Black-Box Inference of LLM Architectural Properties with Restrictive API Access

2026-07-01

AI Summary

Commercial large language models (LLMs) are typically offered as black-box APIs that expose only the logit of a single output token, severely limiting insight into their internal architectures. This work proposes NightVision, a method that infers key architectural attributes—such as hidden dimensionality, number of layers, and total parameter count—under these highly constrained conditions, using solely the API-provided log probabilities and the generation latency of the first token. The approach introduces three core innovations: prompt designs leveraging a shared output vocabulary, spectral analysis for estimating hidden dimensions, and a joint inference framework that integrates temporal and structural signals. Evaluated across 32 open-source LLMs, NightVision achieves an average relative error of 23% in hidden dimension estimation (as low as 9% for MoE models) and estimates model depth and parameter counts for models exceeding 3 billion parameters with errors under 53%.

Abstract

In practice, most commercial LLM providers do not publicly release details of underlying LLM architectures. However, prior work has shown that given limited API access to an LLM (namely, top-$k$ logits and/or a logit bias function), one can recover certain architectural details of an LLM, such as the hidden dimension of the feed-forward network. Perhaps in response to these results, most commercial LLM providers have restricted their APIs to expose only the single logit for each decoded token, and they no longer give users the ability to bias logits. We show that even under current restrictive APIs, several architectural parameters are still recoverable. We present NightVision, an attack that uses restrictive black-box API access to estimate the hidden dimension, depth, and parameter count of an LLM. Algorithmically, NightVision relies on a novel common set prompting technique in which multiple prompts expose log probabilities for the same set of output tokens; a spectral analysis of these results is used to infer hidden dimension. NightVision additionally uses end-to-end time to first token (TTFT) measurements and the estimated hidden dimension to estimate depth and parameter count. We empirically evaluate NightVision on 32 open-source LLMs, recovering hidden dimension to within 23% average relative error across all models (9% on MoE models), and depth and parameter count to within 53% for models exceeding three billion parameters. We run extensive ablations to demonstrate how these accuracies scale with token budget and model properties. Overall, our results suggest that current LLM APIs are not sufficiently restricted to fully obfuscate the architectural details of their underlying models.

Problem

• Black-box inference
• LLM architecture
• Restrictive API
• Model reverse engineering
• Architectural property estimation

Innovation

• black-box inference
• common set prompting
• spectral analysis
• time-to-first-token
• LLM architecture recovery