Local LLM inference is not private: an EM probe beside a Raspberry Pi recovers generated tokens and prompts

When a large language model runs locally on an edge device, what it generates leaks through the processor's electromagnetic emissions, and an adversary needs only a near-field probe placed nearby, with no access to software, memory, or network. Earlier side-channel work on large language models used cache access patterns or network traffic, which require shared hardware resources or observation of encrypted traffic and do not apply to an adversary who has only physical proximity to an offline edge device. With LLaMA-3.2-1B-Instruct running on a Raspberry Pi 5, a near-field magnetic loop probe placed over the BCM2712 processor captured electromagnetic traces during inference, and a Welch t-test confirmed statistically detectable differences between trace populations for different tokens.

The leakage sits in the computation window of the language model's output-head matrix multiplication, and once that electromagnetic signal is turned into a time-frequency image, an ordinary convolutional network can read the word out of it. Feeding the same raw one-dimensional signal directly to one-dimensional networks stayed at 5 to 7 percent accuracy no matter how the network was widened, deepened, or scaled to a billion-parameter multilayer perceptron, barely above random guessing. Converting the signal to a short-time Fourier transform spectrogram and reusing an ImageNet-pretrained ResNet-18 reached 97.2 percent top-1 accuracy over 50 health- and privacy-related keywords, against 98.3 percent for the same configuration on a 30-class pilot.

Beyond classifying known words, the internal hidden state can be estimated from the electromagnetic traces and multiplied by the public vocabulary matrix to rank candidate tokens across the entire 128k-token vocabulary. A closed-set classifier can only choose among the 50 words it has seen and maps unfamiliar words to known classes with high confidence, so it cannot cover the arbitrary text a deployed model actually generates. An EfficientNet-B0 regressing the hidden state reached 94.3 percent top-1 and a median rank of 1 over the full vocabulary on profiled words; for unseen words, switching to full-vocabulary cross-entropy with a hardest-negative margin raised top-100 recovery from 11.8 to 67.0 percent and cut the median rank from 1327 to 54.

The recovered hidden state can also be inverted to reconstruct the semantic content of the user prompt, because self-attention makes each step's representation summarize all preceding input. Earlier work on recovering text from model internals assumed direct software access to representations or outputs, whereas here the target representation must first be estimated from physical leakage. A two-layer feed-forward network projects the 2048-dimensional hidden state into 48 vectors that drive a pretrained T5-base encoder-decoder to generate the prompt token by token; with all 17 capture templates excluded from training, reconstructed prompts matched the original private prompt with high mean cosine similarity and the embedded secret keyword was extracted in 88.7 percent of traces.

The report covers LLaMA-3.2-1B-Instruct running on the Cortex-A76 CPU of a Raspberry Pi 5 through llama.cpp with Q4_K_M quantization, with the adversary assumed to hold only a near-field electromagnetic probe, collect passively, and never touch device software. Capture used a GPIO trigger for alignment and a fixed 1500 MHz CPU frequency, and that trigger is used only for experimental alignment, not assumed available during the attack. The authors propose extending the method to GPU deployments and suggest electromagnetic shielding, execution randomization, and output-head masking as defense directions.

The authors note that real deployments bring cross-session variation and dynamically shifting CPU frequencies; the former can be mitigated by profiling across sessions and aligning with template cross-correlation, the latter with more specialized measurement equipment. The study is limited to CPU inference, and GPU deployments may be harder for the attacker because of higher clocks and more parallelism. For unseen words top-1 remains 0 percent, with recovery landing in the semantic neighborhood, for example predicting doctor or patient for the unseen word clinic; in prompt inversion, about 11.3 percent of mismatches appear as truncated target words.