Pith. sign in

REVIEW 2 major objections 5 minor 69 references

HijackKV: New Threat in Position-Independent KV Cache Reuse

T0 review · 2 major / 5 minor · reviewed 2026-08-03 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Position-independent KV cache reuse can be hijacked without adversarial text in the victim's prompt.

desk verdict New attack surface with a clean formulation and broad simulation, but the simulator omits the RoPE position-correction that real position-independent caches apply — a gap that needs closing before the 94% success rate is taken at face value. read the letter →

arxiv 2607.19957 v2 pith:3GI2OXER submitted 2026-07-22 cs.CR cs.AIcs.LG

Yichi Zhang , Zhiqi Wang , Huan Zhang , Yuchen Yang This is my paper
classification cs.CRcs.AIcs.LG
keywords KVcachehijackingposition-independentcachingpoisoningLLMinferencesecuritycross-userattackadversarialprefixmulti-tenantservingreuse
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that position-independent KV cache reuse—an efficiency optimization that lets any cached text chunk be reused regardless of where it appears in a new prompt—has a built-in security hole. Because a chunk's key-value (KV) states encode the context in which they were computed, an attacker can prepend a carefully optimized prefix to a common benign chunk. The resulting KV cache for that chunk, when later matched inside a victim's query, steers the model to output an attacker-chosen answer even though the victim's input contains no adversarial tokens. The authors build an attack framework around this idea and report high success rates across models, datasets, and serving configurations, including low cache hit rates and partial recomputation.

What carries the argument

The load-bearing object is the hijacked KV cache T^p_X: the key/value tensors of a fixed benign chunk X computed after prepending attacker prefix p. The attack works by forcing a position-independent cache hit between X and a matching subsequence in a later victim prompt, so the victim's inference reuses T^p_X instead of computing X's true context-conditioned KV. The optimization loop simulates the full pipeline—prefix embedding, chunk KV extraction, victim inference with cache reuse, and cross-entropy loss—to refine p until the victim output matches the target answer. This makes the cached chunk's text look benign while its internal state carries the adversarial instruction.

What would settle it

A real serving system where, on every cache hit, the platform recomputes even 50% of the matched tokens under the user's actual context: if replicated experiments show targeted attack success dropping to zero rather than the paper's reported ~39%, the claimed robustness would be falsified.

Watch

Extended reading notes

Core claim

The core discovery is a text–KV binding mismatch in position-independent reuse. In a decoder-only transformer, identical token sequences do not produce identical KV states when preceded by different contexts. The paper defines a position-independent cache hit as any token match between a cached chunk and a subsequence of the user's prompt, and shows that such a hit reuses KV computed under an attacker's prefix. HIJACKKV therefore formulates the attack as an optimization: find a prefix p* that minimizes the cross-entropy between the model's output when serving the victim query with the hijacked KV of chunk X and the target answer r̃ (Eq. 16). A greedy coordinate-gradient search over discrete

Load-bearing premise

The attack only works if the attacker's poisoned entry actually enters the shared cache and is the entry served to a later victim—that is, it is not evicted before reuse and does not lose a race to an already-cached benign copy of the same chunk; the paper's Section 8 concedes that real eviction policies and cache occupancy are unknown.

Editorial extensions

If this is right

  • An average 94% success rate in a single attempt across four QA benchmarks and three model families, with near-100% rates in several configurations.
  • The attack survives low cache hit rates (as low as 10% of the user context replaced) and selective recomputation up to 50% of matched tokens, suggesting that parameter choices used by current serving systems do not close the hole.
  • Once the poisoned chunk is cached, its influence persists through multi-turn interactions of 1,000+ tokens of unrelated context, and the same prefix transfers across models in a black-box setting.
  • Heuristic defenses such as KV pruning and cache compression do not neutralize the attack, because hijacked entries receive high attention and are exactly the high-influence states those methods preserve; only aggressive recomputation at high cost substantially reduces success.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If this result generalizes beyond the benchmark settings, any multi-tenant service that reuses KV chunks across users without verifying the provenance of each chunk should treat every cached chunk as potentially untrusted input—the guarantee that 'only user-authorized text influenced the answer' cannot be maintained at the text layer alone.
  • A natural defense the authors leave implicit is context fingerprinting: bind each cached chunk to a hash of its preceding context so that a position-independent reuse is only allowed when the user's own context matches, or else force recomputation of the chunk under the user's context.
  • The same optimization idea could be aimed at denial-of-service or quality degradation: an attacker might craft a prefix that makes a chunk produce nonsensical or toxic continuations, not just a specific wrong answer, broadening the impact beyond answer-swapping.
  • A testable extension: serving systems that encode each chunk independently (e.g., a retriever that encodes document chunks with no cross-chunk attention) should see a sharp drop in attack success, since the paper itself notes such pipelines are less applicable; an experiment confirming that would validate the underlying context-dependence mechanism.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. The paper identifies a new attack surface in position-independent KV cache reuse: because cached key/value states for a text chunk are context-dependent, an attacker can prepend an optimized adversarial prefix to a common benign chunk, and the resulting poisoned KV cache, when later reused for another user whose prompt contains the same chunk, steers the model to an attacker-chosen answer even though no adversarial token appears in the victim's input. The authors formalize this as an optimization problem (Eq. 16), solve it with a GCG-based algorithm (Algorithm 1), and report high targeted attack success rates across QA datasets, several LLMs, chunk sizes, cache ratios, recomputation ratios, multi-turn contexts, and black-box transfer, while also studying defenses and proposing mitigation directions.

