

Accuracy (%)

100

90

80

70

1.07 1.05 1.03 1.01 0.99 0.97

Member Non-member +2.6%

10

8

10

9

10

Parameter count

Fig. 2: T RAN S COPE accuracy grows as LLMs scale. Each point is the highest accuracy attains at that scale across all evaluated model families.

entropy-dependent branch that causes different computation for member versus nonmember inputs. Adaptive networks such as BranchyNet [23] and Mixture-of-Experts [24] satisfy this condition, but dominant modern models—LLaMA [25], BERT [26], GPT, Vision Transformers—execute static forward passes, providing no input-dependent branch for GateBleed to exploit. Our measurements confirm that end-to-end inference time for GPT and BERT is statistically indistinguishable between member and nonmember samples to within 1.2% across all model sizes and microarchitectures—the timing or usage signal on which GateBleed and all prior hardwarebased membership inference attacks depend simply does not exist in modern models. Furthermore, GateBleed also requires an unpatched Intel AMX [27], present only on Sapphire Rapids through Granite Rapids CPUs, producing no signal on earlier microarchitectures or non-Intel microarchitectures. GhostTrace [15] presents a GPU performance-counter based membership inference attack on CNNs and ViT, but achieves lower accuracy than T RAN S COPE due to the relatively few performance counters exposed by GPUs as compared to CPUs. Prior works EVAX [28], PerSpectron [29], and RHMD [30] demonstrated that malicious computation from transientexecution attacks such as Spectre [31], [32], Meltdown [33], FallOut [34], and LVI [35] leaves microarchitectural footprints detectable through hardware performance monitoring. Our work flips this premise. Instead of detecting microarchitectural side channels we use microarchitectural footprints to build a lightweight, fast detector for copyright abuse detection and leak properties of training data of production AI models including GPT [36], BERT [26], and Vision Transformers [37]— modern transformer architectures; not only with significantly higher robustness than software methods [14] but also bypassing all confidence masking defenses [6]. This paper demonstrates that the microarchitectural landscape can leak training-data provenance: whether a transformer or CNN has been shaped by a specific sample or a copyright-relevant stylistic property. Privacy-critical training data reshapes the internal mechanics of modern models— via embeddings, and locality—into differences that are not

+4.5%

+2.6%

†

−0.65%

4.4M 7

+4.0%

11M

29M

42M

110M

Fig. 3: Per-inference socket power normalised to BERT-tiny member. Non-member exceeds member by 2.6–4.5%, growing with model size. † Tiny: below RAPL quantum (artifact).

merely statistically detectable, but often visibly observable in standard microarchitectural counters (page-table walks, cache demand misses, prefetch-hit behavior, pipeline clears). Crucially, these leaks persist even when end-to-end timing changes by less than 1.2%, bypassing constant-time defenses entirely— undermining the intuition that “if the same high-level inference code runs, the hardware footprint should be the same.” We establish the root cause as a tokenizer-induced spatial-locality gap: training changes which embedding rows are hot, and that locality difference propagates into TLB walk counts, offcore memory traffic, and reservation-station pressure while remaining invisible to timing. Even more critically, we show that microarchitectural training-data provenance leakage grows with model size, reflecting the effect of larger model sizes memorizing more of the training set [38]. Figure 2 illustrates this point - a basic confidence-threshold membership inference attack jumps from 70% accuracy to 96% accuracy when the model surpasses 100M parameters. Our T RAN S COPE attacks on BERT and Pythia exhibit similar behavior. Figure 3 additionally shows how power-consumption disparity between members and nonmembers, one statistic utilized by T RAN S COPE, grows with model size further highlighting the growing AI privacy threat with increasing model size. As AI models scale in size, T RAN S COPE is not going away but will only become stronger. Unlike traditional microarchitectural side channels such as Spectre [39], Meltdown [33]—which leak stored information (cryptographic keys, pointers, model weights)—T RAN S COPE targets information not stored as bytes on the machine: training-set membership, a latent property of the learned model previously not believed to be inferrable from hardware alone. T RAN S COPE is neither a TLBleed [7] nor a traditional cache attack which encode victim memory in the TLB and cache for later extraction by an attacker — while T RAN S COPE does use the TLB and cache, T RAN S COPE targets training-set membership, a property stored nowhere in victim memory. Similar to Cache Telepathy [9] which used known cache attacks to attack AI models, T RAN S COPE also attacks AI models; however, while Cache Telepathy targets model architecture and hyperparameters, T RAN S COPE targets training-set

membership. This paper contains many unexpected results that are fundamental to hardware security in protecting user data used for training these models. Out-of-Distribution Detection and Membership Inference Attacks. Out-of-distribution detection (OOD) asks whether a specific record is within the training-set distribution of a model; informally, whether the input is similar to the data the model was trained on. Out-of-distribution detection was first described by Hendrycks et al. in 2016 [40], using model outputs due to models being overconfidently incorrect on inputs not drawn from its training distribution, leading to AI safety issues described by Amodei et al. [41] which have manifested in the real world. In 2018, a pedestrian was killed by a self-driving Uber due to the software not recognizing the possibility of jaywalking pedestrians [42]. In 2016, a driver was killed when colliding with a tractor-trailer while using Tesla Autopilot, which failed to identify the tractor trailer crossing into the driver’s lane and prompt for human intervention [43]. Thus, the inability of a model to identify inputs unlike its training set to flag a human for manual intervention can yield disastrous results. Related to out-of-distribution detection are membership inference attacks (MIAs), which ask whether a specific, indistribution input was in the training set [6], [8]. Membership is a sensitive and legally actionable fact—determining whether a cancer scan, private message, or copyrighted manuscript was used for training can establish violations of medical privacy, confidentiality agreements, or copyright. Recent headlines make this concrete: Getty Images sued Stability AI for training on copyrighted images [44]; LinkedIn was accused of training on private messages; Apple was sued for allegedly using pirated books to train AI models [45]. Foundational MIA work [6], [8] has accumulated thousands of citations because membership is the root privacy primitive: a model that behaves differently on training-set members versus nonmembers enables escalation to attribute inference and, in the worst case, model inversion. T RAN S COPE removes both constraints simultaneously while achieving over 95% membership inference accuracy in most cases. By observing 290+ hardware performance counters rather than a single timing scalar, it detects membership leakage in static, branchless, production transformer networks—BERT [26], ViT [46], GPT [36], and Pythia [47]— on Intel Sapphire Rapids, without requiring any specialized accelerator or adaptive computation. We demonstrate that 27+ counter events exhibit statistically significant member-versusnonmember divergence when timing is constant and every prior defense and attack is blind. Our 290+ event traces reveal that LLMs and vision transformers do not stress the processor uniformly: training familiarity, input entropy, and model scale reshape branch behavior, front-end delivery, TLB activity, cache locality, reservationstation occupancy, execution-port pressure, power, and latency across the full pipeline. Each counter disparity is simultaneously a leakage signal and a design signal, motivating embedding-aware TLB partitioning, large-page-backed em-

bedding tables, and branchless pooling primitives. Legal cases involving copyrighted data in AI training have proliferated: Thomson Reuters v. Ross [48], Doe v. GitHub [49], Andersen v. Stability AI [50], Getty Images v. Stability AI [44], Concord Music v. Anthropic [51], UMG v. Suno [52], NYT v. OpenAI [53], Bartz v. Anthropic [54], and Kadrey v. Meta [55]. We validate T RAN S COPE on the same corpus at the center of the New York Times Co. v. OpenAI. litigation, using real copyrighted NYT articles—not synthetic benchmarks—to demonstrate that pre-2019 (potential member) and post-2019 (definite non-member) articles separate in counter space despite identical software execution. Contributions. This paper makes the following contributions: •

We investigate the potential of microarchitectural MIA on static, branchless production transformer, bypassing constant-time defenses. We show that 15 Intel counter events and power consumption expose training-set membership in BERT, ViT, GPT, and LLaMA yielding AUC 0.995, 99.8% accuracy, TPR 100%, FPR 0.5% on a realistic threat model available to common users of these popular models, rendering confidence masking and constanttime padding ineffective.

