Pith. sign in

REVIEW 4 major objections 5 minor 31 references

By checking the first tokens of a response as well as the query key, LaCache detects cache-collision attacks with probability at least 1−p2.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

A semantic cache for LLMs that verifies the first k response tokens on cache hits reduces cache-collision attack hit rate to near zero while preserving benign cache utility.

T0 review reviewed 2026-08-04 challenge →

load-bearing objection LaCache's response-prefix check is a genuinely new and empirically effective defense, but the proof as written doesn't cover the deployed configuration because the theorem's constants and k-condition are never grounded. the 4 major comments →

arxiv 2608.01718 v1 pith:WFFLB4K3 submitted 2026-08-03 cs.AI

LaCache: Robust Semantic Caching for LLM Serving

Jiacheng Liang , Yuhui Wang , Tanqiu Jiang , Ting Wang This is my paper
classification cs.AI
keywords semantic cachingcache-collision attackLLM servingresponse-prefix checkinglocality-sensitive hashingadversarial robustnessspeculative decodingcache poisoning defense
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

LaCache is a redesign of semantic caching for LLM serving that defends against cache-collision attacks by checking not only whether an incoming query matches a cached query, but also whether the first k tokens of the response match the cached response's first k tokens. The paper argues that this shift from query-side to response-side integrity works because an adversary can freely craft a query that collides with a victim's cache key but cannot freely control the LLM-generated response, which must remain coherent and semantically distinct from the genuine answer. Under two formal conditions—semantic separability and prefix coherency—LaCache proves it detects any attack that yields a semantically distinct response with probability at least 1−p2, and empirically drives attack hit rate to near zero while preserving over 90% of benign cache utility. The result matters because existing defenses filter adversarial queries at lookup time and can be bypassed by gradient-optimized prompts; LaCache instead builds the defense into the cache structure.

Core claim

LaCache claims that cache-collision attacks can be neutralized by making the cached response's own first k tokens part of the cache key. Instead of serving any query whose embedding hashes to a stored key, LaCache serves only when both the query key and the lookahead key h(f_k(x)) match the stored entry. Under semantic separability—an adversarial response is at distance > δ2/C from the genuine response—and prefix coherency—the k-prefix distance is at least ϵ^{k_min−k} of the full-response distance—Theorem 1 states that for k > k_min − ⌊log_ϵ C⌋, any cache-collision attack producing a semantically distinct response is detected with probability at least 1−p2. Empirically, for KCA and SCP-P acr

What carries the argument

The lookahead check is the load-bearing object. Each LaCache entry stores ⟨h(x), [h(f_k(x)), f(x)]⟩, where h is a locality-sensitive hash over an embedding and f_k(x) is the first k tokens of the model's response; retrieval requires both hash matches. The mechanism's proof uses the gapped-LSH property P[h(z)=h(z')] > p1 for d<δ1 and < p2 for d>δ2, and chains two response-side inequalities: adversarial responses are far from genuine ones (δ2/C), and that distance survives prefix truncation (ϵ^{k_min−k}). A draft LLM generates the prefix and speculative decoding verifies it, which keeps the added check cheap.

Load-bearing premise

The guarantee holds only when every effective attack's response is far from the genuine response in the embedding space and when a short prefix preserves that distance; if either fails, a collision can pass the lookahead check.

What would settle it

Construct a cache-collision attack whose injected response is a near-paraphrase of the genuine response (embedding distance below δ2) while still making the victim act differently—say, changing one critical number or URL in an otherwise identical answer—and show LaCache serves the poisoned answer at non-negligible rate.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Any cache-collision attack whose injected response is semantically distinct from the victim's true response is detected with probability at least 1−p2, even for white-box adversaries with full access to the embedding and LLM.
  • The same cache can preserve most utility: across the tested LLM and embedding combinations, benign hit rate remains above 0.85 (over 90% relative) while attack hit rate falls below 0.04.
  • Query-side defenses (perplexity, query-response consistency, LLM-as-judge) each fail on at least one attack variant; response-side checking is the only one that suppresses all four SCP variants and KCA.
  • A cheap draft model plus speculative decoding makes the lookahead check affordable: latency drops from 108.5 ms to 68.6 ms per query with no security loss.
  • Stacking independent lookahead embedding models amplifies detection on the harder SCP-I and SCP-Z variants, with benign hit rate declining only modestly (from 0.91 to 0.86 at m=4).

