New Attack Infers LLM Architecture from Restrictive APIs

A new research paper introduces "NightVision," an innovative attack designed to infer the architectural specifics of Large Language Models (LLMs) even when API access is severely limited. Previous methods for recovering architectural details, such as hidden dimensions, relied on access to top-k logits or logit bias functions, which most commercial LLM providers have since restricted. NightVision overcomes these restrictions by employing a novel "common set prompting" technique. This involves crafting multiple prompts that expose log probabilities for the same set of output tokens. A subsequent spectral analysis of these results allows for the inference of the LLM's hidden dimension. Additionally, the attack leverages end-to-end time-to-first-token (TTFT) measurements, combined with the estimated hidden dimension, to further estimate the model's depth and total parameter count. Empirical evaluations on 32 open-source LLMs demonstrated that NightVision can recover hidden dimensions with an average relative error of 23% (9% for MoE models) and depth/parameter count within 53% for models exceeding three billion parameters, suggesting that current API restrictions are insufficient to fully obscure underlying model architectures.