Pith. sign in

REVIEW 4 major objections 6 minor 31 references

Governing the KV Cache: Preventing Timing Side-Channel Leakage in Multi-Tenant LLM Inference

T0 review · 4 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Seeding the KV-cache block-hash chain with a per-principal HMAC salt makes cache entries cryptographically disjoint across tenants, driving all three published prompt-reconstruction attacks to 0% success rate.

desk verdict Core defense is prior art (vLLM cache_salt), but the taxonomy, boundary-salting idea, and gate-verified TTFT measurements make this a legitimate paper that deserves peer review. read the letter →

arxiv 2608.09225 v1 pith:VAKHNVJI submitted 2026-08-10 cs.CR cs.AI

Tejasvi C. Addagada This is my paper · ORCID
classification cs.CRcs.AI
keywords KVcachetimingsidechannelmulti-tenantLLMinferenceHMAC-keyednamespaceisolationprefixpromptleakageattacksuccessrateStackelbergauditevolutionarystability
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Modern LLM serving shares a key-value cache across tenants to reuse computed prefixes, and the paper claims this sharing leaks private prompts through a timing side channel: any tenant can tell, from time-to-first-token, whether another tenant's prompt is cached. KVGov is a governance layer that removes the root cause by binding every cache key to the authenticated principal: a per-principal HMAC salt seeds the chained block hashes, so cache entries become cryptographically disjoint across tenants. In the paper's simulated attacks, this drives all three known attack families—PROMPTPEEK, EarlyBird, and InputSnatch—to 0% attack success rate, while an ablation isolates the salt as the necessary and sufficient component. The paper further shows that salting only at the point where prompts diverge preserves most prefix-cache reuse, and adds an audit scheduler and a population-level tipping point for cache-scope choice. If the defense holds, multi-tenant LLM providers can keep their caching speedup without exposing tenants to prompt reconstruction.

What carries the argument

The block-hash chain that inference engines use to key cached token blocks: $h_0 = H(\mathrm{tokens}_{0..B-1})$ and $h_j = H(h_{j-1}, \mathrm{tokens}_{jB..(j+1)B-1})$. KVGov's central object is the per-principal salt $\sigma_p = \mathrm{HMAC}_K(\mathrm{secret}, \mathrm{principal\_id})$ inserted into $h_0$ (or at the divergence boundary), so chaining propagates the salt through every subsequent block; this makes cross-principal cache collision cryptographically impossible while preserving intra-principal prefix reuse. Supporting machinery includes ORIGAMI, a Stackelberg water-filling audit scheduler, and an evolutionary-stability threshold formula for choosing cache scope.

What would settle it

Instrument the cache's own counters in a root-salted deployment: if a single request from principal A resolves a cache block created by principal B, the cryptographic-disjointness claim is false; if no such cross-principal hit ever occurs, the mechanism is doing what the paper says.

Watch

Extended reading notes

Core claim

The central claim is that the three published KV-cache timing attacks share one root cause—cache keys are computed over token sequences alone, with no binding to the issuing principal—and that binding cache resolution to the authenticated principal eliminates all three attacks' prefix-cache paths at once. Concretely, seeding the block-hash chain with $\sigma_p = \mathrm{HMAC}_K(\mathrm{secret}, \mathrm{principal\_id})$ makes the entire chain principal-specific because each block inherits its predecessor's hash; an adversary's probes under their own salt never collide with the victim's entries, so their timing fingerprint is all-MISS and the Pearson correlation collapses toward zero. The paper reports 0% attack success rate for PROMPTPEEK, EarlyBird, and InputSnatch under KVGov, against 100% without defense and 9.8–22% under session-flushing, with the 0% and 100% columns being analytic controls rather than sampled statistics. Real measurements confirm the channel itself is exploitable—a cold/cached time-to-first-token ratio of 0.22 on production hardware and 0.093 on an independent stack—and the paper argues that block-size hardening does not protect template-structured prompts, where confirming whether a specific field is cached costs a single request regardless of block size.

Load-bearing premise

The load-bearing premise is that the serving infrastructure can authenticate every request to a principal_id the attacker cannot spoof and keep the HMAC secret private; the paper assumes this in its threat model but does not implement or test the binding in a real engine.