•

We trace the causal chain from training corpus vocabulary statistics through token-ID proximity and embedding-row spatial locality to cache/TLB residency and observable counter divergence and show the tokenizer effect on embedding locality affecting TLB is the root cause for LLM membership leakage.

•

We show how T RAN S COPE bypasses software-level confidence masking and constant time padding for membership inference defenses due to T RAN S COPE’s lack of reliance on model outputs, confidences, and end-toend execution time. As a first line-of-defense for mitigating T RAN S COPE, we recommend restricting tokenizer training during fine-tuning. Further defenses include smoothing embedding table accesses by sorting token IDs, making the spatial footprint of familiar and novel inputs more similar. We also introduce the concept of constant-footprint execution, where an AI inference system equalizes not only end-to-end runtime but other microarchitectural statistics like TLB accesses, execution port utilization, and per-inference energy consumption.

Responsible Disclosure. We disclosed T RAN S COPE to Intel in July 2026. Intel reproduced our results and confirmed our findings. Paper organization. Section II enumerates the legal and malicious threat models under which we operate. Section III details the T RAN S COPE attack. Section IV describes our experimental environment, including hardware, models, and datasets. Section V details the microarchitectural insights we glean to improve model execution from observing the performance counters generated by T RAN S COPE. Section VI discusses related work, and Section VII concludes.

II. T HREAT M ODEL

a monotonic trend over publication date—precisely the signal a coarse aggregate histogram would obscure.

We consider a legal threat model where T RAN S COPE imposes no requirements on the victim: the attacker does not need to synchronise with, observe, or force the victim to repeat queries. In fact, there is no victim at all—the attacker, or legal auditor, is the user. Legal threat model (privileged auditor). The attacker downloads a publicly-available model and runs it on hardware they own and control. This is not a hypothetical scenario; it is the default operating mode of every user who interacts with a publicly released language model today. Models such as GPT [36], LLaMA [25], and BERT [26] are distributed as open weights executable on any commodity CPU without specialized drivers, CUDA installation, or minimum VRAM. Furthermore, industry is shifting towards shipping binarized, closedweight models runnable on commodity hardware, such as Apple Foundation Models [17], Microsoft Aion Instruct [21], and Adobe Firefly [22], allowing only black-box model accesses even when running on an attacker-controlled machine. The attacker downloads the model, inputs the disputed artifact to it, and reads the hardware counters on their own machine. There is no co-location problem, no hypervisor to evade, no victim with which to synchronize, and no need for the model owner to cooperate or be aware that the measurement is taking place. The attacker controls the entire measurement stack: the hardware, the OS, the inference runtime, and the input. This is the most realistic attacker model in the side-channel literature, because it requires zero capabilities beyond those already available to every user who downloads a publiclyreleased model. The goal is to build a hardware footprint that separates data matching the model’s training distribution from data that does not, producing corroborating evidence for legal proceedings. The CPU is the strongest measurement platform for this purpose: Intel Sapphire Rapids exposes 263 publicly documented core performance monitoring events spanning branch prediction, front-end delivery, TLB activity, cache hierarchy, scheduler pressure, execution-port utilization, retirement, and software-prefetch behavior—orders of magnitude more signal than GPU performance counters. Auditor and expert-witness models. In forensic settings, a court-appointed or party-retained auditor receives the artifact(s) under investigation, control corpora, and controlled model access. The deliverable is a reproducible evidence bundle satisfying Federal Rule of Evidence 702 and the Daubert standard [56]. The T RAN S COPE protocol anticipates both plaintiff- and defendant-assisted audits. Empirical validation on real copyrighted articles. We apply T RAN S COPE to GPT on real New York Times article snippets—copyrighted content from the NYT API, not synthetic benchmarks. We separate articles by GPT’s disclosed training cutoff: pre-October 2019 (candidate members) versus post-2019 (definite non-members). The results reveal statistically significant hardware footprint differences that appear as

III. T RAN S COPE A. Overview A model trained on a corpus D implicitly optimizes its hardware access pattern for inputs drawn from D. Familiar inputs access a compact, hot region of the embedding table, stressing the TLB and caches in predictable ways. On the other hand, novel inputs scatter accesses across the embedding table, accessing a larger swath of the embedding table resulting in more TLB and cache misses. These effects are invisible at the level of the Python forward pass—the same operators execute in the same order—yet are measurable via hardware performance counters. T RAN S COPE measures the distributional distance between an inference input and the model’s training distribution, as reflected in hardware telemetry. This is why T RAN S COPE is framed around in-distribution/out-of-distribution rather than member/nonmember: it is a statistical characterization of whether the input has the same “spirit” as the training corpus. Provenance witness. We define a provenance witness as a hardware-visible or model-internal signal whose behavior is statistically consistent with prior exposure to a disputed artifact, or to a narrowly defined artifact class, and which can therefore serve as corroborating evidence regarding the artifact’s origin or training influence. No single witness settles a case in isolation; when multiple witnesses shift coherently— TLB activity, token locality, and power all moving in the same direction—they collectively form a strong provenance argument. B. Root Cause: Tokenizer-Induced Embedding Locality Core claim. The counter divergence between familiar and unfamiliar inputs is not noise across independent hardware events. It is the projection of a single microarchitectural mechanism with a traceable causal chain: training-corpus familiarity → token-ID proximity → embedding-row locality → cache/TLB residency → counter divergence. We make this concrete with an example shown below and in Figure 4. Suppose we have a large language model whose training cutoff was 2020. Then, if the model was trained on news articles around the cutoff time it would have encountered many headlines relating to COVID-19 (early 2020) but it would not have encountered any headlines relating to the Russo-Ukrainian war (early 2022). Two articles, two memory landscapes. Consider an example headline from March 2020: “COVID-19 spreads in Wuhan as cases rise; China reports new virus infections.” When the model’s tokenizer processes this sentence, it maps each word to an integer ID that serves as a row index into the model’s embedding table. Because words like “China,” “virus,” and “spread” appeared millions of times in the model’s training corpus, the tokenizer learned to assign them small, numerically

