{"id":"83cac537-4d75-491a-9b68-f667c2af732e","arxiv_id":"2608.09225","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Per-principal HMAC salts on LLM cache keys can block cross-tenant timing leaks, but the mechanism is already in vLLM and the paper's 0% success evidence is analytic, not from a deployed defense.","lead":"KVGov proposes per-user secret keys for LLM cache lookups to stop tenants from timing other tenants' cached prompts. The core mechanism is already offered by vLLM, and the paper's defense results come from simulation, not from a deployed system.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"KVGov's zero-leakage guarantee rests on a per-principal cache-salt binding that is never implemented or tested; the cited vLLM cache_salt mechanism is a client-supplied request field, so without an unbuilt server-side auth layer the attack reappears.","rationale":"The paper's central claim is that KVGov eliminates the KV-cache timing side channel. The only part of the work that could establish that is the HMAC-salt mechanism together with the ASR/ablation simulation; the hardware section validates that the undefended channel is exploitable, not that the defense works. The ASR=0 columns are, by the authors' own admission, analytic consequences of assuming isolation rather than empirical findings, so the empirical support for the headline claim is thin. The critical uncertainty is not the hash primitive but the placement of trust: who controls the salt, and whether every cache-key derivation path uses it. This is the same load-bearing assumption the reader identified, and the paper's own limitations point to it: Section 4.2 says the authenticated principal is not held by the serving layer, and boundary salting requires an offset parameter that current engines do not expose. The paper is honest about these gaps, which is why a reject verdict would be too harsh; the core cryptographic argument is sound conditional on the auth binding, the taxonomy is useful, and the hardware measurements are carefully gated and independently replicated. However, the headline 'first unified defense' is not yet supported by a tested system. A revision that implements the server-side auth-to-salt binding and reruns the three attack families would convert this to an accept; absent that, CONDITIONAL remains the right verdict. ORIGAMI and the ESS tipping point do not bear on this assessment because they are governance add-ons, not the isolation mechanism.","tokens_in":14395,"tokens_out":7971,"duration_ms":75541,"concrete_test":"Run a two-tenant vLLM 0.9 experiment where the victim caches a prompt with cache_salt = v and the attacker sends the same prompt with cache_salt = v through the public request API, then measure PROMPTPEEK and InputSnatch ASR. If ASR > 0 or the server's prefix-cache counters show cross-principal hits, the client-controlled-salt path defeats the claimed isolation. Then add a server-side middleware that overwrites cache_salt with HMAC_K(secret, authenticated_principal_id) and repeat; if ASR drops to 0 with zero cross-principal hits, the mechanism works only with that unbuilt middleware, confirming the conditional verdict.","verdict_should_be":"UNCHANGED","load_bearing_attack":"KVGov's security claim is the HMAC-salt construction: sigma_p = HMAC_K(secret, principal_id) seeds the block-hash chain, so cross-principal probes cannot resolve. The argument is cryptographically sound only if every cache lookup actually uses a server-derived sigma_p. The paper does not implement or test this binding. Section 4.2 states that the authenticated principal is not held by the serving layer, and the mechanism the paper credits as its deployment path, vLLM's cache_salt (RFC #16016), is a per-request field. If a client can set cache_salt, an adversary can set it to the victim's salt (or to the empty default) and the isolation collapses; if any engine path (for example LMCache or chunked-prefill reuse) hashes tokens without the salt, the cross-principal signal survives. The ASR=0 columns are analytic controls from an all-MISS simulation, not measurements of this binding. The load-bearing condition is therefore not collision resistance but a hypothetical auth layer that forces principal_id into every cache-key derivation path; the paper defers that layer to deployment.