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same response-prefix principle could be ported to other token-reuse systems—RAG chunk caches, KV-cache sharing, prompt caches—wherever the adversary controls the request but not the generated continuation; the key requirement is that the cached artifact has a deterministic, semantically loaded output prefix.
  • One direct extension is to test a 'soft attack' that makes the injected response close in embedding space to the genuine response while changing a single critical token, such as one wrong number or one malicious link; the paper's evaluation does not include this case, and it falls outside the semantic-separability assumption.
  • Because detection probability is amplified exponentially by m independent embeddings, calibrating diverse embeddings per application may be more important than increasing k; the paper's k-saturation result suggests k=20 is already enough.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes LaCache, a semantic caching scheme for LLM serving that defends against cache-collision attacks. In addition to the standard query-embedding cache key, each cache entry stores a lookahead key derived from the first k tokens of the response, and a hit is served only if both the query check and the response-prefix check pass. The authors prove (Theorem 1, §4.4, proof in §B) that, under two assumptions called semantic separability and prefix coherency, any cache-collision attack producing a semantically distinct response is detected with probability at least 1−p2. They also show that using m independent lookahead checks raises detection to 1−p2^m. Empirically, they evaluate against KCA and SCP attacks across two LLMs and two embedding models, reporting that LaCache reduces attack hit rate to near zero while preserving above 90% of benign hit rate, and that the overhead can be reduced with a draft model and speculative decoding.

Significance. The core idea—that the adversary has limited control over the LLM's response and therefore the response prefix is a more trustworthy integrity signal than the query—is original and practically relevant. If the formal guarantee were fully established, the paper would be a significant step toward provable defenses for semantic caches. The evaluation is reasonably broad (multiple LLMs, embeddings, attack variants, adaptive adversaries) and the results are encouraging: LaCache consistently lowers AHR while maintaining high BHR, and the ablation in Figure 5 justifies the choice of k=20. However, the formal claims currently outrun the evidence: the theorem's constants are unquantified, the LSH property is not validated on response-prefix embeddings, and the production implementation uses a draft model not covered by the proof. These gaps are fixable but require additional analysis and experiments.

