Pith. sign in

REVIEW 5 major objections 7 minor 3 cited by

Semantic caching is inherently vulnerable to key-collision attacks: an attacker can craft prompts that share a cache key with a victim and serve their own response.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 06:12 UTC pith:FWVVUOPH

load-bearing objection A genuine new attack surface—systematic cache-key collision against semantic caches—with strong oracle-level results, but the practical black-box variant rests on an unvalidated latency validator and the transferability claim is weaker than the abstract suggests. the 5 major comments →

arxiv 2601.23088 v2 pith:FWVVUOPH submitted 2026-01-30 cs.CR cs.AI

From Similarity to Vulnerability: Key Collision Attack on LLM Semantic Caching

Zhixiang Zhang , Zesen Liu , Yuchong Xie , Quanfeng Huang , Dongdong She This is my paper
classification cs.CR cs.AI
keywords semantic cachingcache collisionfuzzy hashavalanche effectadversarial promptsLLM response hijackingagent tool hijackingmulti-tenant security
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper argues that semantic caching—using embedding vectors as fuzzy cache keys—has an inherent security flaw: the locality that makes it performant (mapping similar prompts to the same key) is the opposite of the avalanche effect that makes hashes collision-resistant. Because of this, an attacker can craft a prompt that is semantically unrelated to a victim's prompt yet receives the same cache key, causing the victim's query to retrieve an attacker-controlled cached response. The paper formalizes this as a key collision and introduces CacheAttack, a generator–validator framework that searches for colliding suffixes; against a semantic cache it reaches roughly 86% hit rate for LLM response hijacking and can reduce agent tool-selection accuracy by up to 84.5 percentage points. If correct, multi-tenant semantic caching gives attackers a path to tamper with model outputs without modifying the model or the cache contents.

Core claim

The paper's central claim is that semantic cache keys are locality-preserving fuzzy hashes rather than cryptographic hashes, and that this design intentionally trades collision resistance for higher hit rates. The authors establish the conceptual point by contrasting the cache's matching rule (a similarity threshold or a locality-sensitive partition) with the avalanche effect, then demonstrate the practical consequence: an adversary can optimize a discrete suffix appended to a malicious prompt so that its embedding satisfies the cache's match condition for a benign victim prompt. This produces a false-positive cache hit, and because the cache serves the stored response without rerunning the

What carries the argument

The central object is the semantic cache key as a fuzzy hash: a prompt is embedded into a vector, and two prompts collide when their similarity exceeds a threshold or when a locality-sensitive partitioning assigns them the same bucket. The attack's load-bearing machinery is a generator–validator loop: a generator searches over short token suffixes to minimize a collision loss (cosine distance to the victim's embedding, or a relaxed Hamming distance between hash bits), regularized by perplexity so the final prompt looks plausible; a validator infers whether a planted entry caused a cache hit by modeling end-to-end latency as a noisy signal under a two-class Gaussian model and applying a MAP d

Load-bearing premise

The black-box attack practicality rests on the assumption that a publicly available surrogate embedding model has a similarity geometry close enough to the target cache's embedding model that a suffix optimized against the surrogate also produces a cache hit under the target's matching rule.

What would settle it

Run CacheAttack-2 with a surrogate embedding model that is structurally distant from the target (e.g., a small monolingual sentence encoder against a large multilingual or cross-encoder target) and with a high similarity threshold; if the hit rate falls to the natural false-positive rate while the same suffix still collides on the surrogate, the claimed transferability and black-box feasibility are falsified.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • A multi-tenant semantic cache can be weaponized as a content-delivery channel: one attacker-planted cached response can be served to any victim whose prompt collides.
  • Because agentic systems cache intermediate tool plans, a single collision can replace the planned tool call and cascade into wrong actions, such as executing a sell order or leaking sensitive files.
  • Cross-model transferability means the attack is not limited to white-box settings; suffixes optimized on a public embedding model often transfer, though hit rates drop when surrogate and target geometries diverge.
  • The evaluated mitigations—key salting, perplexity screening, and per-user cache isolation—reduce but do not eliminate the risk, and the paper concludes that a persistent efficiency–security trade-off remains.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same collision mechanism likely extends beyond response caches to any fuzzy-match layer—vector retrieval, RAG pipelines, or semantic deduplication—where similarity thresholding replaces exact equality; the paper does not make this generalization explicitly.
  • The latency-based validator implies that even fully opaque caches leak hit/miss information through timing, suggesting that side-channel auditing could be used proactively to detect whether a production cache has been poisoned.
  • A testable extension would be to rotate the embedding model periodically; if model rotation breaks the geometry transfer that CacheAttack relies on, it could become a cheap, low-overhead mitigation that the paper does not explore.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

