Key-Value (KV) caches reduce inference latency in large language models (LLMs). Traditional prefix-based reuse has low cache hit rates due to the need for exact token and position matches. Recent system optimizations have introduced position-independent KV reuse, allowing caches to be reused whenever identical text chunks appear, regardless of their position in the sequence.
However, this design introduces a new threat: KV Cache Hijacking. Since KV caches are retrieved by token match but encode the context in which they were originally computed, the KV tied to a benign-looking token chunk may encode an attacker-controlled prefix. When reused in a victim query, this contaminated KV silently hijacks the model's behavior, even if no attacker-controlled text appears in the input.
We introduce HIJACKKV, the first attack framework that systematically exploits this vulnerability, demonstrating its severity and practicality. HIJACKKV optimizes an attacker-controlled prefix such that the KV computed for a subsequent common benign text encodes the attacker's goal, while the text remains unchanged for future cache hits. HIJACKKV achieves an average success rate of 94% in a single attempt, remains effective under realistic constraints including low hit rates (10%) and frequent recomputation (50%), persists over multi-turn interactions, and transfers across models in black-box settings. We further provide design insights for building secure KV reuse systems.
Blogger's Review: The introduction of HIJACKKV highlights potential security vulnerabilities in existing KV cache reuse strategies, which warrants attention. As model sizes grow and applications expand, ensuring system security becomes crucial, and designing mechanisms to prevent such attacks should be a focal point for future research.