Significance. If the simulator faithfully represents deployed position-independent cache systems, this is a significant new threat: it is the first unprivileged, cache-side attack that requires no system-level access and no adversarial text in the victim's prompt, and it directly challenges the security assumptions behind recent efficiency optimizations (EPIC, CacheBlend, LM-Cache). The paper's strengths include a crisp formalization, an explicit optimization framework, open-source code, honest discussion of cache-availability limitations, and robustness experiments across many system parameters. However, the central claim is conditional on two unresolved issues: the simulator's handling of rotary position embeddings, and the absence of end-to-end validation on a real position-independent cache engine. These issues are load-bearing for the paper's practical claims.

major comments (2)
  1. [§5, Algorithm 1, Eq. (16); Tables 1–4] The victim-side simulation is position-blind with respect to rotary position embeddings. COMPUTELOSS computes the hijacked KV T^p_X from the prefix-chunk context p⊕X, then replays it as the KV for the chunk at the start of the victim prompt (line 19). Because the chunk's keys were originally computed at positions L+1...L+|X|, they carry the attacker-side absolute RoPE rotations (Appendix B, Eq. 18). Real position-independent systems do not reuse raw keys at arbitrary positions without correction: EPIC explicitly performs RoPE fusion (Section 2.1), and CacheBlend selectively recomputes position-sensitive tokens. The paper models EPIC and CacheBlend only as token-selection recomputation methods, not as full systems with positional corrections. The optimizer therefore produces prefixes that work when cached keys are used at the attacker's original positions, and the high T-ASR values in Tab
  2. [Section 8; Tables 1–6] The evaluation grants the attack its most fragile precondition: all reported ASR numbers assume the attacker's poisoned KV for chunk X is already in the shared cache and is the entry matched by a later victim query. The only variable studied is how much of the victim context is replaced (cache ratio δ). Section 8 concedes that real insertion depends on unknown eviction policies and cache occupancy, that the attacker may collide with an existing benign entry, and that the occupancy-probing side channel is only preliminary (81.4% single-query accuracy). The paper does not provide an end-to-end test on an actual position-independent cache implementation (e.g., LM-Cache/CacheBlend or EPIC). As a result, the abstract's 'practicality' claim and the 94% success-rate figure are not yet established for deployed systems. This is fixable by adding an end-to-end evaluation or by explicitly reframing
minor comments (5)
  1. [§7.2] The paragraph 'Impact of Recomputation Ratio ρ' refers to 'Table 3', but the recomputation-ratio results are in Table 4; Table 3 reports cache-ratio results. Please correct the cross-reference.
  2. [Notation, Eq. (16) and §6] The symbol X is used both for the full user context and for the hijacked chunk; the relation between X, the subsequence X, and the query q in Eq. (16) is not fully clear. Please define the exact structure of the victim's prompt and the position at which the cached chunk is replayed.
  3. [Figure 3 caption] The caption shows 'Text Chunk 1' while the surrounding text and the figure describe 'Text Chunk 3'. Please reconcile the labels.
  4. [Table 1] The model name 'Ministral-8B' appears to be a typo for 'Mistral-8B' or a specific variant; please use the correct model name consistently.
  5. [Section 8] The statement that the attack is 'less applicable to chunk-then-cache RAG pipelines where chunks are encoded independently' is an important scope restriction and should appear earlier, in the threat model or introduction, so readers do not over-generalize the attack surface.

Circularity Check

1 steps flagged · score 2.0 of 10

Default T-ASR is the optimization objective; transfer and robustness sweeps provide independent grounding, so circularity is minor.

  1. fitted input called prediction [Algorithm 1 COMPUTELOSS lines 19-20 and Section 6 Metrics (T-ASR); results in Section 7.1 Table 1]
    "r←LLM( ˜X⊕q|T p˜X ); ... L←CROSSENTROPY(r,˜r); ... Targeted Attack Success Rate (T-ASR): Defined as the condition where y=˜r and y̸=x."