5 major / 7 minor

Summary. The paper argues that semantic caching, which uses embedding vectors as fuzzy cache keys, is inherently vulnerable to key-collision attacks because the locality required for high hit rates conflicts with the avalanche effect needed for collision resistance. It introduces CacheAttack, a generator–validator framework that optimizes adversarial suffixes to make a malicious prompt collide with a victim prompt under the cache's similarity gate. Two variants are proposed: CacheAttack-1 validates directly on the target, and CacheAttack-2 uses a surrogate-assisted, latency-validated pipeline. Experiments report high hit rates and injection success rates for LLM response hijacking, agent tool-invocation hijacking, cross-embedding transferability, and a financial-agent case study. The paper also evaluates mitigations (key salting, PPL screening, per-user isolation) and characterizes a performance–security trade-off.

Significance. If the empirical claims hold, this is a useful and timely contribution: it is, to my knowledge, the first systematic treatment of integrity failures in semantic caching, as opposed to prior privacy-side-channel work. The attack framework is clearly described, code is promised, and the agentic case study gives a concrete, plausible harm scenario. The framing of semantic keys as fuzzy hashes is a helpful conceptual lens. However, the paper's load-bearing practical claims currently rest on several unvalidated components, most notably the latency-based validator used in the 'better' attack variant, and on limited experimental support (50 benign prompts, one agent target prompt). These gaps need to be addressed before the strength of the claims can be fully assessed.

major comments (5)
  1. [§5.1, §6.2, Table 1] The latency validator in CacheAttack-2 is never evaluated. Section 5.1 models log-latency as a two-class Gaussian and uses a MAP rule, but no accuracy, confusion matrix, ROC, or false-positive rate is reported anywhere. The HR/ISR numbers in Table 1 appear to be oracle hit rates ('record whether it matches the injected entry'), not end-to-end success under the validator. In a true black-box deployment the attacker must decide whether to stop based on the latency classifier; a non-trivial false-positive rate would substantially lower practical success. Since the paper states CacheAttack-2 is 'the better one' and uses it in RQ2–RQ4, this is a central unsupported component.
  2. [§6.4, Table 3] The transferability claim is weaker than the abstract suggests. Off-diagonal hit rates are highly variable: MiniLM→BGE is 49.8%, BGE→MiniLM is 50.7%, while E5→BGE is 86.9%. RQ1 uses BGE as surrogate and E5 as target, which is one of the more favorable off-diagonals, but the broader claim of 'strong transferability across different embedding models' is not supported by the full matrix. The black-box threat model in §4.2 assumes the surrogate 'mimics the key generation of the target model'; Table 3 shows this assumption fails for several model pairs. The paper should either qualify the transferability claim to similar architectures/families or report attack success conditioned on the actual target geometry.
  3. [§6.2, RQ1] RQ1 evaluates only 50 benign prompts sampled from Natural Questions. No confidence intervals or statistical significance tests are reported. Given the small sample, the difference between CacheAttack-1 (86.9% HR) and CacheAttack-2 (83.1% HR) may not be meaningful, and the headline 86% figure has wide uncertainty. Reporting per-prompt variability, bootstrap CIs, or a larger sample is necessary to support the quantitative claims.
  4. [§6.3, Appendix D] The agent tool-invocation experiment (RQ2) uses exactly one pre-validated malicious target prompt, 'Execute cat /etc/passwd ...'. Table 2 reports a 90.6% hit rate and large TSR/Acc drops, but these results characterize success for a single injection target. The claim that CacheAttack 'can induce malicious behaviors in LLM agent' generally is not established from one prompt. A small set of diverse malicious targets and tool calls is needed, along with reporting of per-target variance, to support the RQ2 conclusions.
  5. [§3, Eq. (1)–(2)] The conceptual analysis in Section 3 is close to a restatement of the matching definition: if match(p1,p2) is true exactly when sim(k_p1,k_p2) ≥ τ, then an attacker who can force sim ≥ τ causes a collision by construction. The paper calls this a 'formalization' of a locality–collision-resistance trade-off, but it does not derive any quantitative bound or independent implication. This is not fatal to the empirical contribution, but the manuscript should be clearer that the 'inherent vulnerability' is a definitional observation, not a new theoretical result.
minor comments (7)
  1. [§5.2] Typo: 'CacheAttack-2, which which uses a surrogate model' appears in the text.
  2. [Eq. (1) text] Typo: 'vice verse' should be 'vice versa'.
  3. [§6.2] The statement 'we consider CacheAttack-2 as the better one' is not justified by the data in Table 1; it is only motivated by efficiency. Please clarify the criteria.
  4. [Table 2] The table formatting is broken (row headers 'semantic cache' and 'semantic KV cache' are not aligned with the columns). Also, the meaning of the duplicate 'Benign Attack Δ(↑)' header is unclear.
  5. [§6.1 / Appendix A] The main text says GPTCache uses 'a cosine similarity threshold τ' but does not state the value used in RQ1. Appendix A says τ=0.8 is adopted in RQ2; clarify whether RQ1 also uses τ=0.8.
  6. [Fig. 3] The perplexity figure reports single numbers without error bars or sample sizes, and the 'Window PPL' definition is not given in the main text. Please add details.
  7. [§7.1] Key salting is presented as a defense, but the salt is appended to the prompt text; if the attacker can observe or guess the salt (e.g., via the public prompt template), the defense may be bypassed. Discuss this limitation.