PT walks

4M Parameter LLM

11M Parameter LLM

29M Parameter LLM

41M Parameter LLM

110M Parameter LLM

340M Parameter LLM

1

0.5

PT walks

0

1

0.5

Fig. 4: A T RAN S COPE root-cause mechanism: member vs. non-member inputs traverse identical software paths but diverge in the memory hierarchy. Left: A member article (COVID-19, Mar. 2020) produces low-ID, clustered tokens whose embedding rows are cache- and TLB-resident, yielding TLB hits and zero page-table walks. Right: A non-member article (Ukraine, Feb. 2022) produces high-ID, scattered tokens with large address strides, triggering the full TLB-miss → page-walk → DRAM-fetch cascade. The resulting counter divergence is consistent, large, and entirely invisible to endto-end timing—bypassing constant-time defenses.

nearby IDs: for example, China (2859), virus (3142), spread (4293). These IDs would cluster in a narrow band in the vocabulary. Now consider an example headline from February 2022: “Russia invades Ukraine with full-scale attack, shelling near Kyiv.” The words “Kyiv,” “invasion,” and “shelling” would be rare or absent in the model’s training data. The tokenizer would assign them large, widely spaced IDs, for example: Kyiv (27631), invasion (18204), shelling (14208). These IDs scatter across a vast range of the vocabulary. From IDs to memory addresses. Each token ID rt indexes a row in the embedding table at address addr(rt ) = BASE + rt · dmodel · sizeof(float). For BERT-base (dmodel = 768, fp32), each row occupies 768 × 4 = 3,072 bytes—nearly filling a single 4 KB memory page. The physical distance the processor must jump between successive token lookups is proportional to the difference in their IDs. For the member pair China → virus, the stride is 283 × 3,072 ≈ 0.83 MB—a short hop within a few neighbouring memory pages. For the nonmember pair Kyiv → invasion, the stride is 9,427 × 3,072 ≈ 28.9 MB—a 35× larger jump that leaps across thousands of pages the processor has never seen in this inference. What the hardware sees. The CPU maintains a translation lookaside buffer (TLB) that caches recent virtual-to-physical page mappings. When successive embedding lookups land on nearby pages, the TLB already holds the translation: the

PT walks

0

1

0.5

0 100

101

102

Nonzero tokens

100

101

102

Nonzero tokens

Fig. 5: 2M/4M-sized page table walks for increasing LLM sizes with increasing zero-token count. Y-axis is page table walks normalized to page table walks for the fully random token sequence.

access is a fast hit, resolved in a few cycles. When lookups scatter across distant pages, each new page forces a page-table walk—the processor must traverse four levels of the page-table hierarchy in memory, costing roughly 200 cycles per walk. Figure 5 makes this concrete. In this experiment, we created a dataset consisting of token sequences of length 512, beginning as entirely random sequences and setting an increasing amount of tokens within the sequence to 0 until the last item in the dataset, an all-zero token sequence. We run the dataset through all canonical BERT sizes, finding that tiny, mini, small, medium, and base exhibit a clear trend of increasing page table walks for increasing amount of nonzero tokens. Large stays flat at a constant number of page table walks, we attribute this to the large size of the model drowning out the contribution of the embedding table accesses. However, in Section IV we find that many performance counter observations can be combined in aggregate to determine outof-distribution from in-distribution data at high accuracy, even for large models. For the candidate member article, the clustered token IDs produce a compact memory footprint. The embedding rows land on ≤ 70 distinct pages, and most of those pages stay TLB-resident throughout inference. The processor follows the fast path: TLB hit, L1/L2 cache hit, no page-table walk. For the non-member article, the scattered IDs spray accesses across many different pages. The TLB overflows, and each new page triggers the slow path: TLB miss, second-level TLB miss, last-level cache miss, page-table walk, and finally a DRAM fetch.

CDF

1 0.5 0

0

15k

30k

(a) 4.4 M

0

15k

30k

0

(b) 11.3 M

15k

30k

(c) 29.1 M

0

15k (d) 41.7 M

30k

0

15k

30k

(e) 110.1 M

Fig. 6: Successive token-distance CDF for member vs. nonmember across model sizes—root-cause observation that member tokens cluster while nonmember tokens scatter regardless of model size, and evidence that the phenomenon generalizes across sizes and is not limited to one case. The dark curves are an in-distribution sample and the dashed orange curves are an outof-distribution sample.

Name

ID

OOD

Input Shape

Structured v. IMDb [57] Random NIH v. NIH Enron Exporter [58] Enron v. Enron NIH Emails [58] NYT 2018–2019 ViT ImageNet [59]

Random

512

Enron Emails [58] NIH Exporter [58] 2020–2024 Random

512 512 512 224×224×3

TABLE II: T RAN S COPE evaluation datasets. ID and OOD are the in-distribution and out-of-distribution corpora; the NYT rows give article publication years. Input is the sequence length in tokens, or the image resolution for ViT. The NIH and Enron rows use a tokenizer trained on their own ID corpus; all other rows use the stock tokenizer.

The model executes an identical sequence of neural-network operations in the same number of clock cycles for both articles—the difference in page-table walks is too small (20 walks out of 52 million cycles) to surface in end-to-end timing, yet the hardware counters that track TLB misses, off-core memory traffic, and reservation-station pressure tell different stories. This is the signal T RAN S COPE reads and why constant-time padding provides no defense. Statistical confirmation. Figure 6 confirms the successive token-distance gap across all five BERT model sizes: the indistribution CDF rises sharply at small token distances, while the out-of-distribution CDF is consistently heavier-tailed. Key insight. The processor is not reacting to input data semantics; it is reacting to the geometry of embedding memory accesses induced by the tokenizer. All measured counters— fewer page-table walk completions for members, fewer offcore demand reads for members, more reservation-station stalls for members (because loads retire faster and the back-end fills up)—are correlated projections of this single root cause. The difference is consistent across models, observable across hundreds of counter events, and invisible in end-to-end timing.

C. Algorithm T RAN S COPE is organized around four design principles: (P1) non-invasive measurement (the model is treated as a fixed artifact); (P2) multi-witness evidence (263 counters organized across seven subsystems form a jury, not a single gadget); (P3) controlled execution (core placement, SMT, frequency, prefetcher state, and input normalization form a disclosed configuration manifest); (P4) method separated from conclusion (output is corroborating evidence, not a binary legal verdict). The system proceeds in five stages: (1) artifact conditioning—defining the provenance question and constructing familiar/novel reference sets; (2) controlled execution harness—applying hardware configuration controls; (3) targetmodel inference—executing on both reference sets and the disputed artifact; (4) multi-witness footprint collection— recording counter telemetry, power, latency, and token locality; (5) analysis and evidence generation—computing effect sizes, subsystem grouping, and emitting an auditable report. D. Step-by-Step Attack Walkthrough: Example BERT We provide an example of the T RAN S COPE attack on the 110.1 M-parameter BERT-base model trained for sentiment classification on 1,000 IMDB reviews [57]. Step 1: Reference set construction. The familiar set XF consists of 1,000 IMDB reviews from the training split. The novel set XN consists of 1,000 sequences of uniformly sampled token IDs from the BERT vocabulary, matched in length. Step 2: Execution and counter collection. Each input is tokenized and padded to 512 tokens. The model executes on a single core pinned via taskset, SMT disabled, TurboBoost enabled, prefetchers at factory defaults. We collect all available performance counters on the system using PAPI [60], plus RAPL energy. Step 3: Key observation. Figure 7 shows the result. End-toend latency is statistically identical (∼52 M cycles), yet pagetable walk completions are elevated by ∼20 walks for outof-distribution inputs—consistent with the embedding-table locality mechanism. Step 4: MCF score computation. For each witness w ∈ W, compute the z-score of the disputed artifact relative to the

familiar and novel reference distributions. Aggregate across witnesses to produce a subsystem-level summary and overall MCF score. Step 5: Evidence report. The final report includes percounter effect sizes with 95% bootstrap CIs, a subsystem-level heatmap, the MCF score with estimated false-positive rate, and the full configuration manifest.

of-distribution), and vice versa (iv) Pre/post-training-cutoff corpus (NYT): copyrighted articles before GPT’s training cutoff (in-distribution) vs. post-cutoff (out-of-distribution). All inputs are matched in length and size, ensuring that the same amount of work executes for each sample; therefore, any performance counter differences we find are due to how the model reacts to the input.