major comments (4)
  1. [§4.4, §5.2, Theorem 1] The constants C and ε in the two assumptions are never estimated, and the condition k > kmin − ⌊log_ε C⌋ is never verified for the deployed k=20. §5.2 validates only d(f(x), f(x*)) > δ2 (P5=0.37 for BGE, vs δ2=0.30) and reports that A_k = d(f_k(x), f_k(x*))/d(f(x), f(x*)) is 'flat' without giving its value. Neither check establishes d(f(x), f(x*)) > δ2/C for a stated C, nor A_k > ε^{kmin−k}. Since C ∈ (0,1), the required separation is strictly stronger than what was measured; for kmin around 100 and k=20, the condition requires ε^{80} > C, which is a strong quantitative assumption that the paper does not support. The theorem therefore cannot be instantiated with the reported data.
  2. [§3, §5.2, Eq. (1)] The gapped-LSH property is validated only on query embeddings: Figure 3(a) uses paraphrase and random query pairs to set δ1, δ2. Theorem 1, however, applies Eq. (1) to response-prefix embeddings h(f_k(x)) and h(f_k(x*)) in the proof. No experiment measures the collision probability or distance distribution for response-prefix embeddings with the same δ2. The statement in §5.2 that 'empirical 1−p2 = 1.0' is about query pairs and does not transfer. Consequently, the claim that 'Theorem 1 applies directly' is not supported; the lookahead guarantee requires validating the LSH thresholds on response-prefix embeddings or explicitly assuming the LSH property for that domain.
  3. [§4.3, Algorithm 1, Theorem 1] The implemented system generates the lookahead prefix f_k(x) with a draft model g (Gemma-4-E4B-it) rather than the backend model f. The proof of Theorem 1 uses f_k, and the paper's justification that substituting g has 'negligible impact' is purely empirical (Table 4). If g and f disagree on the first k tokens, the lookahead check is computed on a different distribution than the one in the proof, so the formal guarantee does not literally apply to the production implementation. Either extend the proof to the draft model (e.g., by proving or assuming the same distance separation for g's prefixes) or present the empirical results as heuristic support, separate from the formal theorem.
  4. [§5.2, §5.3, Table 1] The assumptions of semantic separability and prefix coherency are validated on the same SCP-P adversarial response pairs on which AHR is later measured (Table 1). This is a same-set validation: the 'assumption holds for >95% of pairs' claim is derived from the exact attack data used to report near-zero AHR. If the thresholds τ_a or δ2 had been adjusted after inspecting these pairs, the security results would be optimistically biased. The paper should either validate the assumptions on a separate, held-out attack set or clearly state that all thresholds were fixed before any attack data was examined. This is not merely a presentation issue; it affects the strength of the empirical confirmation of the theorem's premises.
minor comments (5)
  1. [§3] Typo: 'Local-Sensitive Hashing' should be 'Locality-Sensitive Hashing'.
  2. [§5.2, Figure 3] The caption mentions P5 for δ1 and P1(random) for δ2, but the text uses P99 and 'midpoint'. Please make the percentile definitions consistent.
  3. [§5.3, Table 1, Figure 4] Figure 4 uses 'SCP-P wbox' whereas Table 1 uses 'SCP-P'. Define 'wbox' (white-box) in the caption or in the text.
  4. [§5.4, Eq. (3)] The adaptive adversary in Eq. (3) is optimized with 200 gradient-descent steps, but the step size or learning-rate schedule is not reported. Since this is a new optimization, please provide the hyperparameters.
  5. [§A.2] The caption of Table 1 reports BHR for 'undefended' as 1.00 for most rows, but the BHR for LaCache is lower. Consider explicitly noting that the undefended baseline always admits all benign paraphrase pairs by construction.

Circularity Check

2 steps flagged

Partially circular: benign hit rate is a calibration artifact and the near-zero SCP-P attack hit rate restates the semantic-separability validation on the same data; the formal theorem is a valid conditional deduction but its quantitative condition is never checked.

specific steps
  1. fitted input called prediction [§A.2 threshold calibration and §5.3 Table 1 (BHR)]
    "we collect cosine similarities of the 500 benign paraphrase pairs (x, x′) and set τc = min(0.80, P5{sim(emb(x),emb(x′))}) ... Analogously, we collect cosine similarities of fk(x) vs. fk(x′) on the same benign pairs and set τa = min(0.70, P10{sim(emb(fk(x)),emb(fk(x′)))})"

    The BHR reported in Table 1 (0.90–0.94) is measured on those same 500 benign paraphrase pairs. Setting τa to the 10th percentile of the lookahead similarities guarantees at least ~90% of the calibration pairs pass the lookahead check by definition; τc at P5 (capped at 0.80) passes most of the key check. The headline 'preserves over 90% of benign cache utility' is therefore a direct arithmetic consequence of the chosen calibration percentiles on the evaluation set, not an independent measure of utility.