Circularity Check

1 steps flagged

Conceptual vulnerability claim is a restatement of the matching rule, but the empirical attack is externally measured; no load-bearing self-citation.

specific steps
  1. self definitional [Sec. 1; Sec. 3 Eq. (1); Sec. 5.1 Eq. (4)]
    "We observe that semantic caching introduces an intrinsic vulnerability by design. The semantic key matching can be modeled as a locality-preserving fuzzy hash: it produces the same hash for similar queries. It fails to satisfy the avalanche effect ... As a result, semantic caching is naturally vulnerable to cache collision. ... match(p1,p2)=(true, if sim(kp1,kp2)≥τ) ... Lcos_col = 1−sim(g(psrc⊕s), g(pv))"

    The claimed inherent vulnerability is exactly the cache-matching rule: Eq. (1) declares any pair with similarity above τ a hit, and the attack's collision loss (Eq. 4) minimizes 1−sim, i.e., maximizes the same quantity that Eq. (1) uses to decide a collision. The 'locality vs. collision-resistance trade-off' is therefore not an independent derivation from fuzzy-hash theory; it restates the definition of semantic matching plus an optimizer. The empirical hit rates, however, are measured against external cache implementations and are not forced by this definition, so the circularity is confined to the conceptual framing.

full rationale

The central empirical contribution is not circular. CacheAttack's Hit Rate / Injection Success Rate are measured by sending planted and benign queries to GPTCache and a re-implemented SemShareKV (Sec. 6.2), not derived from Eq. (1); Table 3 measures cross-model transfer against four real embedding models; the financial case study is an end-to-end demonstration. No load-bearing self-citation appears: the cited prior work on side-channel privacy leakage (e.g., Wu et al. 2025) is external context, and the GCG/PPL/adversarial-example citations are independent. The theoretical section (Sec. 3) is close to a tautology: given that 'match' is defined by sim≥τ (Eq. 1), the possibility of colliding prompts is implicit in the definition; the generator then optimizes exactly that similarity (Eq. 4). This is a framing/novelty weakness, not a falsified empirical result. Separately, the Section 5.1 latency validator (MAP Gaussian classifier) is never evaluated for accuracy, and CacheAttack-2's end-to-end success under that validator is not reported; if the Table 1 HRs are oracle hit rates, practical black-box success may be overstated. That is a missing-support gap, not circularity, and it does not raise the score further.