IV. E VALUATION

Page table walks

A. Experimental Methodology

4K page table walks Loads causing a page table walk STLB misses Page table walks that are L1 hit L1D cache replacements Stalls due to ROB exhaustion Offcore demand data reads Page table walks that are L3 hit L2 misses Cycles handling DTLB load misses DTLB store misses Cycles handling L1 miss

0

2M/4M page walks

Cycles (×108 )

5.15 5.10 5.05 5.00

520

440

400 OOD

ID

OOD

ID

Fig. 7: Per-inference cycle count (left) and 2M/4M-page table walks (right) for in-distribution (ID) and out-of-distribution (OOD) inputs on 110M-parameter LLM, using the Structured v Random dataset in Table II. Cycle counts are indistinguishable between the two groups (medians differ by 7.6 × 104 cycles, 0.015%), but the page-walk medians differ by 14 walks.

0.6

0.8

1e6

1e6

4.345

3.170

4.340

3.165

4.335

3.160

4.330

3.155 Scalar FP Instructions

7000

+1.728e7

Double-precision scalar FP insts +2.798e7

6000 5000 4000 3000 2000

5000 4000 3000 2000 Taken Branches

480

0.4

Fig. 8: Counters with Cohen’s d > 0.2 for BERT-tiny (4.4M) on the Haswell microarchitecture, ranked by effect size.

0 5.20

0.2

Cohen’s d (member vs. non-member)

1000

5.25

d=0.5

Hardware configuration. All experiments run on a single isolated core pinned via core affinity, with isolcpus removing the core from the OS scheduler. All experiments run with TurboBoost enabled (800 MHz–4.1 GHz). SMT is disabled in all primary experiments. Counter access requires perf_event_paranoid = −1 (CAP_PERFMON on Linux 5.8+). Experiments marked IPEX use Intel Extensions for Pytorch, a Pytorch backend that makes use of Intelspecific features like AMX, rather than the default Pytorch CPU backend. Models. We study three model architecture families spanning recent transformers: BERT (4.4 M, 11.3 M, 29.1 M, 41.7 M, 110.1 M parameters) fine-tuned for sentiment classification on the Large Movie Review Dataset [57]; ViT (22 M, 86 M, 307 M parameters) trained on ImageNet [59] for image classification, and Pythia (70M, 160M, 410M, 1B, 1.4B, 2.8B parameters), a language model mimicking LLaMA [25] but with disclosed training data [47]. Datasets. Each model is paired with a corpus designed to isolate training-exposure effects as seen in Table II: (i) controlled-entropy images (ViT): CIFAR samples (ID) interpolated with uniform entropy (OOD), decoupling input entropy from content semantics; (ii) semantically-structured vs. random tokens (BERT-Random): 1,000 IMDB reviews (in-distribution) vs. 1,000 uniformly sampled random token sequences (out-of-distribution); (iii) Tokens from two different semantic contexts (BERT-NIH, BERT-Enron): 1,000 NIH Exporter samples (in-distribution) vs. 1,000 Enron Emails (out-

1000

Software Prefetches

Fig. 9: Four emergent counter signals for Vision Transformer on member (left) vs. nonmember (right) data. Despite identical clock-cycle counts, nonmembers retire more scalar FP instructions while members take more conditional-taken branches and trigger more software prefetch accesses—a previously unknown microarchitectural fingerprint in production vision transformers. B. Emergent Counter Rankings We define a counter as emergent if it exhibits mediumto-high effect size (d ≥ 0.5, p ≤ 0.15) in the member-vs.nonmember comparison. By convention, d ≥ 0.5 is medium, d ≥ 0.8 is large, and d ≥ 1.5 is exceptional.

Figure 8 ranks 13 emergent counters for BERT-tiny (4.4 M) on the Haswell microarchitecture. Counters relating to page-table walks exhibit emergent behavior and achieve the strongest separation between member and nonmember (d = 0.75—0.82). The rest of the emergent counters are related to cache misses, like L1D cache replacement, ROB stalls, offcore data reads, L2 misses, and cycles handling L1 misses. Figure 9 shows four emergent counters for Vision Transformers — scalar FP instructions, double-precision FP instructions, taken branches, and software prefetches. Notably in the ViT and BERT cases, total cycle count and end-to-end timing are not emergent, confirming that the leakage bypasses constant-time defenses. Figure 10 ranks the top 15 emergent counters for ViTbase (86 M) on Sapphire Rapids. Floating-point microcode assists ASSISTS.FP dominates at d = 2.52—the largest effect size across all model–architecture pairs in this study and the largest hardware-based membership effect size reported to date.

Similarly, we repeated the Structured v Random experiment with BERT running on Intel Extensions for Pytorch (IPEX), a backend using Intel AMX and Intel AVX-512-VNNI kernels representing modern accelerator hardware. Interestingly, we see a clear monotonic increase in AUC and accuracy for increasing model size when using the IPEX backend, implying the use of modern accelerator hardware makes T RAN S COPE more effective at larger model sizes. Finally, we repeat the methodology except using the Enron v NIH and NIH v Enron datasets to see if T RAN S COPE can distinguish between two nonuniform distributions. We find that despite both in-distribution and out-of-distribution texts being valid sentences, T RAN S COPE is still easily able to separate member and non-member with 98% accuracy.

FP microcode assists Scalar FP instructions Double scalar FP instructions Software prefetches

d=0.5

Conditional taken branches Taken branches Loads Memory instructions Instructions retired Instructions retired Not-taken branches 32-cycle stalled FE instructions Port 1-dispatched FP instructions

members of the same size which we generated with 10 repeats per sample and stacked the resulting statistics into a dataset of 2000 samples each with 1,596 features. We trained a 4-layer multilayer perceptron classifier on the the resultant data using an 80/20 train/test split, with the layers having 512, 128, 32, and one neuron, respectively. We trained for 10 epochs with a dropout of 0.4 in the first 2 layers. Table III contains our results. In most cases, we achieved an accuracy of over 90% in determining IMDB samples vs random sequences using only performance counters, regardless of model size.

As Figure 11 shows, both the false-positive and falsenegative rates drop to near zero once the model exceeds ∼30 M parameters for BERT and ∼70 M for Pythia, confirming that the attack signal strengthens with capacity.