  2. fitted input called prediction [§5.2 semantic separability vs. §5.3 Table 1 (SCP-P AHR); §A.2 τa]
    "We measure the adversarial-genuine response distance at k = 20 on SCP-P and compare it against the δ2 calibrated above. As shown in Figure 3 (b), the bulk of adversarial response distances exceed δ2: the lower 5th percentile is 0.37 for BGE and 0.54 for MiniLM, clearing the corresponding δ2 (0.30 and 0.53), so the assumption holds for >95% of pairs"

    For BGE, τa is calibrated to 0.70 (Appendix A.2), so the lookahead check admits only response prefixes with distance ≤ 0.30, exactly the δ2=0.30 boundary used in the semantic-separability check. Having just measured on the same SCP-P pairs that >95% of response-prefix distances exceed δ2, the near-zero AHR reported for SCP-P follows directly from that measurement. The empirical 'confirmation' of the defense on SCP-P is thus a restatement of the assumption-validation statistic on the same attack data rather than an independent prediction.

full rationale

The formal Theorem 1 is a valid conditional deduction: if semantic separability (d(f(x),f(x*)) > δ2/C) and prefix coherency (d(fk(x),fk(x*)) > ε^{kmin−k}d(f(x),f(x*))) hold, then choosing k > kmin − ⌊log_ε C⌋ gives d(fk(x),fk(x*)) > δ2, and the LSH property yields detection probability ≥ 1−p2. This step is not circular; it is just algebra plus the assumed LSH bound. However, the paper never estimates C or ε and never verifies the quantitative condition for the deployed k=20 and typical response lengths, so Theorem 1 may not cover the evaluated configuration; this is an unverified-antecedent gap, not circularity. The two circularity issues are empirical: (1) the utility claim 'preserves over 90% of benign cache utility' is forced by calibrating τc and τa on the same 500 benign pairs at P5/P10; (2) the near-zero AHR on SCP-P largely restates the semantic-separability measurement made on the same SCP-P pairs, since τa=0.70 for BGE corresponds to the same δ2=0.30 distance boundary. The same-data validation also applies to the prefix-coherency check and the k-sensitivity results. There is no load-bearing self-citation chain: the Liang et al. citation in related work is not used to justify LaCache's mechanism, and no uniqueness theorem is imported. The defense concept—checking the response prefix against a lookahead key—is independent and could be evaluated on held-out attacks; but as written, the headline empirical claims are partly predetermined by the calibration and validation protocol.

Axiom & Free-Parameter Ledger

6 free parameters · 5 axioms · 0 invented entities

LaCache introduces a 'lookahead key' as a new field in the cache entry, but it is a data-structure field, not a new physical or conceptual entity; no independent evidence requirement applies. The free parameters are thresholds and hyperparameters fitted to the data distributions used in evaluation.