    The prefix p is selected by minimizing cross-entropy between the model output and the target answer r̃ on the exact (X, q) pair used for evaluation. T-ASR then counts how often the model outputs r̃ on that same (X, q). The headline 94% success rate is therefore the value of the optimized objective on the very inputs it was optimized for — a fitted parameter reported as attack success. The paper's paraphrase, cross-model, and system-configuration experiments are not optimized and provide independent evidence, so this is partial rather than total circularity.

full rationale

Apart from the default same-query evaluation being coincident with the optimization objective, the derivation is self-contained. Section 4.2 establishes the attack surface from the cache-hit definitions and injectivity (Eqs. 12-15), not from a self-citation. The only self-citation, PyramidKV [2], is one of several compression baselines in Figure 5(c) and is not load-bearing for the security claim. The RoPE position-correction gap raised by the skeptic is a realism/correctness concern about whether the simulated reuse matches deployed systems (EPIC/CacheBlend perform RoPE fusion), not a circularity. The paper validates generalization on paraphrased queries (Table 9), black-box cross-model transfer (Table 6), and sweeps over chunk size, cache ratio, and recomputation ratio (Tables 2-4), none of which are used in prefix optimization. Therefore the central claim — that optimized prefixes can hijack position-independent KV reuse — has independent content; score 2 reflects only the tautological default T-ASR.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central claim rests on standard transformer causality, an unproven injectivity assumption, and a specific multi-tenant cache system model. The attack's effectiveness does not follow from a derivation; it is empirically optimized, and the favorable cache-insertion assumption is the largest load-bearing unverified premise.

free parameters (4)
  • Adversarial prefix length L_p = 32 (default)
    Attacker-chosen; larger prefixes raise T-ASR but cost compute (Fig. 4a).
  • GCG optimization steps T = 250
    Attacker-chosen; attack success saturates with more steps (Fig. 4b).
  • Top-k candidate tokens k = 512
    Attacker-chosen; optimal around moderate pool sizes (Fig. 4c).
  • Search width η = 0.5
    Attacker-chosen; higher verification ratios improve T-ASR (Fig. 4d).
assumptions (5)
  • domain assumption Standard decoder-only Transformers are deterministic and causal: identical prefixes produce identical KV states (Eq. 13).
    Used in Section 4.2 to argue prefix-KV reuse is secure and that only position-independent reuse creates the attack surface.
  • domain assumption LLMs are injective in their input contexts, so differing prefixes yield differing internal states (citing [32]).
    Invoked in Section 4.2 (Eq. 15) to justify that KV of the same chunk differs under different prefixes; [32] is a not-yet-formally-verified preprint.
  • domain assumption The serving system stores per-chunk KV in a shared, cross-user cache pool and matches chunks by token identity only, ignoring position (Definition 2).
    This is the position-independent reuse model from [14, 49, 57, 58, 62]; the attack targets it.
  • domain assumption The victim's context is drawn from shared/common corpora so the attacker's chosen benign chunk X appears in victim queries.
    Required for cache hits; supported only by the paper's argument (FAQs, shared RAG corpora, code repos) rather than measured workload traces.
  • ad hoc to paper An insertion window exists: the attacker's poisoned KV for X can enter the cache and persist until a victim query (no eviction/collision with an existing benign entry).
    The evaluation assumes this directly (Section 7 setups), and Section 8 acknowledges it as a real-world uncertainty; the paper treats it as a condition of practicality rather than a demonstrated property.

how reviews work

0 comments
Cite this review

Pith. "Pith review of HijackKV: New Threat in Position-Independent KV Cache Reuse." pith.science (2026). https://pith.science/paper/3GI2OXER

@misc{pith2026260719957,
  author       = {Pith},
  title        = {Pith review of: HijackKV: New Threat in Position-Independent KV Cache Reuse},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3GI2OXER}},
  note         = {Machine review of arXiv:2607.19957}
}
read the original abstract

Key-Value (KV) cache reduces inference latency in large language models (LLMs). Traditional prefix-based reuse has low cache hit rates across inference requests because it requires exact token and position matches. To improve efficiency, recent system optimizations introduce position-independent KV reuse, allowing KV cache to be reused whenever identical text chunks appear, regardless of their position in the sequence. We show this design introduces a new threat, KV Cache Hijacking. Since KV caches are retrieved by token match but encode the context in which they were originally computed, the KV tied to a benign-looking token chunk may encode an attacker-controlled prefix. When later reused in a victim query, this contaminated KV silently hijacks the model's behavior, even if no attacker-controlled text appears in the input. We introduce HIJACKKV, the first attack framework that systematically exploits this vulnerability, demonstrating its severity and practicality. HIJACKKV optimizes an attacker-controlled prefix, so that the KV computed for a subsequent common benign text encodes the attacker's goal, while the text remains unchanged for future cache hits. HIJACKKV achieves an average 94% success rate in a single attempt, remains effective under realistic constraints including low hit rates (10%) and frequent recomputation (50%), persists over multi-turn interactions, and transfers across models in black-box settings. We further provide design insights for building secure KV reuse systems.

Figures

Figures reproduced from arXiv: 2607.19957 by the authors.