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript proposes KVGov, a governance layer for multi-tenant LLM KV-cache timing side channels. Its central mechanism is a per-principal HMAC salt that seeds the block-hash chain, making cache keys cryptographically disjoint across principals; it also presents boundary salting to preserve cross-tenant prefix reuse, an ORIGAMI Stackelberg audit scheduler, and an evolutionary-stability tipping point. The paper reports 0% attack success rate under KVGov from a deterministic simulation, a 12.6% reduction in adversary expected utility for ORIGAMI, and gate-verified hardware measurements on the A100 and Apple Metal confirming the underlying timing channel.","tokens_in":14598,"tokens_out":6267,"duration_ms":56491,"significance":"The paper has real strengths: the TTFT measurements on Qwen2.5-7B/vLLM/A100 are carefully gated, including server-side prefix-cache counters and a FLOP-utilization check, and the independent llama.cpp/Metal replication strengthens the claim that the channel is intrinsic to prefix caching. The taxonomy of cache mechanisms and adversary goals is useful, and the proof of Theorem 1 is correct. The core cryptographic idea, per-principal salting of the cache-key chain, is sound as a design provided the server can bind every request to a non-spoofable principal. However, the headline 0% ASR is an analytic consequence of the simulation's own assumptions, not an empirical validation of the defense, and the paper's only cited deployment path, vLLM's cache_salt, appears to be a client-supplied request field. These issues currently prevent the paper from supporting its central claim that KVGov eliminates the root cause of the attacks.","major_comments":[{"comment":"The KVGov columns in Table 3 and the ablation in Figure 2 report 0% ASR because the simulation model makes that outcome a tautology: after salting, every probe is all-MISS, and the Pearson judge maps a zero-variance vector to rho=0. The text in §5.2 labels these columns analytic controls, but the abstract and §5.3 nevertheless use them as evidence that HMAC-salt is 'necessary and sufficient' and that it 'alone accounts for the full reduction in ASR.' Since the defense is never deployed, no measured evidence supports the ASR=0 claim; the security argument may be correct under the model, but the ablation does not validate it.","section":"§5.2, Table 3, Figure 2"},{"comment":"The defense binds cache resolution to an authenticated principal, yet the only engine mechanism cited, vLLM's cache_salt, is described in the reference list as a 'cache salt request field.' If the client can set cache_salt, an adversary can choose the victim's salt or the empty default, and cross-principal probes resolve again. The paper itself states in §4.2 that the serving layer does not hold the authenticated principal and that boundary salting requires an offset parameter current engines do not expose. This means KVGov as described is not deployable on unmodified vLLM, and the load-bearing binding between principal identity and cache key is never implemented or tested; the threat-model assumption that A cannot issue requests on behalf of another tenant is exactly the missing infrastructure.","section":"§4.1, §4.2, Definition 1; vLLM Project (2025) reference"},{"comment":"The claim that HMAC-salt is 'necessary and sufficient' is not supported by the ablation. The experiment shows that HMAC-salt alone suffices to reach 0% ASR, but it never tests a configuration that contains all other components and omits the salt, so necessity is not established. The abstract and conclusion rest on this 'necessary and sufficient' wording, so the claim should either be demonstrated with the missing ablation or weakened to 'sufficient'.","section":"§5.3, Table 4"},{"comment":"The adversarial load benchmark uses an adversary heuristic that maximizes v_j/(1-p_j), which the paper correctly notes differs from the payoff v_i(1-p_i) optimized by Theorem 1; the benchmark therefore does not validate ORIGAMI's optimality or provide direct evidence for the 12.6% EU reduction reported in the abstract. The admission in §5.5 is commendable, but the abstract and Section 4.3 present the 12.6% figure without this caveat, overstating the empirical support for ORIGAMI.","section":"§5.5, Table 6"}],"minor_comments":[{"comment":"The text says the replicator-dynamics sweep uses a five-point grid and brackets the tipping point between the 30% and 35% samples, but Table 7 lists only four rates (0%, 10%, 20%, 50%) and omits the 30% and 35% rows; the table should be reconciled with the text.","section":"§5.6, Table 7"},{"comment":"The denominator in the Pearson correlation formula has a missing closing norm symbol on the second term, and it would help to state explicitly how the threshold theta=0.85 is applied to decide a match.","section":"§3.1, equation for rho"},{"comment":"The 92.8% retained-cache-efficiency figure is explicitly extrapolated from §5.7 measurements rather than measured end to end; this is disclosed in the Limitations section, but the abstract's wording 'retains an estimated 93%' should