Search papers, labs, and topics across Lattice.
This paper identifies a critical vulnerability in position-independent key-value (KV) cache reuse in large language models, termed KV Cache Hijacking. By exploiting the way KV caches are retrieved based on token matches while encoding context, the authors introduce HIJACKKV, an attack framework that can covertly manipulate model behavior using benign-looking inputs. The attack achieves a remarkable 94% success rate even under challenging conditions, highlighting the urgent need for secure KV reuse system designs.
A new attack framework, HIJACKKV, reveals that position-independent KV cache reuse can be exploited to hijack model behavior with a staggering 94% success rate.
Key-Value (KV) cache reduces inference latency in large language models (LLMs). Traditional prefix-based reuse has low cache hit rates across inference requests because it requires exact token and position matches. To improve efficiency, recent system optimizations introduce position-independent KV reuse, allowing KV cache to be reused whenever identical text chunks appear, regardless of their position in the sequence. We show this design introduces a new threat, KV Cache Hijacking. Since KV caches are retrieved by token match but encode the context in which they were originally computed, the KV tied to a benign-looking token chunk may encode an attacker-controlled prefix. When later reused in a victim query, this contaminated KV silently hijacks the model's behavior, even if no attacker-controlled text appears in the input. We introduce HIJACKKV, the first attack framework that systematically exploits this vulnerability, demonstrating its severity and practicality. HIJACKKV optimizes an attacker-controlled prefix, so that the KV computed for a subsequent common benign text encodes the attacker's goal, while the text remains unchanged for future cache hits. HIJACKKV achieves an average 94% success rate in a single attempt, remains effective under realistic constraints including low hit rates (10%) and frequent recomputation (50%), persists over multi-turn interactions, and transfers across models in black-box settings. We further provide design insights for building secure KV reuse systems.