Figure 1
Figure 1. New threat from position-independent KV reuse in multi-tenant systems. (1) Prefix reuse is slow because reuse requires the same preceding prefix. (2) Position-independent reuse is fast but unsafe because it will reuse a hijacked KV despite position mismatch, enabling cross-user attacker￾controlled outputs without any adversarial text. the time-to-first-token (TTFT) and scales super-linearly with input length [5, 20]… view at source ↗
Figure 2
Figure 2. Empirical analysis of KV Cache deviation. [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. HIJACKKV consists of two phases: (1) constructs an adversarial prefix p and submits a malicious query p⊕X˜ to the LLM service; (2) the service processes p⊕X˜ into KV states and stores them in the shared cache pool Pchunk. When a user sends a query X ⊕q, if a cache hit occurs between X˜ and X as Definition 2, the user receives the malicious response ˜r. implies a divergence in the internal states. Consequently, even … view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Ablation studies of HIJACKKV hyperparameters. We evaluate the impact of four HIJACKKV hyperparameters on effectiveness: (a) adversarial prefix length, (b) number of GCG optimization steps, (c) top-k candidates, and (d) search width [PITH_FULL_IMAGE:figures/full_fig_p0…
Figure 5
Figure 5. Figure 5: (a) Adaptive Attack Against Recomputation (x-axis: recomputation ratio used in the attack; y-axis: target system). Employing recomputation during optimization significantly boosts the robustness of HIJACKKV, maintaining a high ASR even under mismatched recomputation ra…

Review history (2 revisions) →

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

69 extracted references · 14 linked inside Pith

  1. [1]

    Claude api docs: Prompt caching

    Anthropic. Claude api docs: Prompt caching. https://platform.claude.com/docs/en/ build-with-claude/prompt-caching, 2025

    2025

  2. [2]

    Pyramidkv: Dynamic kv cache compression based on pyramidal information funneling

    Zefan Cai, Yichi Zhang, Bofei Gao, Yuliang Liu, Yucheng Li, Tianyu Liu, Keming Lu, Wayne Xiong, Yue Dong, Junjie Hu, et al. Pyramidkv: Dynamic kv cache compression based on pyramidal information funneling. arXiv preprint arXiv:2406.02069, 2024

    arXiv 2024

  3. [3]

    Jail- breaking black box large language models in twenty queries

    Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong. Jail- breaking black box large language models in twenty queries. In2025 IEEE Conference on Secure and Trust- worthy Machine Learning (SaTML), 2025

    2025

  4. [4]

    Evaluating large language models trained on code

    Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Ponde De Oliveira Pinto, Jared Kaplan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, et al. Evaluating large language models trained on code. arXiv preprint arXiv:2107.03374, 2021

    arXiv 2021

  5. [5]

    Flashattention: Fast and memory- efficient exact attention with io-awareness.Advances in neural information processing systems, 2022

    Tri Dao, Dan Fu, Stefano Ermon, Atri Rudra, and Christopher Ré. Flashattention: Fast and memory- efficient exact attention with io-awareness.Advances in neural information processing systems, 2022

    2022

  6. [6]

    From local to global: A graph rag ap- proach to query-focused summarization.arXiv preprint arXiv:2404.16130, 2024

    Darren Edge, Ha Trinh, Newman Cheng, Joshua Bradley, Alex Chao, Apurva Mody, Steven Truitt, Dasha Metropolitansky, Robert Osazuwa Ness, and Jonathan Larson. From local to global: A graph rag ap- proach to query-focused summarization.arXiv preprint arXiv:2404.16130, 2024

    arXiv 2024

  7. [7]

    Whose narrative is it anyway? a kv cache manipulation attack.arXiv preprint arXiv:2511.12752, 2025

    Mukkesh Ganesh, Kaushik Iyer, and Arun Baalaaji Sankar Ananthan. Whose narrative is it anyway? a kv cache manipulation attack.arXiv preprint arXiv:2511.12752, 2025

    arXiv 2025

  8. [8]

    Gemini api docs: Context caching

    Google. Gemini api docs: Context caching. https:// ai.google.dev/gemini-api/docs/caching, 2025

    2025

Show all 69 references
  1. [9]

    The llama 3 herd of models.arXiv preprint arXiv:2407.21783, 2024

    Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, et al. The llama 3 herd of models.arXiv preprint arXiv:2407.21783, 2024

    2024 arXiv

  2. [10]

    Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injec- tion

    Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injec- tion. InProceedings of the 16th ACM workshop on artificial intellige...

    2023

  3. [11]

    Auditing prompt caching in language model APIs

    Chenchen Gu, Xiang Lisa Li, Rohith Kuditipudi, Percy Liang, and Tatsunori Hashimoto. Auditing prompt caching in language model APIs. InForty-second Inter- national Conference on Machine Learning, 2025

    2025

  4. [12]

    Kvquant: Towards 10 million context length llm inference with kv cache quantization.Ad- vances in Neural Information Processing Systems, 2024

    Coleman Hooper, Sehoon Kim, Hiva Mohammadzadeh, Michael W Mahoney, Yakun S Shao, Kurt Keutzer, and Amir Gholami. Kvquant: Towards 10 million context length llm inference with kv cache quantization.Ad- vances in Neural Information Processing Systems, 2024

    2024

  5. [13]

    Can transformer memory be corrupted? in- vestigating cache-side vulnerabilities in large language models.arXiv preprint arXiv:2510.17098, 2025