carry the extrapolation caveat more prominently.","section":"§4.2"},{"comment":"The sentence claiming judges are 'provably 100% accurate for the simulated attack model' is trivially true given the deterministic construction; please clarify what property is being asserted beyond determinism.","section":"§5.1"},{"comment":"The column header 'Rnd' is ambiguous; it appears to denote random-audit breach rate, but could be read as 'rounds,' which is also reported in the last column. Please rename it to 'Random' or 'Random audit.'","section":"Table 6"},{"comment":"The numeric value of the tipping point tau*=31.6% depends critically on the chosen payoff parameters V_glb, V_eph, C_glb,eph, C_eph; these parameters are not empirically calibrated, so the paper should clearly state that the 31.6% figure is an illustrative consequence of the model, not a measured property of real deployments.","section":"§4.4, Proposition 1"}],"recommendation":"major_revision","confidential_remarks":"The paper is honest in several places, notably in labeling the 100%/0% ASR columns as analytic controls and in admitting that boundary salting is not measured. However, the gap between the central claim and the evidence is substantial: the defense is never implemented, the ASR=0 result is forced by the simulation model, and the cited vLLM cache_salt mechanism appears to be client-controlled, which would break the threat model. I would encourage the authors either to implement and measure a server-side authenticated-salt binding or to reframe the paper as a design proposal plus a rigorous vulnerability measurement, with the 0% ASR and 'necessary and sufficient' claims explicitly downgraded. The hardware measurements are a strong contribution and should remain the empirical core of the paper."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the main defense—per-principal HMAC salt on cache keys—is already vLLM's cache_salt (RFC #16016), and the paper says so. What's actually new is the taxonomy of cache mechanisms and adversary goals, the boundary-salting idea, and careful TTFT measurements on two independent stacks. Those are worth reading.\n\nThe hardware measurements are the strongest part. The cold/cached ratios (0.22 on A100, 0.093 on Apple M4) are gate-verified, with a server-side check that the cold arm's prefix-cache hit rate stayed low. That is the right way to measure this channel, and the independent replication gives real weight to the claim that prefix caching leaks timing.\n\nThe soft spots are where the defense itself lives. KVGov's zero-ASR result is analytic, not empirical: after salting, the simulated adversary always sees all-MISS, so the Pearson judge returns rho=0 by construction. The paper labels these columns analytic controls, which is honest, but the abstract and ablation still rely on them as evidence that the salt is 'necessary and sufficient.' That is a framing problem, not a hidden flaw.\n\nThe bigger issue: the security claim requires a server-side binding between requests and authenticated principals. The paper's own deployment section (4.2) says the serving layer does not hold the authenticated principal, and vLLM's cache_salt is a per-request field. If the client can set it, an attacker can set it to the victim's value (or to empty) and the isolation collapses. So the load-bearing assumption—a trustworthy auth layer that forces the salt into every key-derivation path—is not implemented or tested. The stress-test note lands.\n\nORIGAMI and the ESS are fine as theory. Theorem 1's water-filling proof is correct; the 12.6% reduction and 31.6% tipping point are analytically derived from hand-chosen payoffs, so they are illustrative rather than predictive. The paper mostly says this, which I credit.\n\nBottom line: a solid system paper with an overbroad title and an unproven core deployment assumption. It deserves a real referee to force scoped claims: either implement and measure the server-side principal binding, or reposition it as a taxonomy plus design analysis of an existing mechanism. I'd send it to peer review, not desk reject.","headline":"Core defense is prior art (vLLM cache_salt), but the taxonomy, boundary-salting idea, and gate-verified TTFT measurements make this a legitimate paper that deserves peer review.","tokens_in":15216,"tokens_out":4406,"would_cite":true,"duration_ms":36711,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Seeding the KV-cache block-hash chain with a per-principal HMAC salt makes cache entries cryptographically disjoint across tenants, driving all three published prompt-reconstruction attacks to 0% success rate.","keywords":["KV cache timing side channel","multi-tenant LLM inference","HMAC-keyed namespace