free parameters (6)
  • τc (cache admission threshold) = 0.800 (BGE), 0.778 (MiniLM)
    Set as min(0.80, P5 of benign paraphrase query similarity); used in all hit-rate computations.
  • τa (lookahead admission threshold) = 0.700 (Qwen3+BGE), 0.611 (Qwen3+MiniLM), 0.664 (Gemma3+BGE), 0.515 (Gemma3+MiniLM)
    Set as min(0.70, P10 of benign response-prefix similarity); directly controls the AHR vs BHR trade-off.
  • δ1, δ2 (LSH distance boundaries) = (0.16, 0.30) for BGE; (0.29, 0.53) for MiniLM
    δ1 = P99 of paraphrase query distances; δ2 = midpoint of the gap; both fitted to the query embedding distributions that also underlie the claimed 1−p2 ≈ 1.0.
  • k (lookahead window) = 20 tokens
    Chosen because BHR saturates at k=20 in Figure 5; the theorem gives a lower bound in terms of unquantified C and ϵ, so k is not derived.
  • C, ϵ (assumption constants) = Not measured
    Theorem 1's condition k > kmin − ⌊log_ϵ C⌋ depends on these constants, which the paper never estimates.
  • m (number of lookahead checks) = 1 (default; up to 4 in ensemble)
    Hyperparameter; Figure 6 shows m>1 only marginally improves AHR.
axioms (5)
  • domain assumption The LSH function h satisfies the gapped probability property of Eq. (1) for the query and response embeddings.
    The Gapped LSH property is stated in §3 and used in the proof of Theorem 1 (§B); it is validated only for query pairs in §5.2, not for response-prefix pairs.
  • domain assumption Semantic Separability: the adversary's intended response is always at embedding distance > δ2/C from the genuine response for some fixed C in (0,1).
    Stated in §4.1; validated in §5.2 on the same SCP-P attack used in the AHR evaluation; C is never quantified.
  • domain assumption Prefix Coherency: the first k tokens of a response preserve a fraction ϵ^(kmin−k) of the full response's embedding distance.
    Stated in §4.1; validated via the ratio A_k in Figure 3(c), but the formal inequality with ϵ is never directly tested.
  • ad hoc to paper The draft model g produces the same first-k-token prefix as the backend model f for the purpose of the lookahead check.
    Assumed implicitly in §4.3 when replacing f with g; Table 4 only checks AHR/BHR, not the theorem's conditions.
  • domain assumption Adversarial queries are restricted to those whose intended response is semantically distinct from the genuine response.
    Explicitly scoped in §6 limitation (i); subtle misinformation attacks preserving semantic proximity are excluded from the guarantee.

reviewed 2026-08-04 · how reviews work

0 comments
Cite this review

Pith. "Pith review of LaCache: Robust Semantic Caching for LLM Serving." pith.science (2026). https://pith.science/paper/WFFLB4K3

@misc{pith2026260801718,
  author       = {Pith},
  title        = {Pith review of: LaCache: Robust Semantic Caching for LLM Serving},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WFFLB4K3}},
  note         = {Machine review of arXiv:2608.01718}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Semantic caching, which reuses responses to semantically similar requests via their embeddings, has seen growing adoption in LLM serving, offering faster responses and reduced costs. Yet existing schemes are fundamentally vulnerable to cache-collision attacks, wherein an adversary pollutes the cache by injecting crafted queries, corrupting responses to subsequent legitimate requests. We present LaCache, a novel semantic caching scheme that addresses this vulnerability through a conceptually simple yet principled redesign. The key insight is that while the adversary has full control over the adversarial query, it has far less control over its response, which must simultaneously satisfy multiple semantic constraints. Rather than checking only the cache hit of a query, LaCache additionally checks the cache hit of its first k (speculatively) decoded tokens. This design yields two concrete benefits. First, it provides formally guaranteed resilience against cache-collision attacks: we prove that it is impossible to craft adversarial queries that simultaneously elicit malicious responses and collide with benign queries. Second, the enriched index supplies additional semantic context for cache retrieval, improving response relevance. Empirical evaluation across diverse LLMs and benchmarks validates both LaCache's security guarantees and efficiency gains, pointing to a promising direction for robust semantic caching.

Figures

Figures reproduced from arXiv: 2608.01718 by Jiacheng Liang, Tanqiu Jiang, Ting Wang, Yuhui Wang.

Figure 1
Figure 1. Figure 1: (a) Cache-collision attacks: the adversarial query [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Security (attack hit rate) [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Empirical validation of working assumptions across LLM-embedding combinations: (a) embedding [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Embedding distance distributions for adversarial (restricted to successfully injected ones) and benign [PITH_FULL_IMAGE:figures/full_fig_p008_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: LACACHE’s sensitivity to the look-ahead window k against SCP-P (prompt injection with optimized prefix) across all LLM-embedding model combinations. Lookahead Window [PITH_FULL_IMAGE:figures/full_fig_p009_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: AHR of ensembles of lookahead checks (averaged over all combinations of BGE, MiniLM, MPNet, and Qwen3-Emb). Notably, AHR remains flat in k across all LLM-embedding model combinations, while BHR saturates by k = 20. This is consistent with our finding in §5.2 that prefix coherency is already tight at k = 20. The setting of k = 20 thus achieves near-optimal security at minimum decoding cost. Number of Lookah… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