Microcode assists Port 0-dispatched FP instructions 0 0.25 0.5 0.75 1 1.25 1.5 1.75 2 2.25 BERT GPT-2

C. Power Side-Channel Per-inference socket power (Intel RAPL, SGX enabled) reveals a third independent leakage channel orthogonal to both performance counters and timing. Figure 3 shows power normalised to the BERT-tiny member baseline. The member/nonmember gap grows monotonically from +2.6% at BERT-mini to +4.5% at BERT-base, tracking model parameter count. End-to-end wall-clock time is flat to within 1.2% across all sizes, confirming that timing defenses fail—yet RAPL power provides a complementary and growing signal. D. BERT Member/Nonmember Classifier Study We collected the performance counter, energy, and power statistics for all BERT sizes on Sapphire Rapids across 100 samples of the IMDB dataset and 100 samples of verified non

False Negative Rate

Fig. 10: Top 15 effect size emergent counters for ViT-base (86M parameters) on the Sapphire Rapids microarchitecture, ranked by effect size. FP microcode assists (d = 2.52) is the strongest single-counter membership signal reported to date.

False Positive Rate

Cohen’s d (member vs. non-member)

Pythia BERT IPEX

Enron v NIH NIH v Enron

0.4 0.3 0.2 0.1 0.0 0.4 0.3 0.2 0.1 0.0 4M

11M

29M

70M

160M

410M

1B

2.8B

Model parameters

Fig. 11: False positive and false negative rates vs. model size. Both error rates drop sharply as model size increases for BERT and Pythia , while GPT-2 reverses at 1.5 B parameters. Cross-domain pairs remain elevated across all sizes.

E. New York Times Articles Study We collected the performance counter and timing statistics of running GPT on New York Times articles from 2019, 2020, 2021, 2022, and 2023. GPT’s training cutoff was November 2019; hence, the article from 2019 is a possible member, or at least in-distribution, to GPT’s training set whereas the articles from 2020-2023 can not be. Figure 12 shows the result of this study, finding that the 2019 article exhibits 56% fewer off-core demand reads over the 2020-2023 articles and 12% fewer DTLB load misses, all while remaining within 1% of runtime bypassing constant-time defenses. Therefore, GPT is more familiar with the 2019 article than the other articles, fitting what we know about the training date cutoff.

Reads (×10−3 )

2019 2020 2021 2022 2023 (a) OFFCORE_REQUESTS.DEMAND_DATA_RD 7.5 6.0 −56%

4.5 3.0

Walk cycles (%)

(b) DTLB_LOAD_MISSES.WALK_PENDING 6.8 6.4 6.0 5.6

−12%

Cycles (×1010 )

(c) End-to-end timing 1.36 1.28 1.20 1.12 1.04

Constant time: max diff. 1.2%

2019

2020 2021 2022 2023 NYT article publication year

Fig. 12: NYT article inference on unmodified GPT / Sapphire Rapids, partitioned by publication year (2019 = potential member; 2020–2023 = non-member). (a) Off-core demand reads drop sharply for 2019 (∼90% lower). (b) TLB walkpending cycles show a parallel 12% reduction for 2019. (c) End-to-end timing remains constant to within 1.2%— constant-time defenses are blind to this channel.

V. M ICROARCHITECTURAL I NSIGHTS AND R EDESIGN G UIDANCE This paper does more than introduce a new family of side channels. Its deeper contribution is architectural: it provides one of the first detailed CPU-side characterisations of how production CNNs, LLMs, and vision transformers stress the

microarchitecture, how that stress changes with input familiarity, and how it evolves as model size scales. Across more than 290 hardware performance counters, along with latency, energy, and power, we show that training influence does not remain confined to model outputs—it reshapes the execution footprint of the processor itself. Production transformers do not stress the processor uniformly: training predictability and model scale reshape branch behavior, front-end delivery, TLB activity, cache locality, reservation-station occupancy, execution-port pressure, power, and latency across the full microarchitecture pipeline. These results therefore matter not only to privacy and security researchers, but also to performance architects and hardware designers, because each counter disparity is simultaneously a leakage signal and a clue about where modern AI workloads stress, underutilise, or destabilise the machine. Translation structures. Page-table walk completions for 2 MB/4 MB pages increase with BERT model size and separate familiar from novel inputs across all five parameter points. Transformer embedding-table access patterns stress the page-table walker far more than prior workloads—300+ walk completions per inference, each costing hundreds of cycles [61] This motivates embedding-aware TLB partitioning, large-page-backed embedding tables, and speculative pagewalk prefetch tuned to gather/scatter access patterns. Speculation recovery. Pipeline clears (d ≈ 0.84) and pipeline recovery cycles (d ≈ 0.73) differ between familiar and novel inputs even when wall-clock time does not—further evidence that the leakage operates below the timing floor and bypasses constant-time defenses. Future CPUs targeting LLM inference could benefit from “ML-phase” hints that adapt branch-predictor confidence thresholds for out-of-distribution inputs. Cache hierarchy and prefetch. Embedding-table scatter drives L3 miss counts and off-core demand reads for novel inputs; familiar inputs enjoy greater cache residency because the model has been conditioned to their token distribution. Prefetcher designs that recognize embedding-table stride signatures could reduce both miss rates and the locality-driven leakage that T RAN S COPE exploits. Scheduler pressure. Reservation-station empty cycles and store-buffer stalls vary with both model size and input familiarity, revealing phases where speculative work and memorylatency hiding interact with novelty-driven traffic. Power and energy. Per-inference power differs between familiar and novel inputs even when latency does not, constituting a leakage channel orthogonal to timing [62] as shown in Figure 3. Increasing training-set coverage reduces average inference energy; “training coverage” becomes a new axis in energy modeling of production LLM deployments. VI. R ELATED W ORK Software-based membership inference. The foundational MIA by Shokri et al. [6] used shadow models to infer membership from classification outputs. LiRA [8] improved attack power through likelihood-ratio tests. Label-only attacks [16]

BERT [26] — Structured v Random

GPT-2 [36] — Structured v Random Pythia [47] — Structured v Random

Params AUC 4M 11M 29M 41M 110M 340M

Acc. FPR

FNR

Params AUC

0.92 84% 0.14 0.95 89% 0.12 0.99 100% 0.01 0.99 100% 0.00 0.99 99% 0.01 1.00 100% 0.00

0.19 0.10 0.01 0.01 0.01 0.00

124M 355M 774M 1.5B – –

Acc. FPR FNR

0.99 96% 0.05 1.00 100% 0.01 0.98 93% 0.07 0.90 82% 0.16 – – – – – –

0.05 0.00 0.07 0.21 – –

Params AUC Acc. FPR

FNR

70M 160M 410M 1B 1.4B 2.8B

0.01 0.01 0.02 0.06 0.02 0.00

1.00 1.00 0.99 0.98 0.99 1.00

99% 99% 98% 94% 97% 99%

0.00 0.00 0.01 0.07 0.04 0.00

BERT IPEX [26] — Structured v Random BERT [26] — Enron v NIH

BERT [26] — NIH v Enron

Params AUC

Acc. FPR

FNR

Params AUC

Acc. FPR FNR

Params AUC Acc. FPR

FNR

4M 11M 29M 41M 110M –

81% 83% 88% 90% 93% –

0.22 0.15 0.11 0.09 0.10 –

4M 11M 29M 41M 110M 340M

69% 77% 80% 98% 97% 84%

4M 11M 29M 41M 110M 340M

0.38 0.28 0.17 0.13 0.20 0.16

0.89 0.91 0.95 0.96 0.98 –

0.16 0.20 0.13 0.10 0.04 –

0.75 0.84 0.88 1.00 1.00 0.92

0.35 0.15 0.20 0.00 0.02 0.12

0.28 0.31 0.21 0.03 0.03 0.19

0.73 0.80 0.89 0.87 0.88 0.90

67% 73% 80% 94% 80% 81%

0.29 0.27 0.22 0.14 0.20 0.22

TABLE III: T RAN S COPE attack statistics on production transformers.

