[Track A] Feedback: Inference-Time Side-Channel Disclosure

[rocklambros]

Sprint 2 Feedback — Inference-Time Side-Channel Disclosure

This issue collects qualitative feedback on the Inference-Time Side-Channel Disclosure new candidate entry. Submit your Importance, Clarity, and Distinctness scores via the Sprint 2 Google Form (single ballot covering both tracks).

• Vote: https://docs.google.com/forms/d/e/1FAIpQLSebmFQyJPOMuw1IorHCJ2FdW98ZT2oLNBuVgYqpPoayW9v6ww/viewform — page through to the Track A section, then to Inference-Time Side-Channel Disclosure
• Read the draft: https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/new_entry_candidates/inference-time-side-channel-disclosure.md
• Voting closes: May 18, 2026 at 23:59 UTC
• Code of Conduct: https://owasp.org/www-policy/operational/code-of-conduct

Scoring rubric

• Importance (1–5): How critical is this risk to LLM application security in 2026?
• Clarity (1–5): How clearly does the candidate describe the risk and mitigations?
• Distinctness (1–5): Is this materially different from existing entries (LLM01–LLM10), or could it be merged into one of them?

Why Distinctness matters

Sprint 3 cuts 8 candidates down to 5. A high-Importance candidate that overlaps heavily with an existing entry is a merge target, not a standalone winner. Distinctness scores let the working group make defensible cut, keep, or merge calls.

How to comment

Reply to this issue with feedback specific to Inference-Time Side-Channel Disclosure. Use one comment per topic so the working group can triage cleanly. Format we like:

Section: <which section of the candidate>
Issue: <what is wrong, missing, unclear, or duplicative>
Proposed change: <your suggested fix, addition, or merge target>
Overlaps with: <existing entry LLM01–LLM10 if applicable>
Evidence: <CVE, paper, incident, or research note ID if applicable>

Out of scope here

• Cross-cutting comments → use Discussions
• Comments on existing entries (LLM01–LLM10) → comment on the relevant Track B issue
• Process or governance questions → comment in Discussions

Triage

Working group entry leads classify each comment within 48 hours as:

• actionable — feeds Sprint 3 revision or merge decision
• clarification — requires reply, not action
• out-of-scope — closed with redirect

Sprint 3 begins May 18 with this issue's triage as input.