isolation","prefix cache","prompt leakage","attack success rate","Stackelberg audit","evolutionary stability"],"falsifier":"Instrument the cache's own counters in a root-salted deployment: if a single request from principal A resolves a cache block created by principal B, the cryptographic-disjointness claim is false; if no such cross-principal hit ever occurs, the mechanism is doing what the paper says.","tokens_in":14101,"feed_emoji":"🔐","tokens_out":9819,"duration_ms":75574,"temperature":0.7,"pith_summary":"Modern LLM serving shares a key-value cache across tenants to reuse computed prefixes, and the paper claims this sharing leaks private prompts through a timing side channel: any tenant can tell, from time-to-first-token, whether another tenant's prompt is cached. KVGov is a governance layer that removes the root cause by binding every cache key to the authenticated principal: a per-principal HMAC salt seeds the chained block hashes, so cache entries become cryptographically disjoint across tenants. In the paper's simulated attacks, this drives all three known attack families—PROMPTPEEK, EarlyBird, and InputSnatch—to 0% attack success rate, while an ablation isolates the salt as the necessary and sufficient component. The paper further shows that salting only at the point where prompts diverge preserves most prefix-cache reuse, and adds an audit scheduler and a population-level tipping point for cache-scope choice. If the defense holds, multi-tenant LLM providers can keep their caching speedup without exposing tenants to prompt reconstruction.","feed_headline":"Salting cache keys by tenant cuts prompt-leak attacks to 0%","feed_subtitle":"A per-principal HMAC salt makes each tenant's cache blocks unreadable to others, killing all three known attack families.","key_machinery":"The block-hash chain that inference engines use to key cached token blocks: $h_0 = H(\\mathrm{tokens}_{0..B-1})$ and $h_j = H(h_{j-1}, \\mathrm{tokens}_{jB..(j+1)B-1})$. KVGov's central object is the per-principal salt $\\sigma_p = \\mathrm{HMAC}_K(\\mathrm{secret}, \\mathrm{principal\\_id})$ inserted into $h_0$ (or at the divergence boundary), so chaining propagates the salt through every subsequent block; this makes cross-principal cache collision cryptographically impossible while preserving intra-principal prefix reuse. Supporting machinery includes ORIGAMI, a Stackelberg water-filling audit scheduler, and an evolutionary-stability threshold formula for choosing cache scope.","core_discovery":"The central claim is that the three published KV-cache timing attacks share one root cause—cache keys are computed over token sequences alone, with no binding to the issuing principal—and that binding cache resolution to the authenticated principal eliminates all three attacks' prefix-cache paths at once. Concretely, seeding the block-hash chain with $\\sigma_p = \\mathrm{HMAC}_K(\\mathrm{secret}, \\mathrm{principal\\_id})$ makes the entire chain principal-specific because each block inherits its predecessor's hash; an adversary's probes under their own salt never collide with the victim's entries, so their timing fingerprint is all-MISS and the Pearson correlation collapses toward zero. The paper reports 0% attack success rate for PROMPTPEEK, EarlyBird, and InputSnatch under KVGov, against 100% without defense and 9.8–22% under session-flushing, with the 0% and 100% columns being analytic controls rather than sampled statistics. Real measurements confirm the channel itself is exploitable—a cold/cached time-to-first-token ratio of 0.22 on production hardware and 0.093 on an independent stack—and the paper argues that block-size hardening does not protect template-structured prompts, where confirming whether a specific field is cached costs a single request regardless of block size.","pith_inferences":["If the authentication binding holds, the same HMAC-salt construction should also cover exact-response caches and radix-tree caches, but the paper explicitly does not measure the semantic-cache row of its taxonomy, where nearest-neighbour lookup defeats salting; a per-principal partition of the retrieval index would be the natural extension.","The boundary-salting logic suggests a deployment-level control that requires no engine change: emitting a per-principal token near position 0 in every prompt would approximate root salting, and operators could A/B test the resulting timing isolation without modifying cache internals.","Because the paper's 0% ASR rests on the collision-resistance argument rather than on sampled trials, an end-to-end implementation in a real engine with real adversarial tenants would strengthen the empirical claim, especially the 92.8% efficiency estimate, which is extrapolated