showed that differential privacy [63] is the only effective defense. Subsequent work extended MIAs to recommender systems [64], federated learning [65], in-context learning [66], vision-language models [67], and LLMs [68]. All prior works require model outputs, confidence scores, running an expensive surrogate model, or multiple inferences; T RAN S COPE is the first cheap, one-shot out-of-distribution detector that does not require any model output or surrogate model. Hardware-assisted privacy attacks. GateBleed [13] exploits Intel AMX power-gating timing for MIA on adaptive networks. FeatureBleed [69] infers private attributes from sparsity-optimized accelerators. Timing-channel attacks [10] target adaptive neural networks with observable latency variation. T RAN S COPE is the first to demonstrate membership leakage on static, branchless, production networks where timing is constant and all prior hardware-assisted attacks fail. Property inference. Property inference attacks [70] determine undisclosed properties of training data. Extensions cover GANs [71], CNNs [72], graph neural networks [73], and federated learning [74]. T RAN S COPE subsumes property inference as a special case: when the “property” is membership in a temporal slice of a publisher’s archive, our hardware footprint provides direct evidence. Microarchitectural side channels. Prior work establishes that timing channels persist on formally verified kernels [75] and surveys the attack surface exhaustively [76]. Our finding that 15+ counter events discriminate training members from nonmembers while timing remains flat adds a new entry to that taxonomy: a software-optimization-mediated counter channel that operates below the timing floor. Our 290+ event trace dataset enables the community to compute formal channelcapacity bounds for each leaking event across three model families and two microarchitectures. Microarchitectural characterization of AI workloads. While this paper introduces a new series of side-channel techniques, its broader contribution is to expose the microarchitectural anatomy of modern AI execution on CPUs. Prior CPU

characterization studies have focused on traditional server workloads; no prior work has systematically profiled how training familiarity, input entropy, and model scale reshape the full microarchitecture pipeline—from branch prediction through TLB activity and cache locality to execution-port utilization and power. This paper is therefore not only a security result; it is also a microarchitectural characterization study of production AI workloads, with direct implications for future processor optimization and hardware design. Our traces show that transformer embedding lookups generate 300+ pagetable walk completions per inference on Sapphire Rapids, each costing hundreds of cycles—a bottleneck invisible to prior workload characterization and one that motivates embeddingaware TLB partitioning and large-page-backed embedding table layouts. VII. C ONCLUSION Membership inference is the root of privacy in modern AI. This paper establishes that hardware detectors can bypass state-of-the-art software defenses in constant time models, and alarmingly, these hardware-level leakage signals amplify as models—such as LLMs, Vision Transformers, and CNNs—scale and as new accelerators gets integrated in CPUS. Consequently, user privacy is fundamentally vulnerable at the hardware level. As AI becomes ubiquitous across all computing domains, and hardware accelerators becoming more integrated, relying solely on software defenses is no longer sufficient. T RAN S COPE takes the first step in analyzing how these privacy-compromising hardware signals manifest as we relentlessly scale and deploy these models or integrate aggressive on core acceleration for AI. R EFERENCES [1] M. Duan, A. Suri, N. Mireshghallah, S. Min, W. Shi, L. Zettlemoyer, Y. Tsvetkov, Y. Choi, D. Evans, and H. Hajishirzi, “Do membership inference attacks work on large language models?” arXiv preprint arXiv:2402.07841, 2024.

[2] M. Meeus, I. Shilov, S. Jain, M. Faysse, M. Rei, and Y.-A. de Montjoye, “Sok: Membership inference attacks on llms are rushing nowhere (and how to fix it),” in 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML). IEEE, 2025, pp. 385–401. [3] W. Shi, A. Ajith, M. Xia, Y. Huang, D. Liu, T. Blevins, D. Chen, and L. Zettlemoyer, “Detecting pretraining data from large language models,” arXiv preprint arXiv:2310.16789, 2023. [4] M. Meeus, S. Jain, M. Rei, and Y.-A. de Montjoye, “Did the neurons read your book? document-level membership inference for large language models,” in 33rd USENIX Security Symposium (USENIX Security 24), 2024, pp. 2369–2385. [5] Y. He, B. Li, L. Liu, Z. Ba, W. Dong, Y. Li, Z. Qin, K. Ren, and C. Chen, “Towards label-only membership inference attack against pretrained large language models,” in USENIX Security, 2025. [6] R. Shokri, M. Stronati, C. Song, and V. Shmatikov, “Membership inference attacks against machine learning models,” in 2017 IEEE Symposium on Security and Privacy (SP). IEEE, 2017, pp. 3–18. [7] B. Gras, K. Razavi, H. Bos, and C. Giuffrida, “Translation leak-aside buffer: Defeating cache side-channel protections with tlb attacks,” in USENIX Security, 2018. [8] N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis, and F. Tramer, “Membership inference attacks from first principles,” in 2022 IEEE symposium on security and privacy (SP). IEEE, 2022, pp. 1897–1914. [9] M. Yan, C. W. Fletcher, and J. Torrellas, “Cache telepathy: Leveraging shared resource attacks to learn DNN architectures,” in 29th USENIX Security Symposium (USENIX Security ’20), 2020, pp. 2003–2020. [10] A. Akinsanya and T. Brennan, “Timing channels in adaptive neural networks,” Proceedings 2024 Network and Distributed System Security Symposium, 2024. [Online]. Available: https://api.semanticscholar.org/ CorpusID:267617613 [11] Y. Liu, X. Lyu, D. Wang, Y. Li, and B. Xiao, “Lomia: Label-only membership inference attacks against pre-trained large vision-language models,” Advances in Neural Information Processing Systems, vol. 38, pp. 153 714–153 737, 2026. [12] Y. Peng, J. Roh, S. Maji, and A. Houmansadr, “Oslo: one-shot labelonly membership inference attacks,” Advances in Neural Information Processing Systems, vol. 37, pp. 62 310–62 333, 2024. [13] J. Kalyanapu, F. Dizani, D. Asher, A. Ghanbari, R. Cammarota, A. Aysu, and S. M. Ajorpaz, “Gatebleed: Exploiting on-core accelerator power gating for high performance and stealthy attacks on ai,” in Proceedings of the 58th IEEE/ACM International Symposium on Microarchitecture®, 2025, pp. 308–325. [14] M. Tong, Y. Du, K. Chen, W. Zhang, and N. Li, “Membership inference attacks on tokenizers of large language models,” arXiv preprint arXiv:2510.05699, 2025. [15] A. Srivastava, A. Menon, S. Das, and K. Basu, “Ghosttrace: A membership inference attack via hardware performance counters as a sidechannel,” in 2026 IEEE International Symposium on Hardware Oriented Security and Trust (HOST). IEEE, 2026, pp. 220–230. [16] C. A. Choquette-Choo, F. Tramer, N. Carlini, and N. Papernot, “Labelonly membership inference attacks,” in Proceedings of the 38th International Conference on Machine Learning, ser. Proceedings of Machine Learning Research, M. Meila and T. Zhang, Eds., vol. 139. PMLR, 18–24 Jul 2021, pp. 1964–1974. [17] T. Gunter, Z. Wang, C. Wang, R. Pang, A. Narayanan, A. Zhang, B. Zhang, C. Chen, C.-C. Chiu, D. Qiu et al., “Apple intelligence foundation language models,” arXiv preprint arXiv:2407.21075, 2024. [18] N. Oberst, D. Oberst, and M. Rao, “On-Device Agentic AI Workflows with Qualcomm Hexagon NPU and LLMWare.ai,” https://www.qualcomm.com/developer/blog/2026/05/local-agenticai-with-llmware-on-pcs-with-snapdragon-x-series, 2026, [Accessed 30-07-2026]. [19] O. Shafi, C. Rai, R. Sen, and G. Ananthanarayanan, “Demystifying tensorrt: Characterizing neural network inference engine on nvidia edge devices,” in 2021 IEEE International Symposium on Workload Characterization (IISWC). IEEE, 2021, pp. 226–237. [20] V. Pradeep, “Phi Silica, small but mighty on-device SLM — blogs.windows.com,” https://blogs.windows.com/windowsexperience/ 2024/12/06/phi-silica-small-but-mighty-on-device-slm/, 2024, [Accessed 30-07-2026]. [21] S. Chatterjee, “Expanding on-device AI in Microsoft Edge: New models and APIs for the web — blogs.windows.com,” https://blogs.windows.com/msedgedev/2026/06/02/expanding-on-