Axiom & Free-Parameter Ledger

5 free parameters · 6 axioms · 0 invented entities

The attack's central claim relies on several assumptions about deployment (shared cache, observable latency, surrogate transfer) and on attack hyperparameters that are not fully reported. The conceptual fuzzy-hash analysis itself is definitional rather than an independent derivation.

free parameters (5)
  • λ (PPL trade-off coefficient)
    Eq. (3) balances collision loss with perplexity; no sensitivity analysis or chosen value reported, but attack results depend on it.
  • α (LSH relaxation temperature)
    Eq. (5) uses tanh(α R e(p)); must be large enough to approximate sign; value not reported.
  • τ (similarity threshold) = 0.8
    Set to 0.8 in Appendix A, following prior work; a more permissive threshold increases hit rates, so results are tied to this choice.
  • Validator Gaussian parameters (µ_h, σ_h) = calibrated
    Sec. 5.1 fits class-conditional Gaussian parameters to calibration queries; no values or accuracy reported.
  • GCG search budget = 1000 steps
    Chosen to bound the attacker's budget; affects success rate and runtime.
axioms (6)
  • domain assumption Semantic cache matching is accurately modeled by Eq. (1) (cosine threshold) or Eq. (2) (LSH).
    The attack targets this abstraction; real systems may have additional gates, salting, per-user namespaces, or different thresholds.
  • domain assumption Avalanche effect is the relevant security requirement for cache keys.
    Semantic keys are not cryptographic hashes; requiring avalanche would eliminate semantic reuse, so the trade-off is definitional, not a discovered tension.
  • domain assumption Adversarial examples in embedding space can be found by GCG-style optimization of discrete suffixes.
    Cited prior work (Alzantot, Ebrahimi, Zou) supports existence of text adversarial examples, but transfer to semantic-cache keys in black-box settings is empirical.
  • domain assumption Cache hits are distinguishable from misses via a latency side channel modeled as class-conditional Gaussians.
    Sec. 5.1 assumes this; no accuracy evaluation is reported in the paper.
  • domain assumption Semantic cache is shared across tenants / attacker-planted entries are visible to victim queries.
    Threat model in Sec. 4.1; per-user isolation would invalidate this.
  • domain assumption Surrogate embedding models approximate the target model's neighborhood structure sufficiently for transfer.
    Sec. 4.2 and RQ3; Table 3 shows transfer is model-pair dependent.

pith-pipeline@v1.3.0-alltime-deepseek · 16246 in / 15456 out tokens · 170220 ms · 2026-08-03T06:12:21.087302+00:00 · methodology

0 comments
read the original abstract

Semantic caching has emerged as a pivotal technique for scaling LLM applications, widely adopted by major providers including AWS and Microsoft. By utilizing semantic embedding vectors as cache keys, this mechanism effectively minimizes latency and redundant computation for semantically similar queries. In this work, we conceptualize semantic cache keys as a form of fuzzy hashes. We demonstrate that the locality required to maximize cache hit rates fundamentally conflicts with the cryptographic avalanche effect necessary for collision resistance. Our conceptual analysis formalizes this inherent trade-off between performance (locality) and security (collision resilience), revealing that semantic caching is naturally vulnerable to key collision attacks. While prior research has focused on side-channel and privacy risks, we present the first systematic study of integrity risks arising from cache collisions. We introduce CacheAttack, an automated framework for launching black-box collision attacks. We evaluate CacheAttack in security-critical tasks and agentic workflows. It achieves a hit rate of 86\% in LLM response hijacking and can induce malicious behaviors in LLM agent, while preserving strong transferability across different embedding models. A case study on a financial agent further illustrates the real-world impact of these vulnerabilities. Finally, we discuss mitigation strategies.

Figures

Figures reproduced from arXiv: 2601.23088 by Dongdong She, Quanfeng Huang, Yuchong Xie, Zesen Liu, Zhixiang Zhang.