from two hardware measurements rather than measured directly.","The evolutionary tipping point could be turned into an adaptive cache-scope policy: monitor the adversary prevalence and switch between global and ephemeral caching as the modeled threshold is crossed."],"forward_implications":["An adversary's probes under their own salt never resolve to a victim's cache entries, so the timing fingerprint becomes all-MISS and the published PROMPTPEEK identification attack collapses to 0% success.","EarlyBird's token-by-token reconstruction and InputSnatch's template-field membership queries are blocked for hash-keyed caches, because the oracle that the attacks read is removed rather than merely made noisier.","Block-size hardening is not a substitute: with template-structured prompts, confirming whether a specific field is cached costs one request even at block size 16, so only namespace isolation closes that O(1) membership query.","Boundary salting, which applies the salt only where prompts diverge, is estimated to retain 92.8% of the prefix-cache benefit of full sharing while still eliminating the cross-principal timing signal.","The ORIGAMI scheduler cut adversary expected utility by 12.6% over random audit under an enterprise workload, and the replicator-dynamics analysis identifies a 31.6% adversary-prevalence threshold below which global caching is evolutionarily stable."],"supporting_citations":[{"why":"Defines the PROMPTPEEK fingerprint-correlation attack whose prefix-cache path KVGov must eliminate.","marker":"Wu et al. (2025)"},{"why":"Defines the EarlyBird token-reconstruction attack and the block-size=1 cache granularity it exploits.","marker":"Song et al. (2024)"},{"why":"Defines the InputSnatch template and semantic-cache attacks, providing the membership-query threat model.","marker":"Zheng et al. (2024b)"},{"why":"Introduces PagedAttention and the block-chained prefix cache whose key computation KVGov modifies.","marker":"Kwon et al. (2023)"},{"why":"Introduces the radix-tree prefix cache in SGLang that exposes the finer matched-prefix-length oracle.","marker":"Zheng et al. (2024a)"},{"why":"Documents the cache-salt request field that already exposes the per-principal salt mechanism in a production engine.","marker":"vLLM Project (2025)"},{"why":"Supplies the Stackelberg security game formulation ORIGAMI's water-filling dual is adapted from.","marker":"Tambe (2011)"},{"why":"Supplies the replicator-dynamics framework behind the evolutionary stability tipping-point analysis.","marker":"Hofbauer and Sigmund (1988)"}],"fun_headline_variants":["Per-tenant HMAC salt blocks all KV-cache timing attacks","KVGov: salt cache keys by principal to stop prompt leaks","Tenant-scoped cache keys eliminate KV-cache side channel","HMAC per-tenant salt: zero cross-principal KV-cache hits","Principal-bound cache keys neutralise all three leak attacks"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the serving infrastructure can authenticate every request to a principal_id the attacker cannot spoof and keep the HMAC secret private; the paper assumes this in its threat model but does not implement or test the binding in a real engine.","fun_headline_variants_meta":{"raw":{"variants":["Per-tenant HMAC salt blocks all KV-cache timing attacks","KVGov: salt cache keys by principal to stop prompt leaks","Tenant-scoped cache keys eliminate KV-cache side channel","HMAC per-tenant salt: zero cross-principal KV-cache hits","Principal-bound cache keys neutralise all three leak attacks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00052,"raw_usage":{"total_tokens":2645,"prompt_tokens":1200,"completion_tokens":1445,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":816,"completion_tokens_details":{"reasoning_tokens":1356}},"tokens_in":816,"tokens_out":1445,"duration_ms":11879,"temperature":1.0,"reasoning_tokens":1356,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T14:25:45.463718+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Instrument the cache's own counters in a root-salted deployment: if a single request from principal A resolves a cache block created by principal B, the cryptographic-disjointness claim is false; if no such cross-principal hit ever occurs, the mechanism is doing what the paper says.","supporting_citations":[{"cited_title":", author Li, Z","cited_arxiv_id":null,"evidence_quote":"Introduces PagedAttention and the block-chained prefix cache whose key computation KVGov modifies."},{"cited_title":"title RFC: Prefix Cache Isolation via cache\\_salt","cited_arxiv_id":null,"evidence_quote":"Documents the cache-salt request field that already exposes the per-principal salt mechanism in a production engine."}],"review_version":2}