device-ai-in-microsoft-edge-new-models-and-apis-for-the-web/, 2026, [Accessed 30-07-2026]. [22] R. Bañez, Extending Creativity with Adobe Firefly: Create striking visuals, add text effects, and edit design elements faster with text prompts. Packt Publishing Ltd, 2024. [23] S. Teerapittayanon, B. McDanel, and H.-T. Kung, “Branchynet: Fast inference via early exiting from deep neural networks,” in 2016 23rd international conference on pattern recognition (ICPR). IEEE, 2016, pp. 2464–2469. [24] Y. Zhou, T. Lei, H. Liu, N. Du, Y. Huang, V. Zhao, A. M. Dai, Q. V. Le, J. Laudon et al., “Mixture-of-experts with expert choice routing,” Advances in Neural Information Processing Systems, vol. 35, pp. 7103– 7114, 2022. [25] H. Touvron, T. Lavril, G. Izacard, X. Martinet, M.-A. Lachaux, T. Lacroix, B. Rozière, N. Goyal, E. Hambro, F. Azhar et al., “Llama: Open and efficient foundation language models,” arXiv preprint arXiv:2302.13971, 2023. [26] J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “Bert: Pre-training of deep bidirectional transformers for language understanding,” arXiv preprint arXiv:1810.04805, 2018. [27] Intel-Corporation, “Accelerate AI with advanced matrix extensions (AMX),” https://www.intel.com/content/dam/www/central-libraries/us/ en/documents/2022-12/accelerate-ai-with-amx-sb.pdf, Dec. 2022. [28] S. M. Ajorpaz, D. Moghimi, J. N. Collins, G. Pokam, N. Abu-Ghazaleh, and D. Tullsen, “Evax: Towards a practical, pro-active & adaptive architecture for high performance & security,” in 2022 55th IEEE/ACM International Symposium on Microarchitecture (MICRO), 2022, pp. 1218–1236. [29] S. Mirbagher-Ajorpaz, G. Pokam, E. Mohammadian-Koruyeh, E. Garza, N. Abu-Ghazaleh, and D. A. Jiménez, “Perspectron: Detecting invariant footprints of microarchitectural attacks with perceptron,” in 2020 53rd Annual IEEE/ACM International Symposium on Microarchitecture (MICRO), 2020. [30] K. N. Khasawneh, N. Abu-Ghazaleh, D. Ponomarev, and L. Yu, “Rhmd: Evasion-resilient hardware malware detectors,” in Annual IEEE/ACM International Symposium on Microarchitecture, 2017. [31] P. Kocher et al., “Spectre attacks: Exploiting speculative execution,” in IEEE S&P, 2019. [32] C. Canella, J. Van Bulck, M. Schwarz, M. Lipp, B. von Berg, P. Ortner, F. Piessens, D. Evtyushkin, and D. Gruss, “A systematic evaluation of transient execution attacks and defenses,” in USENIX Security Symposium, 2019. [33] M. Lipp, M. Schwarz, D. Gruss, T. Prescher, W. Haas, J. Horn, S. Mangard, P. Kocher, D. Genkin, Y. Yarom et al., “Meltdown: Reading kernel memory from user space,” Communications of the ACM, vol. 63, no. 6, pp. 46–56, 2020. [34] C. Canella, D. Genkin, L. Giner, D. Gruss, M. Lipp, M. Minkin, D. Moghimi, F. Piessens, M. Schwarz, B. Sunar et al., “Fallout: Leaking data on meltdown-resistant CPUs,” in Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, 2019, pp. 769–784. [35] J. Van Bulck, D. Moghimi, M. Schwarz, M. Lipp, M. Minkin, D. Genkin, Y. Yuval, B. Sunar, D. Gruss, and F. Piessens, “LVI: Hijacking Transient Execution through Microarchitectural Load Value Injection,” in IEEE Symposium on Security and Privacy (S&P’20), 2020. [36] A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, I. Sutskever et al., “Language models are unsupervised multitask learners,” OpenAI blog, vol. 1, no. 8, p. 9, 2019. [37] A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly et al., “An image is worth 16x16 words: Transformers for image recognition at scale,” arXiv preprint arXiv:2010.11929, 2020. [38] N. Carlini, D. Ippolito, M. Jagielski, K. Lee, F. Tramer, and C. Zhang, “Quantifying memorization across neural language models,” in The Eleventh International Conference on Learning Representations, 2022. [39] P. Kocher, J. Horn, A. Fogh, D. Genkin, D. Gruss, W. Haas, M. Hamburg, M. Lipp, S. Mangard, T. Prescher, M. Schwarz, and Y. Yarom, “Spectre attacks: Exploiting speculative execution,” in IEEE Symposium on Security and Privacy (S&P), 2019. [40] D. Hendrycks and K. Gimpel, “A baseline for detecting misclassified and out-of-distribution examples in neural networks,” arXiv preprint arXiv:1610.02136, 2016.

