HijackKV: Poisoning Position-Independent KV Cache Reuse in RAG Serving

This episode examines HijackKV, an integrity attack on position-independent KV cache reuse, where a clean question and a clean retrieved document still yield an attacker's chosen answer because the stored attention state was poisoned earlier. It explains why prefix caching is safe by construction, why position-independent systems such as Prompt Cache, CacheBlend, and EPIC give that up to raise hit rates for retrieval-augmented generation, and how the resulting "attention shift" mismatch, long treated only as an accuracy problem, becomes an unkeyed-input hole much like web cache poisoning. The discussion contrasts the attack with indirect prompt injection and with timing-based cache privacy attacks, and sets out a threat model in which the attacker is an ordinary user who optimizes a prefix with a GCG-style gradient search. It also defines the untargeted and targeted attack-success metrics and tests the abstract's claims of roughly 94% one-shot success and survival under 50% recomputation against the paper's tables. Listeners get a clear look at a security risk in shared LLM serving caches that no text filter can see.

Sources:
1. HijackKV: Poisoning Position-Independent KV Cache Reuse in RAG Serving
https://arxiv.org/pdf/2607.19957
2. CacheBlend: Fast Large Language Model Serving for RAG with Cached Knowledge Fusion — Jiayi Yao, Hanchen Li, Yuhan Liu, Siddhant Ray, Yihua Cheng, Qizheng Zhang, Kuntai Du, Shan Lu, Junchen Jiang, 2024 (EuroSys 2025)
https://scholar.google.com/scholar?q=CacheBlend%3A+Fast+Large+Language+Model+Serving+for+RAG+with+Cached+Knowledge+Fusion
3. Efficient Memory Management for Large Language Model Serving with PagedAttention — Woosuk Kwon, Zhuohan Li, Siyuan Zhuang, Ying Sheng, Lianmin Zheng, Joseph Gonzalez, Hao Zhang, Ion Stoica, 2023 (SOSP)
https://scholar.google.com/scholar?q=Efficient+Memory+Management+for+Large+Language+Model+Serving+with+PagedAttention
4. Universal and Transferable Adversarial Attacks on Aligned Language Models — Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, Matt Fredrikson, 2023
https://scholar.google.com/scholar?q=Universal+and+Transferable+Adversarial+Attacks+on+Aligned+Language+Models
5. Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection — Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, Mario Fritz, 2023
https://scholar.google.com/scholar?q=Not+what+you%27ve+signed+up+for%3A+Compromising+Real-World+LLM-Integrated+Applications+with+Indirect+Prompt+Injection
6. Auditing Prompt Caching in Language Model APIs — Chenchen Gu, Xiang Lisa Li, Rohith Kuditipudi, Percy Liang, Tatsunori Hashimoto, 2025
https://scholar.google.com/scholar?q=Auditing+Prompt+Caching+in+Language+Model+APIs
7. The Early Bird Catches the Leak: Unveiling Timing Side Channels in LLM Serving Systems — Linke Song, Zixuan Pang, Wenhao Wang, Zihao Wang, XiaoFeng Wang, Hongbo Chen, Wei Song, Yier Jin, Dan Meng, Rui Hou, 2024
https://scholar.google.com/scholar?q=The+Early+Bird+Catches+the+Leak%3A+Unveiling+Timing+Side+Channels+in+LLM+Serving+Systems
8. Prompt Leakage via KV-Cache Sharing in Multi-Tenant LLM Serving — Guanlong Wu, Zheng Zhang, Yao Zhang, Weili Wang, Jianyu Niu, Ye Wu, Yinqian Zhang, 2025 (NDSS)
https://scholar.google.com/scholar?q=Prompt+Leakage+via+KV-Cache+Sharing+in+Multi-Tenant+LLM+Serving
9. EPIC: Efficient Position-Independent Caching for Serving Large Language Models — Junhao Hu et al., 2025
https://scholar.google.com/scholar?q=EPIC%3A+Efficient+Position-Independent+Caching+for+Serving+Large+Language+Models
10. Prompt Cache: Modular Attention Reuse for Low-Latency Inference — In Gim, Guojun Chen, Seung-seob Lee, Nikhil Sarda, Anurag Khandelwal, Lin Zhong, 2024
https://scholar.google.com/scholar?q=Prompt+Cache%3A+Modular+Attention+Reuse+for+Low-Latency+Inference
11. Block-Attention for Efficient Prefilling / TurboRAG / APE (Adaptive Parallel Encoding) — Dongyang Ma et al.; Songshuo Lu et al.; Xinyu Yang et al., 2024-2025
https://scholar.google.com/scholar?q=Block-Attention+for+Efficient+Prefilling+%2F+TurboRAG+%2F+APE+%28Adaptive+Parallel+Encoding%29
12. I Know What You Asked: Prompt Leakage via KV-Cache Sharing in Multi-Tenant LLM Serving — Guanlong Wu, Zheng Zhang, Yao Zhang, Weili Wang, Jianyu Niu, Ye Wu, Yinqian Zhang, 2025
https://scholar.google.com/scholar?q=I+Know+What+You+Asked%3A+Prompt+Leakage+via+KV-Cache+Sharing+in+Multi-Tenant+LLM+Serving
13. Universal and Transferable Adversarial Attacks on Aligned Language Models (GCG) — Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, Matt Fredrikson, 2023
https://scholar.google.com/scholar?q=Universal+and+Transferable+Adversarial+Attacks+on+Aligned+Language+Models+%28GCG%29
14. PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models — Wei Zou, Runpeng Geng, Binghui Wang, Jinyuan Jia, 2025 (USENIX Security)
https://scholar.google.com/scholar?q=PoisonedRAG%3A+Knowledge+Corruption+Attacks+to+Retrieval-Augmented+Generation+of+Large+Language+Models
15. Cartridges: Lightweight and General-Purpose Long Context Representations via Self-Study — Sabri Eyuboglu, Ryan Ehrlich, Simran Arora, et al., 2025
https://scholar.google.com/scholar?q=Cartridges%3A+Lightweight+and+General-Purpose+Long+Context+Representations+via+Self-Study
16. Prompt Infection / Not what you've signed up for: indirect prompt injection — Kai Greshake et al.; Donghyun Lee and Mugur Tiwari, 2023; 2024
https://scholar.google.com/scholar?q=Prompt+Infection+%2F+Not+what+you%27ve+signed+up+for%3A+indirect+prompt+injection
17. CacheGen / CacheBlend lineage and RAGCache — Yuhan Liu et al.; Chao Jin et al., 2023-2024
https://scholar.google.com/scholar?q=CacheGen+%2F+CacheBlend+lineage+and+RAGCache
18. vLLM prefix caching with cache_salt and per-organization cache isolation in provider APIs — vLLM project; OpenAI/Anthropic documentation, 2024-2025
https://scholar.google.com/scholar?q=vLLM+prefix+caching+with+cache_salt+and+per-organization+cache+isolation+in+provider+APIs