Token timing alone fingerprints a closed model's architecture.

Majidi, Mireshghallah, and Taram demonstrate the first attacks inferring proprietary model and deployment details from per-token generation timing over a remote API (arXiv 2607.20723). One attack detects whether a provider runs speculative decoding and recovers the draft model's context length, measuring Google Gemini Flash 2.5 at roughly a 128K-token draft window. The other recovers layer count, hidden dimension, and attention-head count by modeling latency on NVIDIA GPUs, landing the near-correct Llama configuration in the top-10 more than 90% of the time. Streaming APIs are a side channel. Nothing about the response content has to leak.