PolicySniff: Inferring Agent Policy States through Shared-GPU Execution

Summary

PolicySniff is a side-channel attack that infers an LLM agent's approval-policy setting, such as whether it asks before a consequential tool call, by timing only the attacker's own GPU kernels on a shared GPU. On an eager sparse mixture-of-experts runtime, a frozen and blinded study identified the deployed setting at 94.17% balanced accuracy on its primary estimand, reaching 88.82% where both settings yield the same decision and 91.98% where they differ.

Mitigation

The source recommends that deployments keeping their approval setting private measure its distinguishability on the serving runtime and enforce authorization outside the model.

Related items

• MediumCVE-2026-127202: MLflow path traversal through model_id in the log outputs APISimilar attack · NVD/CVE Database
• LowAI chatbots are recommending fake retail websites, study findsSimilar attack · The Verge (AI)
• MediumPalo Alto tracks a massive Chinese AI attack that sadly lives up to industry fearsSimilar attack · CSO Online
• MediumAttackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society SectorsSimilar attack · Palo Alto Unit 42
• MediumCVE-2026-126994: braindecode model config deserialization flaw via activation argumentSimilar attack · NVD/CVE Database