    Elias Hossain, Swayamjit Saha, Somshubhra Roy, and Ravi Prasad. Can transformer memory be corrupted? in- vestigating cache-side vulnerabilities in large language models.arXiv preprint arXiv:2510.17098, 2025

    2025

  6. [14]

    EPIC: Efficient position-independent caching for serving large language models

    Junhao Hu, Wenrui Huang, Weidong Wang, Haoyi Wang, tiancheng hu, zhang qin, Hao Feng, Xusheng Chen, Yizhou Shan, and Tao Xie. EPIC: Efficient position-independent caching for serving large language models. InForty-second International Conference on Machine Learning, 2025

    2025

  7. [15]

    Position: The platonic representation hy- pothesis

    Minyoung Huh, Brian Cheung, Tongzhou Wang, and Phillip Isola. Position: The platonic representation hy- pothesis. InForty-first International Conference on Machine Learning, 2024

    2024

  8. [16]

    Pleak: Prompt leaking attacks against large language model applications

    Bo Hui, Haolin Yuan, Neil Gong, Philippe Burlina, and Yinzhi Cao. Pleak: Prompt leaking attacks against large language model applications. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, 2024

    2024

  9. [17]

    Robustkv: Defending large language models against jailbreak attacks via kv eviction.arXiv preprint arXiv:2410.19937, 2024

    Tanqiu Jiang, Zian Wang, Jiacheng Liang, Changjiang Li, Yuhui Wang, and Ting Wang. Robustkv: Defending large language models against jailbreak attacks via kv eviction.arXiv preprint arXiv:2410.19937, 2024

    2024 arXiv

  10. [18]

    What disease does this patient have? a large-scale open domain question an- swering dataset from medical exams.Applied Sciences, 2021

    Di Jin, Eileen Pan, Nassim Oufattole, Wei-Hung Weng, Hanyi Fang, and Peter Szolovits. What disease does this patient have? a large-scale open domain question an- swering dataset from medical exams.Applied Sciences, 2021

    2021

  11. [19]

    Pubmedqa: A dataset for biomedical research question answering

    Qiao Jin, Bhuwan Dhingra, Zhengping Liu, William Cohen, and Xinghua Lu. Pubmedqa: A dataset for biomedical research question answering. InProceedings of the 2019 conference on empirical methods in natu- ral language processing and the 9th international joint conference on natu...

    2019

  12. [20]

    Efficient memory manage- ment for large language model serving with pagedatten- tion

    Woosuk Kwon, Zhuohan Li, Siyuan Zhuang, Ying Sheng, Lianmin Zheng, Cody Hao Yu, Joseph Gonzalez, Hao Zhang, and Ion Stoica. Efficient memory manage- ment for large language model serving with pagedatten- tion. InProceedings of the 29th symposium on operating systems principles, 2023

    2023

  13. [21]

    Fun-tuning: Characterizing the vulnerability of proprietary llms to optimization-based prompt injection attacks via the fine- tuning interface

    Andrey Labunets, Nishit V Pandya, Ashish Hooda, Xiaohan Fu, and Earlence Fernandes. Fun-tuning: Characterizing the vulnerability of proprietary llms to optimization-based prompt injection attacks via the fine- tuning interface. In2025 IEEE Symposium on Security and Privacy (SP), 2025

    2025

  14. [22]

    Retrieval-augmented generation for knowledge- intensive nlp tasks.Advances in neural information processing systems, 2020

    Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, et al. Retrieval-augmented generation for knowledge- intensive nlp tasks.Advances in neural information processing systems, 2020

    2020

  15. [23]

    Snapkv: Llm knows what you are looking for before generation.Advances in Neural Information Processing Systems, 2024

    Yuhong Li, Yingbing Huang, Bowen Yang, Bharat Venkitesh, Acyr Locatelli, Hanchen Ye, Tianle Cai, Patrick Lewis, and Deming Chen. Snapkv: Llm knows what you are looking for before generation.Advances in Neural Information Processing Systems, 2024

    2024

  16. [24]

    Autodan: Generating stealthy jailbreak prompts on aligned large language models

    Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. Autodan: Generating stealthy jailbreak prompts on aligned large language models. InThe Twelfth In- ternational Conference on Learning Representations, 2024

    2024

  17. [25]

    Formalizing and benchmarking prompt injection attacks and defenses

    Yupei Liu, Yuqi Jia, Runpeng Geng, Jinyuan Jia, and Neil Zhenqiang Gong. Formalizing and benchmarking prompt injection attacks and defenses. In33rd USENIX Security Symposium (USENIX Security 24), 2024

    2024

  18. [26]

    Scissorhands: Exploiting the persistence of importance hypothesis for llm kv cache compression at test time.Advances in Neural Information Processing Systems, 2023

    Zichang Liu, Aditya Desai, Fangshuo Liao, Weitao Wang, Victor Xie, Zhaozhuo Xu, Anastasios Kyrillidis, and Anshumali Shrivastava. Scissorhands: Exploiting the persistence of importance hypothesis for llm kv cache compression at test time.Advances in Neural Information Processi...