31 extracted references · 31 canonical work pages

  1. [1]

    Cache Me, Catch You: Cache Related Security Threats in LLM Serving Frameworks , author=

    work page

  2. [2]

    , journal =

    Afiffy, Mohanad and Fakhr, Mohamed Waleed and Maghraby, Fahima A. , journal =. Enhancing adversarial resilience in semantic caching for secure retrieval augmented generation systems , volume =

    work page

  3. [3]

    The Early Bird Catches the Leak: Unveiling Timing Side Channels in LLM Serving Systems , year=

    Song, Linke and Pang, Zixuan and Wang, Wenhao and Wang, Zihao and Wang, XiaoFeng and Chen, Hongbo and Song, Wei and Jin, Yier and Meng, Dan and Hou, Rui , journal=. The Early Bird Catches the Leak: Unveiling Timing Side Channels in LLM Serving Systems , year=

    work page

  4. [4]

    I Know What You Asked: Prompt Leakage via KV-Cache Sharing in Multi-Tenant LLM Serving , author=

    work page

  5. [5]

    PoisonedRAG: knowledge corruption attacks to retrieval-augmented generation of large language models , author=

    work page

  6. [6]

    and Barrett, Clark and Sheng, Ying , booktitle = nips, title =

    Zheng, Lianmin and Yin, Liangsheng and Xie, Zhiqiang and Sun, Chuyue and Huang, Jeff and Yu, Cody Hao and Cao, Shiyi and Kozyrakis, Christos and Stoica, Ion and Gonzalez, Joseph E. and Barrett, Clark and Sheng, Ying , booktitle = nips, title =

    work page

  7. [7]

    SemShareKV: Efficient KVCache Sharing for Semantically Similar Prompts via Token-Level LSH Matching. Proceedings of the 14th International Joint Conference on Natural Language Processing and the 4th Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics (IJCNLP-AACL)

    work page

  8. [8]

    Yang and Mohammad Mohammadi Amiri , booktitle=colm, year=

    Yuxuan Zhu and Ali Falahati and David H. Yang and Mohammad Mohammadi Amiri , booktitle=colm, year=. Sentence

    work page

  9. [9]

    GPT Semantic Cache: Reducing LLM Costs and Latency via Semantic Embedding Caching

    work page

  10. [10]

    SmartCache: Context-aware Semantic Cache for Efficient Multi-turn

    Chengye YU and Tianyu Wang and Zili Shao and Song Jiang , booktitle=nips, year=. SmartCache: Context-aware Semantic Cache for Efficient Multi-turn

    work page

  11. [11]

    Morris, Robert and Thompson, Ken , title =. Commun. ACM , pages =. 1979 , volume =

    work page 1979

  12. [12]

    When Cache Poisoning Meets

    Wu, Guanlong and Wang, Taojie and Zhang, Yao and Zhang, Zheng and Niu, Jianyu and Wu, Ye and Zhang, Yinqian , booktitle=ndss, year=. When Cache Poisoning Meets

    work page

  13. [13]

    Zhengmian Hu and Gang Wu and Saayan Mitra and Ruiyi Zhang and Tong Sun and Heng Huang and Viswanathan Swaminathan , title =

    work page

  14. [14]

    , title =

    Charikar, Moses S. , title =

    work page

  15. [15]

    Transactions of the Association for Computational Linguistics

    Kwiatkowski, Tom and Palomaki, Jennimaria and Redfield, Olivia and Collins, Michael and Parikh, Ankur and Alberti, Chris and Epstein, Danielle and Polosukhin, Illia and Devlin, Jacob and Lee, Kenton and Toutanova, Kristina and Jones, Llion and Kelcey, Matthew and Chang, Ming-Wei and Dai, Andrew M. and Uszkoreit, Jakob and Le, Quoc and Petrov, Slav , journ...

