🤖 machine learning

Quantamination: Dynamic Quantization Leaks Your Data Across the Batch

This paper introduces "Quantamination," a critical vulnerability in dynamic quantization where improper implementation in popular ML frameworks creates side channels that allow adversaries to steal sensitive user data from other inputs within the same processing batch.

Original authors: Hanna Foerster, Ilia Shumailov, Cheng Zhang, Yiren Zhao, Jamie Hayes, Robert Mullins

Published 2026-04-30

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Hanna Foerster, Ilia Shumailov, Cheng Zhang, Yiren Zhao, Jamie Hayes, Robert Mullins

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are at a busy coffee shop where the barista (the AI server) has to make drinks for two customers at the same time to save time. To make things faster, the barista uses a special "quick-measure" cup instead of a precise scale. This is called dynamic quantization.

Here is the problem the paper found: The barista doesn't measure each cup individually. Instead, they look at both customers' drinks together to decide how big the "quick-measure" cup should be for that specific moment.

The "Shared Cup" Problem

In the world of AI, when two people ask a computer to process their data at the exact same time (a "batch"), the computer often calculates a single setting for both of them based on the largest numbers it sees in the combined pile.

The Victim: A regular user sending a secret message.
The Attacker: A sneaky user sending a fake message right next to the victim's.

Because the computer calculates the "cup size" based on the combined data, the victim's secret numbers actually change the size of the cup used for the attacker's data. It's like if the barista had to hold a giant bucket for the victim's huge order, and that bucket was so big it made the attacker's tiny espresso taste slightly different than it usually would.

The "Leak" (Quantamination)

The paper calls this "Quantamination" (a mix of "quantization" and "contamination").

The attacker knows exactly what their own drink should taste like. But because the "cup size" was changed by the victim's secret data, the attacker's drink tastes a tiny bit weird. By tasting that weirdness, the attacker can work backward to guess what the victim's secret data was.

What the Attackers Can Do

The researchers tested this in two main scenarios:

Reading Secret Messages (LLMs):
Imagine the victim is typing a secret sentence, one word at a time. The attacker sends their own words alongside the victim's.
- The Result: The attacker was able to guess the victim's secret words with 99.6% to 100% accuracy. It was like the attacker could hear the victim whispering their password through the wall, just by listening to how their own voice echoed back.
- How fast? It took a few hundred tries for the first word, but once they knew the first word, the next words became much easier to guess, like solving a crossword puzzle where you already have the first few letters.
Identifying Images (Classification):
Imagine the victim uploads a secret photo of a cat, and the attacker uploads a photo of a dog.
- The Result: If the attacker had a library of 10,000 photos to choose from, they could almost always pick out the exact photo the victim uploaded.
- The Catch: If the attacker didn't have the exact photo in their library, they could only guess the category (e.g., "It's probably a cat") with low accuracy. The "noise" from the computer was too strong to pinpoint the exact image without a direct match.

Why This Happens (The "Why" of the Coffee Shop)

Most modern AI systems are designed to be super efficient. They often use a method called "Per-Tensor" quantization for speed. This means they look at the whole batch of data to set the rules.

The paper found that popular tools like vLLM, SGLang, ONNX Runtime, and PyTorch often use this "look at the whole batch" method by default or as an easy option. This creates a hidden channel where one person's data leaks into another person's results.

The Good News

The paper also points out a simple fix. If the system uses "Per-Token" quantization (measuring each word or item individually before mixing them), the leak disappears. It's like giving every customer their own precise scale, so the giant bucket for the other customer doesn't affect them.

Many modern systems already use this safer method for standard text models, but the dangerous "whole batch" method is still the default for some specific high-speed settings (like FP8) and general-purpose tools.

The Real-World Hurdle

The paper admits that in the real world, this attack is a bit harder to pull off than in their lab.

The "Static" Noise: Real servers aren't perfectly quiet. Sometimes the computer's hardware or the software's random choices make the "taste" of the drink vary slightly even without a leak.
The "Temperature" Issue: Even if a user asks for a "perfectly deterministic" (no randomness) result, the server provider might add their own secret sauce or sampling methods that mess up the perfect pattern the attacker needs to see.

Summary

Dynamic quantization is a speed trick that saves money and time for AI companies. However, when it mixes two people's data together to set its rules, it accidentally creates a side channel. A sneaky user can listen to how their own data changes because of a stranger's secret data, allowing them to steal that secret. The fix is to stop mixing the measurements and measure each person's data individually.

1. Problem Statement

The paper identifies a critical privacy vulnerability in dynamic quantization strategies used in modern machine learning inference frameworks.

Context: To optimize GPU utilization and reduce memory costs, multi-tenant LLM serving frameworks (e.g., vLLM, SGLang) batch concurrent user requests. To further accelerate inference, these systems often employ dynamic quantization, which converts high-precision activations (FP16/FP32) to lower precision (INT8/FP8) at runtime.
The Vulnerability: Unlike static quantization (where parameters are fixed offline), per-tensor dynamic quantization computes scaling parameters (min/max values) based on the entire batch of inputs simultaneously.
The Consequence: This creates a cross-user side channel. The victim's input data influences the quantization parameters applied to the adversary's input. By observing perturbations in their own output logits, an adversary can infer sensitive information about the victim's data co-located in the same batch. The authors term this phenomenon "Quantamination."