    2023

  19. [27]

    Kivi: A tuning-free asymmetric 2bit quanti- zation for kv cache.arXiv preprint arXiv:2402.02750, 2024

    Zirui Liu, Jiayi Yuan, Hongye Jin, Shaochen Zhong, Zhaozhuo Xu, Vladimir Braverman, Beidi Chen, and Xia Hu. Kivi: A tuning-free asymmetric 2bit quanti- zation for kv cache.arXiv preprint arXiv:2402.02750, 2024

    2024 arXiv

  20. [28]

    LMCache Team. Lmcache. https://lmcache.ai/, 2024

    2024

  21. [29]

    Shadow in the cache: Unveiling and mitigating pri- vacy risks of kv-cache in llm inference.arXiv preprint arXiv:2508.09442, 2025

    Zhifan Luo, Shuo Shao, Su Zhang, Lijing Zhou, Yuke Hu, Chenxu Zhao, Zhihao Liu, and Zhan Qin. Shadow in the cache: Unveiling and mitigating pri- vacy risks of kv-cache in llm inference.arXiv preprint arXiv:2508.09442, 2025

    2025

  22. [30]

    Mistral 3

    Mistral AI. Mistral 3. https://mistral.ai/news/ mistral-3, 2025

    2025

  23. [31]

    Cachetrap: Injecting trojans in llms without leaving any traces in inputs or weights.arXiv preprint arXiv:2511.22681, 2025

    Mohaiminul Al Nahian, Abeer Matar A Almalky, Gamana Aragonda, Ranyang Zhou, Sabbir Ahmed, Dmitry Ponomarev, Li Yang, Shaahin Angizi, and Ad- nan Siraj Rakin. Cachetrap: Injecting trojans in llms without leaving any traces in inputs or weights.arXiv preprint arXiv:2511.22681, 2025

    2025 arXiv

  24. [32]

    Language models are injective and hence in- vertible.arXiv preprint arXiv:2510.15511, 2025

    Giorgos Nikolaou, Tommaso Mencattini, Donato Crisos- tomi, Andrea Santilli, Yannis Panagakis, and Emanuele Rodolà. Language models are injective and hence in- vertible.arXiv preprint arXiv:2510.15511, 2025

    2025

  25. [33]

    Capabilities of gpt-4 on medical challenge problems.arXiv preprint arXiv:2303.13375, 2023

    Harsha Nori, Nicholas King, Scott Mayer McKinney, Dean Carignan, and Eric Horvitz. Capabilities of gpt-4 on medical challenge problems.arXiv preprint arXiv:2303.13375, 2023

    2023 arXiv

  26. [34]

    Cahtgpt api docs: Prompt caching

    OpenAI. Cahtgpt api docs: Prompt caching. https:// openai.com/index/api-prompt-caching/, 2025

    2025

  27. [35]

    Generative agents: Interactive simulacra of human be- havior

    Joon Sung Park, Joseph O’Brien, Carrie Jun Cai, Mered- ith Ringel Morris, Percy Liang, and Michael S Bernstein. Generative agents: Interactive simulacra of human be- havior. InProceedings of the 36th annual acm sympo- sium on user interface software and technology, 2023

    2023

  28. [36]

    Neural exec: Learning (and learning from) execu- tion triggers for prompt injection attacks

    Dario Pasquini, Martin Strohmeier, and Carmela Tron- coso. Neural exec: Learning (and learning from) execu- tion triggers for prompt injection attacks. InProceed- ings of the 2024 Workshop on Artificial Intelligence and Security, 2024

    2024

  29. [37]

    Ignore previous prompt: Attack techniques for language models.arXiv preprint arXiv:2211.09527, 2022

    Fábio Perez and Ian Ribeiro. Ignore previous prompt: Attack techniques for language models.arXiv preprint arXiv:2211.09527, 2022

    2022 arXiv

  30. [38]

    Efficiently scal- ing transformer inference.Proceedings of machine learning and systems, 2023

    Reiner Pope, Sholto Douglas, Aakanksha Chowdhery, Jacob Devlin, James Bradbury, Jonathan Heek, Kefan Xiao, Shivani Agrawal, and Jeff Dean. Efficiently scal- ing transformer inference.Proceedings of machine learning and systems, 2023

    2023

  31. [39]

    Know what you don’t know: Unanswerable questions for SQuAD

    Pranav Rajpurkar, Robin Jia, and Percy Liang. Know what you don’t know: Unanswerable questions for SQuAD. InProceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), 2018

    2018

  32. [40]

    SQuAD: 100,000+ questions for machine comprehension of text

    Pranav Rajpurkar, Jian Zhang, Konstantin Lopyrev, and Percy Liang. SQuAD: 100,000+ questions for machine comprehension of text. InProceedings of the 2016 Conference on Empirical Methods in Natural Language Processing, 2016

    2016

  33. [41]

