Cross-Tenant Data Exfiltration in Azure OpenAI via Fine-Tuned Model Side-Channel Attack
Overview
Researchers from the University of Cyberspace Security published a paper demonstrating a novel side-channel attack against multi-tenant cloud AI services, specifically targeting Azure OpenAI's fine-tuning and deployment infrastructure. The attack, named 'Whispering Giant', allows a malicious actor in one tenant to potentially exfiltrate sensitive data from another tenant's model inferences running on the same underlying physical GPU hardware. The attack requires the adversary to first deploy their own specially crafted, fine-tuned LLM. This malicious model is designed to create specific patterns of GPU memory access and cache utilization. By continuously monitoring the performance and timing of its own model's inference requests, the attacker can detect subtle fluctuations caused by the memory access patterns of a victim's model running concurrently on the same GPU. Over thousands of observations, these fluctuations can be statistically analyzed to reconstruct fragments of the victim's input data or model outputs, such as proprietary source code, PII, or financial data. While the attack is complex and has a low bandwidth, it proves that the logical isolation between tenants in some shared AI infrastructure can be breached at the hardware level, posing a critical risk for organizations handling sensitive information.
Affected Systems
Testing Guide
Directly testing for this vulnerability is not feasible for customers as it requires control over model placement on physical hardware and sophisticated statistical analysis. The primary action is to review your service configuration: 1. Log in to your Azure portal and navigate to your Azure OpenAI resource. 2. Check the pricing tier and deployment options for your models. 3. Determine if you are using a shared or dedicated hosting model. 4. If using a shared model for processing highly sensitive data, re-evaluate the risk and consider migrating to a dedicated option.
Mitigation Steps
1. **Use Dedicated Resources:** For highly sensitive workloads, provision dedicated instances or clusters instead of using the default shared, multi-tenant infrastructure. This ensures physical hardware isolation. 2. **Data Obfuscation:** Apply data masking, tokenization, or encryption to sensitive data *before* sending it to the LLM for processing. This ensures that even if data is exfiltrated, it is not in a readable format. 3. **Monitor Inference Metrics:** Monitor for anomalous inference latency or performance patterns on your deployed models, which could be an indicator of a co-located, noisy, or malicious neighbor model. 4. **Request Information from Cloud Provider:** Engage with your cloud provider (e.g., Microsoft) to understand their specific hardware isolation guarantees and mitigations against such side-channel attacks.
Patch Details
Microsoft has implemented enhanced scheduling algorithms and hardware-level countermeasures in their backend infrastructure to mitigate this class of attack as of Q1 2026.