Figure 1
Figure 1. Figure 1: A brief overview of key collision in semantic caching. Semantically different A1 (attacker) and P1 (victim) unexpectedly maps to the same semantic key K1. As a result, victim response is hijacked by the attacker. We show collision in red lines. repeated queries incur significant redundant computation and inference latency. To mitigate this redundancy, mod￾ern LLM agents increasingly rely on caching (Gim et… view at source ↗
Figure 2
Figure 2. Figure 2: Case study of a financial agent under cache collision, leading to financial harm. sell order, exposing the victim to real financial harm. This example highlights the inherent security vulnerabil￾ities of semantic caching at the agent level and reveals a fundamental security flaw: without rigorous validation, a cache layer optimized for efficiency can be weaponized to manipulate model outputs and bypass ali… view at source ↗
Figure 3
Figure 3. Figure 3: Perplexity Comparison on Natural Questions(NQ) Dataset. Standard PPL and window PPL (size=5) for baseline, Semantic Cache, and Semantic KV Cache. 7.3. Per-user Cache Isolation and Trade-off A direct mitigation against cross-user cache collision is to scope the semantic caching to a per-user (or per-session) namespace. Concretely, we augment the cache key k with an identifier u and only allow reuse within t… view at source ↗
Figure 4
Figure 4. Figure 4: Sensitivity analysis of CacheAttack performance under varying similarity thresholds τ , demonstrating the trade-off between efficiency and robustness. measure how vulnerabilities in the serving stack (e.g., reuse mechanisms such as semantic caching) can be exploited to elicit policy-violating behaviors in practice. By focusing on benign-appearing, contextually plausible, and obfuscated formulations that no… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 3 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Grounded Cache Routing for Retrieval-Augmented Generation: When Is It Safe to Reuse an Answer?

    cs.CR 2026-05 unverdicted novelty 6.0

    GroundedCache reduces unsafe-served rate in RAG answer caching to 0-1.5% (vs 15-51.5% naive) via four validation gates while keeping p50 latency within 1.07x of no-cache baseline.

  2. Token-Operations-Oriented Inference Optimization Techniques for Large Models

    cs.SE 2026-06 unverdicted novelty 3.0

    The paper introduces a four-layer technical architecture for token-operations-oriented inference optimization in large models and reviews key technologies and industry status at each layer.

  3. Token-Operations-Oriented Inference Optimization Techniques for Large Models

    cs.SE 2026-06 conditional novelty 3.0

    A survey of large-model inference optimization, organized as a four-layer 'token-operations' taxonomy: multi-model fusion, model optimization, compute-model fusion, and compute-network-model fusion.

Reference graph

Works this paper leans on

26 extracted references · 14 linked inside Pith · cited by 2 Pith papers

  1. [1]

    https://github.com/meta-l lama/llama3/blob/main/MODEL_CARD.md

    Llama 3 model card. https://github.com/meta-l lama/llama3/blob/main/MODEL_CARD.md. Alon, G. and Kamfonas, M. Detecting language model attacks with perplexity.arXiv preprint arXiv:2308.14132,

    Pith/arXiv arXiv

  2. [7]

    L., Kuditipudi, R., Liang, P., and Hashimoto, T

    Gu, C., Li, X. L., Kuditipudi, R., Liang, P., and Hashimoto, T. Auditing prompt caching in language model apis.arXiv preprint arXiv:2502.07776,

    Pith/arXiv arXiv

  3. [8]

    Deepseek-r1: In- centivizing reasoning capability in llms via reinforcement learning.arXiv preprint arXiv:2501.12948,

    Guo, D., Yang, D., Zhang, H., Song, J., Zhang, R., Xu, R., Zhu, Q., Ma, S., Wang, P., Bi, X., et al. Deepseek-r1: In- centivizing reasoning capability in llms via reinforcement learning.arXiv preprint arXiv:2501.12948,

    Pith/arXiv arXiv

  4. [10]

    Q., Sablayrolles, A., Mensch, A., Bamford, C., Chaplot, D

    Jiang, A. Q., Sablayrolles, A., Mensch, A., Bamford, C., Chaplot, D. S., de las Casas, D., Bressand, F., Lengyel, G., Lample, G., Saulnier, L., Lavaud, L. R., Lachaux, M.-A., Stock, P., Scao, T. L., Lavril, T., Wang, T., Lacroix, T., and Sayed, W. E. Mistral 7b.arXiv preprint arXiv:2310.06825,

    Pith/arXiv arXiv

  5. [12]

    Shadow in the cache: Unveiling and mitigating privacy risks of kv-cache in llm inference

    Luo, Z., Shao, S., Zhang, S., Zhou, L., Hu, Y ., Zhao, C., Liu, Z., and Qin, Z. Shadow in the cache: Unveiling and mitigating privacy risks of kv-cache in llm inference. arXiv preprint arXiv:2508.09442,

    arXiv

  6. [14]