    Tool- former: Language models can teach themselves to use tools.Advances in Neural Information Processing Sys- tems, 2023

    Timo Schick, Jane Dwivedi-Yu, Roberto Dessì, Roberta Raileanu, Maria Lomeli, Eric Hambro, Luke Zettle- moyer, Nicola Cancedda, and Thomas Scialom. Tool- former: Language models can teach themselves to use tools.Advances in Neural Information Processing Sys- tems, 2023

    2023

  34. [42]

    Enhancing prompt injection attacks to llms via poison- ing alignment

    Zedian Shao, Hongbin Liu, Jaden Mu, and Neil Gong. Enhancing prompt injection attacks to llms via poison- ing alignment. InProceedings of the 18th ACM Work- shop on Artificial Intelligence and Security, 2025

    2025

  35. [43]

    Optimization-based prompt injection attack to llm-as- a-judge

    Jiawen Shi, Zenghui Yuan, Yinuo Liu, Yue Huang, Pan Zhou, Lichao Sun, and Neil Zhenqiang Gong. Optimization-based prompt injection attack to llm-as- a-judge. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, 2024

    2024

  36. [44]

    Large language models encode clinical knowledge.Na- ture, 2023

    Karan Singhal, Shekoofeh Azizi, Tao Tu, S Sara Mah- davi, Jason Wei, Hyung Won Chung, Nathan Scales, Ajay Tanwani, Heather Cole-Lewis, Stephen Pfohl, et al. Large language models encode clinical knowledge.Na- ture, 2023

    2023

  37. [45]

    The early bird catches the leak: Unveiling timing side channels in llm serving systems

    Linke Song, Zixuan Pang, Wenhao Wang, Zihao Wang, XiaoFeng Wang, Hongbo Chen, Wei Song, Yier Jin, Dan Meng, and Rui Hou. The early bird catches the leak: Unveiling timing side channels in llm serving systems. IEEE Transactions on Information Forensics and Secu- rity, 2025

    2025

  38. [46]

    Roformer: Enhanced trans- former with rotary position embedding.Neurocomput- ing, 2024

    Jianlin Su, Murtadha Ahmed, Yu Lu, Shengfeng Pan, Wen Bo, and Yunfeng Liu. Roformer: Enhanced trans- former with rotary position embedding.Neurocomput- ing, 2024

    2024

  39. [47]

    Attention is all you need.Advances in neural information processing systems, 2017

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need.Advances in neural information processing systems, 2017

    2017

  40. [48]

    vLLM Team. vllm. https://docs.vllm.ai/en/ latest/, 2024

    2024

  41. [49]

    Mepic: Memory efficient position independent caching for llm serving.arXiv preprint arXiv:2512.16822, 2025

    Qian Wang, Zahra Yousefijamarani, Morgan Lindsay Heisler, Rongzhi Gu, Bai Xiaolong, Shan Yizhou, Wei Zhang, Wang Lan, Ying Xiong, Yong Zhang, et al. Mepic: Memory efficient position independent caching for llm serving.arXiv preprint arXiv:2512.16822, 2025

    2025

  42. [50]

    Cacheprune: Neural-based attribution de- fense against indirect prompt injection attacks.arXiv preprint arXiv:2504.21228, 2025

    Rui Wang, Junda Wu, Yu Xia, Tong Yu, Ruiyi Zhang, Ryan Rossi, Subrata Mitra, Lina Yao, and Julian McAuley. Cacheprune: Neural-based attribution de- fense against indirect prompt injection attacks.arXiv preprint arXiv:2504.21228, 2025

    2025 arXiv

  43. [51]

    Webinject: Prompt injection attack to web agents

    Xilong Wang, John Bloch, Zedian Shao, Yuepeng Hu, Shuyan Zhou, and Neil Zhenqiang Gong. Webinject: Prompt injection attack to web agents. InProceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, 2025

    2025

  44. [52]

    Jailbroken: How does llm safety training fail?Advances in Neural Information Processing Systems, 2023

    Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. Jailbroken: How does llm safety training fail?Advances in Neural Information Processing Systems, 2023

    2023

  45. [53]

    I know what you asked: Prompt leakage via kv-cache sharing in multi- tenant llm serving

    Guanlong Wu, Zheng Zhang, Yao Zhang, Weili Wang, Jianyu Niu, Ye Wu, and Yinqian Zhang. I know what you asked: Prompt leakage via kv-cache sharing in multi- tenant llm serving. InProceedings of the 2025 Network and Distributed System Security (NDSS) Symposium. San Diego, CA, USA, 2025

    2025

  46. [54]

    Efficient streaming lan- guage models with attention sinks.arXiv preprint arXiv:2309.17453, 2023

    Guangxuan Xiao, Yuandong Tian, Beidi Chen, Song Han, and Mike Lewis. Efficient streaming lan- guage models with attention sinks.arXiv preprint arXiv:2309.17453, 2023

    2023 arXiv

  47. [55]