[41] D. Amodei, C. Olah, J. Steinhardt, P. Christiano, J. Schulman, and D. Mané, “Concrete problems in ai safety,” arXiv preprint arXiv:1606.06565, 2016. [42] National Transportation Safety Board, “Collision between vehicle controlled by developmental automated driving system and pedestrian, tempe, arizona, march 18, 2018,” National Transportation Safety Board, Washington, DC, Highway Accident Report NTSB/HAR19/03, 2019. [Online]. Available: https://www.ntsb.gov/investigations/ AccidentReports/Reports/HAR1903.pdf [43] ——, “Collision between a car operating with automated vehicle control systems and a tractor-semitrailer truck near williston, florida, may 7, 2016,” National Transportation Safety Board, Washington, DC, Highway Accident Report NTSB/HAR-19/03, 2016. [Online]. Available: https: //www.ntsb.gov/investigations/AccidentReports/Reports/HAR1702.pdf [44] “Getty images (us) inc and others v. stability ai ltd [2025] ewhc 38 (ch),” neutral citation: [2025] EWHC 38 (Ch). [Online]. Available: https: //www.judiciary.uk/judgments/getty-images-and-others-v-stability-ai/ [45] Reuters, “Apple sued by authors over use of books in ai training,” Reuters, accessed: 2025-09-17. [46] B. Wu, C. Xu, X. Dai, A. Wan, P. Zhang, Z. Yan, M. Tomizuka, J. Gonzalez, K. Keutzer, and P. Vajda, “Visual transformers: Tokenbased image representation and processing for computer vision,” 2020. [47] S. Biderman, H. Schoelkopf, Q. G. Anthony, H. Bradley, K. O’Brien, E. Hallahan, M. A. Khan, S. Purohit, U. S. Prashanth, E. Raff et al., “Pythia: A suite for analyzing large language models across training and scaling,” in International conference on machine learning. PMLR, 2023, pp. 2397–2430. [48] “Thomson reuters enterprise centre gmbh v. ross intelligence inc.” p. 467. [49] “Doe 1 v. github, inc.” p. 837. [50] “Andersen v. stability ai ltd.” p. 853. [51] “Concord music group, inc. v. anthropic pbc,” p. 973. [52] “Umg recordings, inc. v. suno, inc.” [53] M. M. Grynbaum and R. Mac, “The times sues openai and microsoft over ai use of copyrighted work,” The New York Times, vol. 27, no. 1, 2023. [54] “Bartz v. anthropic pbc,” p. 1007. [55] “Kadrey v. meta platforms, inc.” p. 1026. [56] C. T. Hutchinson and D. S. Ashby, “Daubert v. merrell dow pharmaceuticals, inc.: redefining the bases for admissibility of expert scientific testimony,” Cardozo L. Rev., vol. 15, p. 1875, 1993. [57] A. L. Maas, R. E. Daly, P. T. Pham, D. Huang, A. Y. Ng, and C. Potts, “Learning word vectors for sentiment analysis,” in Proceedings of the 49th Annual Meeting of the Association for Computational Linguistics: Human Language Technologies. Portland, Oregon, USA: Association for Computational Linguistics, June 2011, pp. 142–150. [Online]. Available: http://www.aclweb.org/anthology/P11-1015 [58] L. Gao, S. Biderman, S. Black, L. Golding, T. Hoppe, C. Foster, J. Phang, H. He, A. Thite, N. Nabeshima et al., “The pile: An 800gb dataset of diverse text for language modeling,” arXiv preprint arXiv:2101.00027, 2020. [59] J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large-scale hierarchical image database,” in 2009 IEEE conference on computer vision and pattern recognition. Ieee, 2009, pp. 248–255. [60] P. J. Mucci, S. Browne, C. Deane, and G. Ho, “Papi: A portable interface to hardware performance counters,” in Proceedings of the department of defense HPCMP users group conference, vol. 710, 1999, pp. 7–10. [61] K. Loughlin, I. Neal, J. Ma, E. Tsai, O. Weisse, S. Narayanasamy, and B. Kasikci, “{DOLMA}: Securing speculation with the principle of transient {Non-Observability},” in 30th USENIX Security Symposium (USENIX Security 21), 2021, pp. 1397–1414. [62] M. Lipp, A. Kogler, D. Oswald, M. Schwarz, C. Easdon, C. Canella, and D. Gruss, “Platypus: Software-based power side-channel attacks on x86,” 05 2021, pp. 355–371. [63] M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’16. New York, NY, USA: Association for Computing Machinery, 2016, p. 308–318. [Online]. Available: https://doi.org/10.1145/2976749.2978318 [64] M. Zhang, Z. Ren, Z. Wang, P. Ren, Z. Chen, P. Hu, and Y. Zhang, “Membership inference attacks against recommender systems,” in Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, 2021, pp. 864–879.

[65] H. Chang, B. Edwards, A. S. Paul, and R. Shokri, “Efficient privacy auditing in federated learning,” in 33rd USENIX Security Symposium (USENIX Security 24), 2024, pp. 307–323. [66] R. Wen, Z. Li, M. Backes, and Y. Zhang, “Membership inference attacks against in-context learning,” in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, 2024, pp. 3481–3495. [67] Y. Hu, Z. Li, Z. Liu, Y. Zhang, Z. Qin, K. Ren, and C. Chen, “Membership inference attacks against {Vision-Language} models,” in 34th USENIX Security Symposium (USENIX Security 25), 2025, pp. 1589–1608. [68] L. Rossi, M. Aerni, J. Zhang, and F. Tramèr, “Membership inference attacks on sequence models,” in 2025 IEEE Security and Privacy Workshops (SPW). IEEE, 2025, pp. 98–110. [69] D. Asher, F. Dizani, J. Kalyanapu, R. Cammarota, A. Aysu, and S. M. Ajorpaz, “Featurebleed: Inferring private enriched attributes from sparsity-optimized ai accelerators,” IEEE Computer Architecture Letters, 2026. [70] K. Ganju, Q. Wang, W. Yang, C. A. Gunter, and N. Borisov, “Property inference attacks on fully connected neural networks using permutation invariant representations,” in Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’18. New York, NY, USA: Association for Computing Machinery, 2018, p. 619–633. [71] J. Zhou, Y. Chen, C. Shen, and Y. Zhang, “Property inference attacks against gans,” arXiv preprint arXiv:2111.07608, 2021. [72] M. P. Parisot, B. Pejo, and D. Spagnuelo, “Property inference attacks on convolutional neural networks: Influence and implications of target model’s complexity,” arXiv preprint arXiv:2104.13061, 2021. [73] X. Wang and W. H. Wang, “Group property inference attacks against graph neural networks,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, 2022, pp. 2871–2884. [74] Z. Wang, Y. Huang, M. Song, L. Wu, F. Xue, and K. Ren, “Poisoningassisted property inference attack against federated learning,” IEEE Transactions on Dependable and Secure Computing, vol. 20, no. 4, pp. 3328–3340, 2022. [75] D. Cock, Q. Ge, T. Murray, and G. Heiser, “The last mile: An empirical study of timing channels on sel4,” in Proceedings of the 2014 ACM SIGSAC conference on computer and communications security, 2014, pp. 570–581. [76] Q. Ge, Y. Yarom, D. Cock, and G. Heiser, “A survey of microarchitectural timing attacks and countermeasures on contemporary hardware,” Journal of Cryptographic Engineering, 2018.

Related documents

• TranScope: What the Software Hides About LLM Training Data, the Hardware Reveals at Scale, and Accelerators Magnify#1215927
• Penrose: Privacy-Preserving Performance Profiling of In-The-Wild GPUs#1062797
• Detecting Hidden ML Training With Zero-Overhead Telemetry#287122
• FlashMoE: Fast Distributed MoE in a Single Kernel#1142540
• Privacy Auditing with Zero (0) Training Run#998229