    work page 2019

  16. [16]

    Zhao, Yiran and Zheng, Wenyue and Cai, Tianle and Do, Xuan Long and Kawaguchi, Kenji and Goyal, Anirudh and Shieh, Michael Qizhe , title =

    work page

  17. [17]

    Proceedings of the 3rd Workshop for Natural Language Processing Open Source Software (NLP-OSS 2023)

    Bang, Fu. Proceedings of the 3rd Workshop for Natural Language Processing Open Source Software (NLP-OSS 2023). 2023

    work page 2023

  18. [18]

    Fast Inference from Transformers via Speculative Decoding , author =

    work page

  19. [19]

    and Zhang, Hao and Stoica, Ion , title =

    Kwon, Woosuk and Li, Zhuohan and Zhuang, Siyuan and Sheng, Ying and Zheng, Lianmin and Yu, Cody Hao and Gonzalez, Joseph E. and Zhang, Hao and Stoica, Ion , title =

    work page

  20. [20]

    Gao, Bin and He, Zhuomin and Sharma, Puru and Kang, Qingxuan and Jevdjic, Djordje and Deng, Junbo and Yang, Xingkun and Yu, Zhou and Zuo, Pengfei , title =

    work page

  21. [21]

    Ruoyu Qin and Zheming Li and Weiran He and Jialei Cui and Feng Ren and Mingxing Zhang and Yongwei Wu and Weimin Zheng and Xinran Xu , title =

    work page

  22. [22]

    Zhang, Zhenyu and Sheng, Ying and Zhou, Tianyi and Chen, Tianlong and Zheng, Lianmin and Cai, Ruisi and Song, Zhao and Tian, Yuandong and R

    work page

  23. [23]

    Li, Yuhong and Huang, Yingbing and Yang, Bowen and Venkitesh, Bharat and Locatelli, Acyr and Ye, Hanchen and Cai, Tianle and Lewis, Patrick and Chen, Deming , title =

    work page

  24. [24]

    Liu, Zirui and Yuan, Jiayi and Jin, Hongye and Zhong, Shaochen and Xu, Zhaozhuo and Braverman, Vladimir and Chen, Beidi and Hu, Xia , title =

    work page

  25. [25]

    Xiao, Guangxuan and Tian, Yuandong and Chen, Beidi and Han, Song and Lewis, Mike , title =

    work page

  26. [26]

    Liu, Yuhan and Li, Hanchen and Cheng, Yihua and Ray, Siddhant and Huang, Yuyang and Zhang, Qizheng and Du, Kuntai and Yao, Jiayi and Lu, Shan and Ananthanarayanan, Ganesh and Maire, Michael and Hoffmann, Henry and Holtzman, Ari and Jiang, Junchen , title =

    work page

  27. [27]

    Ye, Lu and Tao, Ze and Huang, Yong and Li, Yang , title =

    work page

  28. [28]

    Juravsky, Jordan and Brown, Bradley and Ehrlich, Ryan and Fu, Daniel Y. and R

    work page

  29. [29]

    Zheng, Zhen and Ji, Xin and Fang, Taosong and Zhou, Fanghao and Liu, Chuanjie and Peng, Gang , title =

    work page

  30. [30]

    Jin, Chao and Zhang, Zili and Jiang, Xuanlin and Liu, Fangyue and Liu, Shufan and Liu, Xuanzhe and Jin, Xin , title =

    work page

  31. [31]

    Agarwal, Shubham and Sundaresan, Sai and Mitra, Subrata and Mahapatra, Debabrata and Gupta, Archit and Sharma, Rounak and Kapu, Nirmal Joshua and Yu, Tong and Saini, Shiv , title =

    work page

This paper was first reviewed by deepseek-v4-flash on August 4, 2026.