Encrypted Conversations, Recognizable Workflows: What AI Traffic Reveals

TL;DR for operators

Encrypted LLM connections can conceal prompts and responses while exposing recognizable patterns of AI activity. In a controlled benchmark, classifiers using only encrypted response metadata identify broad prompt categories with 67.37% mean accuracy, against a 16.67% chance baseline. Traffic from collaborative agents also reveals task categories, including when only part of the team’s communication is visible.

The strongest signals include packet bursts, response timing, and sequences of model calls. This creates a security consideration for organizations whose choice of AI model or type of work is commercially sensitive.

Operational decision: Treat traffic-metadata confidentiality as a separate requirement from message-content encryption. Evaluate the actual serving architecture, observer visibility, and candidate defenses before assuming that published attack accuracies apply to production.

The prompt stays encrypted, but its category may not

Consider an organization using encrypted LLM connections for research, software development, and internal decision support. An observer monitoring network traffic cannot read its prompts or generated answers. The organization may therefore assume that outsiders cannot distinguish these activities.

Yet communication still produces observable information: how many packets move, how large they are, which direction they travel, and when they arrive.

In A Large-Scale Benchmark and Risk Assessment of Traffic Analysis Attacks on Cloud LLM Services, Pouryousef and colleagues examine how much those observations disclose.¹ Their study constructs a common benchmark for three prediction problems: identifying the deployed LLM, classifying a user’s prompt category, and identifying the task performed by a collaborative agent team.

The direct-interaction dataset contains 60,000 encrypted traffic traces: 60 distinct prompts spanning six categories, submitted to ten locally hosted models with 100 repetitions per model–prompt combination. The researchers train supervised classifiers and evaluate them using grouped partitions that keep identical prompts out of both training and test sets.

A particularly revealing test removes request-side traffic from the prompt classifier. This prevents the classifier from exploiting the relatively direct relationship between prompt length and encrypted request size.

Using 22 response-only features, the classifiers achieve 67.37% mean accuracy across ten model-specific classifiers, compared with 16.67% under random guessing (Section V-A3, Table II). Request-only features achieve 51.68%, while the full traffic representation achieves 65.10% under the reported evaluation.

The response-only result establishes that observable effects of generation contain information about the prompt’s broad semantic category. It does not mean the attacker can reconstruct the prompt or recover sensitive words. The classifier chooses among six predefined categories, including summarization, code generation, and mathematical reasoning.

Packet bursts reveal more than total traffic volume

The mechanism becomes clearer when the researchers examine which network features predict the serving model.

LLMs generate text incrementally. The serving system converts generated material into streamed messages and encrypted network packets. Differences in response length, generation timing, streaming implementation, and packetization can produce recognizable traffic patterns.

A burst is a group of packets arriving close together. Burst features describe properties such as the group’s size, direction, duration, and spacing. They preserve information about the progression of an interaction that a simple total-byte count loses.

The model-identification ablation makes this measurable (Section V-A2, Table I):

These are mean accuracies from five prompt-grouped folds using one repetition per model–prompt pair. The feature families contain different numbers of variables, so the family-only comparison is not controlled for feature count.

Nevertheless, the ablation supplies two complementary findings. Burst structure is sufficient for high classification performance in this setting, and removing it reduces the full representation’s accuracy by 9.34 percentage points.

An additional information-theoretic analysis estimates 3.02 bits of model-identity leakage from response burst-byte features, against approximately 3.32 bits of maximum entropy for ten equally likely models (Section V-A5, Figure 6). This estimate depends on density estimation, feature selection, and conditional-independence approximations; it is not a direct measurement of decrypted information.

There is also an attribution boundary. The fingerprint characterizes the deployed model-serving system, not model weights alone. Architecture, tokenization, post-training, generated output, and streaming implementation jointly contribute to the observed signal. High identification accuracy therefore cannot establish that network traffic uniquely reveals an underlying model architecture.

Multi-agent coordination exposes the structure of work

A collaborative AI system creates a different opportunity for observation.

Instead of one request producing one response, specialized agents may make successive model calls, exchange work through an orchestration framework, and repeat operations until a task finishes. Even when their internal messages remain hidden, the timing and progression of their calls can reflect the work being performed.

The authors investigate this using MARBLE/MultiAgentBench, ten task categories, teams of two to five agents, and graph-mesh and star coordination topologies. All agents use a locally hosted Llama 3.2 3B model.

