Adnan KhanAdnanProduct & AI
San Francisco Bay Area
Get in touch

Source note3 min read

HijackKV: New Threat in Position-Independent KV Cache Reuse

Source

arXiv

arxiv.org/abs/2607.19957v1

Read the source

Source

Plain-Language Brief

Researchers have identified a new threat called KV Cache Hijacking in position-independent KV cache reuse, which is used to reduce inference latency in large language models. This threat allows an attacker to silently manipulate the model's behavior by encoding an attacker-controlled prefix into a KV cache tied to a benign-looking token chunk. The researchers introduce HIJACKKV, an attack framework that can exploit this vulnerability effectively under various conditions.

What the Document Says

  • Key-Value (KV) cache is used to reduce inference latency in large language models.
  • Traditional prefix-based KV reuse has low cache hit rates due to exact token and position matches requirement.
  • Position-independent KV reuse allows KV cache to be reused whenever identical text chunks appear, regardless of their position.
  • The researchers show that position-independent KV reuse introduces a new threat called KV Cache Hijacking.
  • KV caches are retrieved by token match but encode the context in which they were originally computed.
  • An attacker can manipulate the model's behavior by encoding an attacker-controlled prefix into a KV cache tied to a benign-looking token chunk.
  • HIJACKKV is an attack framework that exploits this vulnerability effectively under various conditions.
  • HIJACKKV optimizes an attacker-controlled prefix, so that the KV computed for a subsequent common benign text encodes the attacker’s goal, while the text remains unchanged for future cache hits.
  • HIJACKKV achieves an average 94% success rate in a single attempt and persists over multi-turn interactions.

Key Concepts Mentioned

  • Key-Value cache
  • large language models
  • position-independent KV reuse
  • KV Cache Hijacking
  • HIJACKKV

Claims Made by the Document

  • Position-independent KV reuse introduces a new threat.
  • HIJACKKV is an effective attack framework.

Evidence Used

  • The researchers demonstrate the severity and practicality of HIJACKKV.

Methods / Approach

  • The researchers introduce HIJACKKV, an attack framework that systematically exploits KV Cache Hijacking.

Limitations Stated by the Authors

  • Not stated in source

Limitations Noted by the Agent

Agent interpretation — not from the source.

  • Uncertainty about the robustness of HIJACKKV against defensive measures.
  • Uncertainty about the impact on specific types of large language models.

Open Questions

  • What are potential defensive measures against HIJACKKV?
  • How does HIJACKKV affect different types of large language models?

Notes for Future Q&A

May include interpretation. Labeled where it does.

  • This research highlights a new threat in position-independent KV cache reuse and introduces an attack framework called HIJACKKV. It's important to consider potential defensive measures against such attacks, as well as their impact on various types of large language models.

Raw Abstract / Excerpt

Key-Value (KV) cache reduces inference latency in large language models (LLMs). Traditional prefix-based reuse has low cache hit rates across inference requests because it requires exact token and position matches. To improve efficiency, recent system optimizations introduce position-independent KV reuse, allowing KV cache to be reused whenever identical text chunks appear, regardless of their position in the sequence. We show this design introduces a new threat, KV Cache Hijacking. Since KV caches are retrieved by token match but encode the context in which they were originally computed, the KV tied to a benign-looking token chunk may encode an attacker-controlled prefix. When later reused in a victim query, this contaminated KV silently hijacks the model's behavior, even if no attacker-controlled text appears in the input. We introduce HIJACKKV, the first attack framework that systematically exploits this vulnerability, demonstrating its severity and practicality. HIJACKKV optimizes an attacker-controlled prefix, so that the KV computed for a subsequent common benign text encodes the attacker's goal, while the text remains unchanged for future cache hits. HIJACKKV achieves an average 94% success rate in a single attempt, remains effective under realistic constraints including low hit rates (10%) and frequent recomputation (50%), persists over multi-turn interactions, and transfers across models in black-box settings. We further provide design insights for building secure KV reuse systems.