2. Methodology

The authors propose a side-channel attack that exploits the data-dependent nature of per-tensor dynamic quantization.

Threat Model

Adversary Capabilities: The attacker can inject a crafted input into a batch containing a victim's secret input (batch co-location). They can observe the model's output (logits or top-1 log probabilities) for their own input.
Assumptions: The attack assumes the system uses per-tensor dynamic quantization (computing one scale factor for the whole batch) rather than per-token (computing a scale factor for each token individually).
Settings: The attack is evaluated in both White-box (local model access) and Black-box (API access) scenarios.

Attack Mechanics

Quantization Parameter Leakage: In per-tensor dynamic quantization, the scale factor $\alpha$ is calculated as:
$\alpha = \frac{\max(X) - \min(X)}{255}$
where $X$ is the combined activation tensor of the batch. If the victim's input has a larger magnitude than the adversary's, it dominates the $\max$ or $\min$ , altering $\alpha$ .
Observation: The adversary observes the resulting change in their own output logits ( $\Delta$ ) caused by the altered quantization.
Recovery Strategy:
- LLM Token Recovery: The adversary iteratively guesses the victim's tokens. For each position, they test candidate tokens from the vocabulary. The candidate that produces a logit difference ( $\Delta$ ) matching the observed difference when paired with the victim is selected as the recovered token.
- Classification: The adversary compares the logit differences of a victim's image against a candidate set of images to find the closest match or infer the class.

3. Key Contributions

Discovery of "Quantamination": The first demonstration that per-tensor dynamic quantization creates a side channel allowing data leakage across batch boundaries in shared inference environments.
Framework Analysis: The authors surveyed major inference frameworks and found that at least 4 popular frameworks (vLLM, SGLang, ONNX Runtime, PyTorch) either default to or support configurations using vulnerable per-tensor dynamic quantization, particularly in FP8 online modes.
Practical Attack Implementation: They developed and validated attacks for both Large Language Models (token recovery) and Image Classification (class/image identification).
Differentiation from Prior Work: Unlike previous batch-based attacks that rely on MoE routing, KV cache sharing, or federated learning gradients, this attack requires no architectural modification and exploits a fundamental property of standard inference quantization.

4. Experimental Results

A. LLM Token Recovery

The attack was tested on three models (TinyStories-1M, Pythia-70M, SmolLM2-135M) using batch size 2.

Accuracy: Achieved 99.6% to 100% token recovery accuracy across all models.
Efficiency:
- For in-distribution data (e.g., TinyStories on TinyStories data), the attack required an average of 424 queries per token, which is 59× faster than random search.
- For general-purpose models (Pythia, SmolLM2) on WikiText, efficiency was 985–1,343 queries per token (18–25× faster than random).
- Context Acceleration: The first token is the most expensive to recover, but subsequent tokens benefit from autoregressive context, drastically reducing the search space.
Black-Box Feasibility: The attack remains effective even with limited API access (observing only top-1 log probabilities), assuming greedy decoding.

B. Classification Image Recovery

Tests were conducted on MNIST using Simple CNN, ResNet18, and ResNet50.

Exact Recovery: When the secret image existed in the candidate set, recovery rates were 80–100%, with deeper networks (ResNet18/50) achieving 100% success even with random probes.
Class Inference: When the secret was not in the candidate set, the attack struggled to identify the exact class (10–16% accuracy vs. 10% random baseline). However, t-SNE analysis revealed that quantization scales do cluster by class, suggesting that while exact recovery is hard without a candidate set, class-level leakage is detectable in deep networks.

5. Significance and Implications

Privacy Risk: The vulnerability poses a severe risk to multi-tenant ML serving. An adversary can potentially reconstruct private prompts, sensitive documents, or proprietary data from other users sharing the same GPU batch.
Performance vs. Security Trade-off: The paper highlights that per-tensor dynamic quantization is not only suboptimal for accuracy (due to poor handling of heterogeneous activation distributions) but also introduces a concrete security vulnerability.
Mitigation: The authors recommend switching to per-token dynamic quantization, which computes scaling parameters independently for each token. This eliminates the cross-batch information flow and is already the standard for INT8 in many LLM frameworks.
Real-World Challenges: The discussion notes that production environments may introduce non-determinism (hardware heterogeneity, provider-side sampling pipelines) that could obscure the signal, potentially making the attack harder but not impossible to execute.

Conclusion

The paper demonstrates that per-tensor dynamic quantization is a critical security flaw in modern ML serving. By leaking information about co-batched inputs through quantization parameters, it allows adversaries to steal sensitive user data. The authors urge framework developers to default to per-token quantization to ensure both high accuracy and user privacy.