    Efficient streaming language models with attention sinks

    Guangxuan Xiao, Yuandong Tian, Beidi Chen, Song Han, and Mike Lewis. Efficient streaming language models with attention sinks. InThe Twelfth Interna- tional Conference on Learning Representations, 2024

    2024

  48. [56]

    Qwen3 technical report

    An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chen- gen Huang, Chenxu Lv, et al. Qwen3 technical report. arXiv preprint arXiv:2505.09388, 2025

    2025 arXiv

  49. [57]

    Kvshare: An llm service system with efficient and effective multi-tenant kv cache reuse.arXiv preprint arXiv:2503.16525, 2025

    Huan Yang, Renji Zhang, Mingzhe Huang, Weijun Wang, Yin Tang, Yuanchun Li, Yunxin Liu, and Deyu Zhang. Kvshare: An llm service system with efficient and effective multi-tenant kv cache reuse.arXiv preprint arXiv:2503.16525, 2025

    2025 arXiv

  50. [58]

    KVLink: Accelerating large language models via efficient KV cache reuse

    Jingbo Yang, Bairu Hou, Wei Wei, Yujia Bao, and Shiyu Chang. KVLink: Accelerating large language models via efficient KV cache reuse. InThe Thirty-ninth Annual Conference on Neural Information Processing Systems, 2025

    2025

  51. [59]

    Mma-diffusion: Multi- modal attack on diffusion models

    Yijun Yang, Ruiyuan Gao, Xiaosen Wang, Tsung-Yi Ho, Nan Xu, and Qiang Xu. Mma-diffusion: Multi- modal attack on diffusion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024

    2024

  52. [60]

    Sneakyprompt: Jailbreaking text-to-image generative models

    Yuchen Yang, Bo Hui, Haolin Yuan, Neil Gong, and Yinzhi Cao. Sneakyprompt: Jailbreaking text-to-image generative models. In2024 IEEE symposium on security and privacy (SP), 2024

    2024

  53. [61]

    Hotpotqa: A dataset for diverse, ex- plainable multi-hop question answering

    Zhilin Yang, Peng Qi, Saizheng Zhang, Yoshua Ben- gio, William Cohen, Ruslan Salakhutdinov, and Christo- pher D Manning. Hotpotqa: A dataset for diverse, ex- plainable multi-hop question answering. InProceedings of the 2018 conference on empirical methods in natural language p...

    2018

  54. [62]

    Cacheblend: Fast large language model serving for rag with cached knowledge fusion

    Jiayi Yao, Hanchen Li, Yuhan Liu, Siddhant Ray, Yi- hua Cheng, Qizheng Zhang, Kuntai Du, Shan Lu, and Junchen Jiang. Cacheblend: Fast large language model serving for rag with cached knowledge fusion. InPro- ceedings of the Twentieth European Conference on Com- puter Systems, 2025

    2025

  55. [63]

    H2o: Heavy- hitter oracle for efficient generative inference of large language models.Advances in Neural Information Pro- cessing Systems, 2023

    Zhenyu Zhang, Ying Sheng, Tianyi Zhou, Tianlong Chen, Lianmin Zheng, Ruisi Cai, Zhao Song, Yuandong Tian, Christopher Ré, Clark Barrett, et al. H2o: Heavy- hitter oracle for efficient generative inference of large language models.Advances in Neural Information Pro- cessing Sys...

    2023

  56. [64]

    Sglang: Efficient execution of structured language model programs.Advances in neural information pro- cessing systems, 2024

    Lianmin Zheng, Liangsheng Yin, Zhiqiang Xie, Chuyue Livia Sun, Jeff Huang, Cody Hao Yu, Shiyi Cao, Christos Kozyrakis, Ion Stoica, Joseph E Gonzalez, et al. Sglang: Efficient execution of structured language model programs.Advances in neural information pro- cessing systems, 2024

    2024

  57. [65]

    Universal and trans- ferable adversarial attacks on aligned language models

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. Universal and trans- ferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043, 2023

    2023 arXiv

  58. [66]

    {PoisonedRAG}: Knowledge corruption attacks to {Retrieval-Augmented} generation of large language models

    Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia. {PoisonedRAG}: Knowledge corruption attacks to {Retrieval-Augmented} generation of large language models. In34th USENIX Security Symposium (USENIX Security 25), 2025. A Notations Symbol Description Sequences and Tokens XInp...

    2025

  59. [67]

    Multiple Choice questions with labeled options (A/B/C/D): Output ONLY the corresponding uppercase letter

  60. [68]

    This rule OVERRIDES rule 1

    Binary-choice questions (e.g., Yes/No, True/False, A/B, Option1/Option2): Output ONLY the option text itself, NOT the letter label. This rule OVERRIDES rule 1

  61. [69]

    High”–>“Low

    Open-ended questions: Answer in 1–3 words. Do not provide explanations or full sentences. Be extremely concise. Generate Malicious Answer Prompt Role:You are an expert data generator specializing in creating plausible incorrect answers (distractors). Goal:Given a specific Ques...

    1995

Pith tools

Reviewed August 3, 2026 · model on record in the stance chip above.