    G., Desai, A., Cuadron, A., Chu, K., Liu, S., Zhao, M., Krusche, S., Kemper, A., Stoica, I., Zaharia, M., et al

    Schroeder, L. G., Desai, A., Cuadron, A., Chu, K., Liu, S., Zhao, M., Krusche, S., Kemper, A., Stoica, I., Zaharia, M., et al. vcache: Verified semantic prompt caching. arXiv preprint arXiv:2502.03771,

    arXiv

  7. [16]

    Upadhyay, D., Gaikwad, N., Zaman, M., and Sampalli, S

    Accessed: 2026-01-16. Upadhyay, D., Gaikwad, N., Zaman, M., and Sampalli, S. Investigating the avalanche effect of various cryptograph- ically secure hash functions and hash-based applications. IEEE Access, 10:112472–112486,

    2026

  8. [18]

    Contextcache: Context-aware semantic cache for multi-turn queries in large language models.arXiv preprint arXiv:2506.22791,

    Yan, J., Ni, W., Chen, L., Lin, X., Cheng, P., Qin, Z., and Ren, K. Contextcache: Context-aware semantic cache for multi-turn queries in large language models.arXiv preprint arXiv:2506.22791,

    Pith/arXiv arXiv

  9. [19]

    Qwen3 technical report.arXiv preprint arXiv:2505.09388,

    Yang, A., Li, A., Yang, B., Zhang, B., Hui, B., Zheng, B., Yu, B., Gao, C., Huang, C., Lv, C., et al. Qwen3 technical report.arXiv preprint arXiv:2505.09388,

    Pith/arXiv arXiv

  10. [20]

    Accessed: 2025-12-26

    URL https://bair .berkeley.edu/blog/2024/02/18/compou nd-ai-systems/. Accessed: 2025-12-26. Zhao, W. X., Zhou, K., Li, J., Tang, T., Wang, X., Hou, Y ., Min, Y ., Zhang, B., Zhang, J., Dong, Z., et al. A survey of large language models.arXiv preprint arXiv:2303.18223, 1(2),

    Pith/arXiv arXiv 2024

  11. [21]

    and Mastorakis, S

    Zhao, X. and Mastorakis, S. Semsharekv: Efficient kvcache sharing for semantically similar prompts via token-level lsh matching.arXiv preprint arXiv:2509.24832,

    arXiv

  12. [22]

    L., Huang, J., Yu, C

    Zheng, L., Yin, L., Xie, Z., Sun, C. L., Huang, J., Yu, C. H., Cao, S., Kozyrakis, C., Stoica, I., Gonzalez, J. E., et al. Sglang: Efficient execution of structured language model programs.Advances in neural information processing systems, 37:62557–62583, 2024a. Zheng, X., Han, H., Shi, S., Fang, Q., Du, Z., Hu, X., and Guo, Q. Inputsnatch: Stealing input...

    Pith/arXiv arXiv

  13. [23]

    H., and Amiri, M

    Zhu, Y ., Falahati, A., Yang, D. H., and Amiri, M. M. Sen- tencekv: Efficient llm inference via sentence-level se- mantic kv caching.arXiv preprint arXiv:2504.00970,

    arXiv

  14. [24]

    Z., and Fredrikson, M

    Zou, A., Wang, Z., Carlini, N., Nasr, M., Kolter, J. Z., and Fredrikson, M. Universal and transferable adversar- ial attacks on aligned language models.arXiv preprint arXiv:2307.15043,

    Pith/arXiv arXiv

  15. [25]

    In our experiments, we adopt the more conservative setting τ= 0.8 to impose a stricter reuse criterion and evaluate CacheAttackunder a higher bar

    uses τ= 0.7 in their default configuration. In our experiments, we adopt the more conservative setting τ= 0.8 to impose a stricter reuse criterion and evaluate CacheAttackunder a higher bar. Embedding model.Embedding models can be categorized by Transformer architecture intoencoder-onlyandencoder– decodermodels (Raffel et al., 2020; Devlin et al., 2019); ...