With 247 traffic features, task-category classifiers achieve 85.3% balanced accuracy for graph coordination and 86.0% for star coordination, against a 10% chance level (Section V-B, Figure 7).

The more informative experiment removes packet-size, byte-volume, and burst-byte features. The remaining workflow-oriented features still achieve 54.0% and 58.7% balanced accuracy for graph and star arrangements, respectively.

This feature-restriction test isolates an additional source of predictive information: the observable sequence and timing of collaborative activity. Concealing message sizes alone may leave substantial workflow information exposed.

Nor does the attacker necessarily need visibility into every agent. With only one agent’s model traffic available, task-identification accuracy reaches 66.5% in graph coordination and 78.0% in star coordination (Section V-B, Figure 8(b)).

For an enterprise operating distributed agents, this suggests that protecting internal orchestration messages may be insufficient if individual agents’ external model communications remain observable.

Fingerprints depend on the system being observed

The paper’s robustness experiments qualify the high baseline accuracies. They examine whether identification persists when inputs, decoding behavior, candidate models, or coordination arrangements change.

Sources: Section V-B, Figure 8(a); Section V-C, Figure 9. These are distinct experimental configurations, not interchangeable estimates of one attack’s accuracy.

The candidate-model experiment also compares a smaller 35-feature baseline, whose accuracy falls from 76.0% to 48.8%. Feature representation therefore materially affects the measured scalability of fingerprinting.

These tests are not demonstrations of comprehensive privacy defenses. They show that metadata leakage is sensitive to the generation and coordination conditions under which traffic is produced.

What infrastructure owners should evaluate

For organizations using external LLM services, the immediate question is which activities would be sensitive if an observer could classify them.

A procurement team assessing a hosted model should distinguish contractual assurances about encrypted content from any assurances about usage-pattern confidentiality. The paper motivates asking whether packet timing, response streaming, and traffic volumes expose identifiable service characteristics. It does not establish that a particular commercial provider is vulnerable at the reported rates.

For an AI platform team designing collaborative workflows, the exposure assessment should extend beyond individual model calls. If a research, coding, or legal-analysis workflow is sensitive as an activity category, partial visibility into agent traffic may also warrant protection.

Potential mitigations operate at different layers. Application-level reformulation changes generation behavior; serving-level batching may alter response emission; network-level padding and traffic shaping may obscure observable size and timing patterns.

The paper discusses these possibilities but does not experimentally establish comprehensive protection from padding, batching, dummy traffic, or adaptive shaping. Their bandwidth, latency, and operational costs also require measurement.

A defensible engineering approach is to test representative workloads under the organization’s actual network and serving conditions, then compare classification leakage and performance overhead before selecting controls.

What the benchmark does not establish

The study assumes a closed-world adversary: an observer trained on labeled traffic from known candidate models or tasks, who can correctly isolate individual interactions and executions. It does not evaluate uncertain trace segmentation or arbitrary unknown activities.

Its models run in a controlled local serving environment, not across a representative population of heterogeneous commercial cloud deployments. Sixty distinct direct-interaction prompts also provide less semantic diversity than the 60,000 repeated traces might initially suggest.

The collaborative experiments use a common model, two coordination topologies, and predefined tasks. The weaker cross-topology results reinforce the need to test deployment-specific conditions.

Finally, the paper reports 2,838 multi-agent executions in its abstract but separately describes 3,970 successful executions with valid traffic captures in Section IV-A. Those counts are not explicitly reconciled in the supplied research record. Headline accuracy figures likewise differ from several detailed experiments, making protocol-specific reporting essential.

These limits do not negate the measured leakage. They determine how confidently the results can be transferred to operational systems.

Confidentiality must include observable behavior

The benchmark establishes that encrypted AI traffic can reveal more about computation and collaboration than message-content security alone would suggest. Burst patterns help identify deployed serving systems; response characteristics reveal broad prompt categories; and sequences of agent calls can disclose collaborative tasks.

For infrastructure owners, the next decision is not whether to abandon encryption. It is whether the confidentiality requirement also covers what an AI system appears to be doing, and whether the deployed architecture sufficiently protects that information.

That question requires measurement of real workflows, not the automatic transfer of laboratory attack accuracies into production risk estimates.

Cognaptus: Automate the Present, Incubate the Future.