LeakyLMs Fingerprints a Closed Model's Architecture From Token Timing Alone — and Detects Gemini Flash 2.5's ~128K Draft Context

arXiv 2607.20723·high signalXBlueskyLinkedInCopy link

Sadegh Majidi, Niloofar Mireshghallah, and Kazem Taram demonstrate the first attacks that infer proprietary model and deployment details using only per-token generation timing over a remote API. One attack detects whether a provider runs speculative decoding and recovers the draft model's context length — measuring Google Gemini Flash 2.5 at roughly a 128K-token draft window; the other recovers layer count, hidden dimension, and attention-head count by modeling token-generation latency on NVIDIA GPUs and searching the architecture space, landing the near-correct Llama configuration in the top-10 guesses more than 90% of the time. Streaming APIs are a side channel, and nothing about the response content needs to leak for the architecture to.