    2020

  16. [26]

    function_name

    as the backend LLM. Since Table 5.Hit Rate (HR) ofCacheAttack-2 within semantic cache across different backend LLMs. Backend LLM HR (%) Qwen3-8B 83.1 Qwen3-32B 83.8 DeepSeek-R1-0528 84.6 Llama-3.1-8B-Instruct 81.0 Mistral2-7B-Instruct-v0.2 81.4 CacheAttacktargets the semantic caching rather than the backend LLM itself, a natural question is whether its ef...

    2025

  17. [1985]

    I know what you asked: Prompt leakage via kv- cache sharing in multi-tenant llm serving

    Wu, G., Zhang, Z., Zhang, Y ., Wang, W., Niu, J., Wu, Y ., and Zhang, Y . I know what you asked: Prompt leakage via kv- cache sharing in multi-tenant llm serving. InProceedings of the 2025 Network and Distributed System Security (NDSS) Symposium. San Diego, CA, USA,

    2025

  18. [2002]

    Semantic caching of contextual summaries for efficient question-answering with language models

    Couturier, C., Mastorakis, S., Shen, H., Rajmohan, S., and R¨uhle, V . Semantic caching of contextual summaries for efficient question-answering with language models. arXiv preprint arXiv:2505.11271,

    Pith/arXiv arXiv

  19. [2018]

    A., Singh, M., and Dion, B

    Gill, W., Cechmanek, J., Hutcherson, T., Rajamohan, S., Agarwal, J., Gulzar, M. A., Singh, M., and Dion, B. Advancing semantic caching for llms with domain- specific embeddings and synthetic data.arXiv preprint arXiv:2504.02268, 2025a. Gill, W., Elidrisi, M., Kalapatapu, P., Ahmed, A., Anwar, A., and Gulzar, M. A. Meancache: User-centric semantic caching ...

    Pith/arXiv arXiv 2023

  20. [2019]

    and Atkison, T

    Lee, A. and Atkison, T. A comparison of fuzzy hashes: eval- uation, guidelines, and future suggestions. InProceedings of the 2017 ACM Southeast Conference, pp. 18–25,

    2017

  21. [2020]

    and Pun, C

    Regmi, S. and Pun, C. P. Gpt semantic cache: Reducing llm costs and latency via semantic embedding caching.arXiv preprint arXiv:2411.05276,

    Pith/arXiv arXiv

  22. [2021]

    Song, L., Pang, Z., Wang, W., Wang, Z., Wang, X., Chen, H., Song, W., Jin, Y ., Meng, D., and Hou, R

    Accessed: 2026-01-16. Song, L., Pang, Z., Wang, W., Wang, Z., Wang, X., Chen, H., Song, W., Jin, Y ., Meng, D., and Hou, R. The early bird catches the leak: Unveiling timing side channels in llm serving systems.IEEE Transactions on Information Forensics and Security,

    2026

  23. [2022]

    Jafari, O., Maurya, P., Nagarkar, P., Islam, K

    Accessed: 2026-01-16. Jafari, O., Maurya, P., Nagarkar, P., Islam, K. M., and Cru- shev, C. A survey on locality sensitive hashing algorithms and their applications.arXiv preprint arXiv:2102.08942,

    Pith/arXiv arXiv 2026

  24. [2023]

    Generating natural language adversarial examples.arXiv preprint arXiv:1804.07998,

    Alzantot, M., Sharma, Y ., Elgohary, A., Ho, B.-J., Srivas- tava, M., and Chang, K.-W. Generating natural language adversarial examples.arXiv preprint arXiv:1804.07998,

    Pith/arXiv arXiv

  25. [2024]

    Ac- cessed: 2026-01-16. Bang, F. Gptcache: An open-source semantic cache for llm applications enabling faster answers and cost savings. In Proceedings of the 3rd Workshop for Natural Language Processing Open Source Software (NLP-OSS 2023), pp. 212–218,

    2026

  26. [2025]

    Bert: Pre-training of deep bidirectional transformers for lan- guage understanding

    Devlin, J., Chang, M.-W., Lee, K., and Toutanova, K. Bert: Pre-training of deep bidirectional transformers for lan- guage understanding. InProceedings of the 2019 confer- ence of the North American chapter of the association for computational linguistics: human language technologies, volume 1 (long and short papers), pp. 4171–4186,

    2019