Editorial extensions

If this is right

  • An adversary's probes under their own salt never resolve to a victim's cache entries, so the timing fingerprint becomes all-MISS and the published PROMPTPEEK identification attack collapses to 0% success.
  • EarlyBird's token-by-token reconstruction and InputSnatch's template-field membership queries are blocked for hash-keyed caches, because the oracle that the attacks read is removed rather than merely made noisier.
  • Block-size hardening is not a substitute: with template-structured prompts, confirming whether a specific field is cached costs one request even at block size 16, so only namespace isolation closes that O(1) membership query.
  • Boundary salting, which applies the salt only where prompts diverge, is estimated to retain 92.8% of the prefix-cache benefit of full sharing while still eliminating the cross-principal timing signal.
  • The ORIGAMI scheduler cut adversary expected utility by 12.6% over random audit under an enterprise workload, and the replicator-dynamics analysis identifies a 31.6% adversary-prevalence threshold below which global caching is evolutionarily stable.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the authentication binding holds, the same HMAC-salt construction should also cover exact-response caches and radix-tree caches, but the paper explicitly does not measure the semantic-cache row of its taxonomy, where nearest-neighbour lookup defeats salting; a per-principal partition of the retrieval index would be the natural extension.
  • The boundary-salting logic suggests a deployment-level control that requires no engine change: emitting a per-principal token near position 0 in every prompt would approximate root salting, and operators could A/B test the resulting timing isolation without modifying cache internals.
  • Because the paper's 0% ASR rests on the collision-resistance argument rather than on sampled trials, an end-to-end implementation in a real engine with real adversarial tenants would strengthen the empirical claim, especially the 92.8% efficiency estimate, which is extrapolated from two hardware measurements rather than measured directly.
  • The evolutionary tipping point could be turned into an adaptive cache-scope policy: monitor the adversary prevalence and switch between global and ephemeral caching as the modeled threshold is crossed.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The manuscript proposes KVGov, a governance layer for multi-tenant LLM KV-cache timing side channels. Its central mechanism is a per-principal HMAC salt that seeds the block-hash chain, making cache keys cryptographically disjoint across principals; it also presents boundary salting to preserve cross-tenant prefix reuse, an ORIGAMI Stackelberg audit scheduler, and an evolutionary-stability tipping point. The paper reports 0% attack success rate under KVGov from a deterministic simulation, a 12.6% reduction in adversary expected utility for ORIGAMI, and gate-verified hardware measurements on the A100 and Apple Metal confirming the underlying timing channel.

Significance. The paper has real strengths: the TTFT measurements on Qwen2.5-7B/vLLM/A100 are carefully gated, including server-side prefix-cache counters and a FLOP-utilization check, and the independent llama.cpp/Metal replication strengthens the claim that the channel is intrinsic to prefix caching. The taxonomy of cache mechanisms and adversary goals is useful, and the proof of Theorem 1 is correct. The core cryptographic idea, per-principal salting of the cache-key chain, is sound as a design provided the server can bind every request to a non-spoofable principal. However, the headline 0% ASR is an analytic consequence of the simulation's own assumptions, not an empirical validation of the defense, and the paper's only cited deployment path, vLLM's cache_salt, appears to be a client-supplied request field. These issues currently prevent the paper from supporting its central claim that KVGov eliminates the root cause of the attacks.

major comments (4)
  1. [§5.2, Table 3, Figure 2] The KVGov columns in Table 3 and the ablation in Figure 2 report 0% ASR because the simulation model makes that outcome a tautology: after salting, every probe is all-MISS, and the Pearson judge maps a zero-variance vector to rho=0. The text in §5.2 labels these columns analytic controls, but the abstract and §5.3 nevertheless use them as evidence that HMAC-salt is 'necessary and sufficient' and that it 'alone accounts for the full reduction in ASR.' Since the defense is never deployed, no measured evidence supports the ASR=0 claim; the security argument may be correct under the model, but the ablation does not validate it.
  2. [§4.1, §4.2, Definition 1; vLLM Project (2025) reference] The defense binds cache resolution to an authenticated principal, yet the only engine mechanism cited, vLLM's cache_salt, is described in the reference list as a 'cache salt request field.' If the client can set cache_salt, an adversary can choose the victim's salt or the empty default, and cross-principal probes resolve again. The paper itself states in §4.2 that the serving layer does not hold the authenticated principal and that boundary salting requires an offset parameter current engines do not expose. This means KVGov as described is not deployable on unmodified vLLM, and the load-bearing binding between principal identity and cache key is never implemented or tested; the threat-model assumption that A cannot issue requests on behalf of another tenant is exactly the missing infrastructure.
  3. [§5.3, Table 4] The claim that HMAC-salt is 'necessary and sufficient' is not supported by the ablation. The experiment shows that HMAC-salt alone suffices to reach 0% ASR, but it never tests a configuration that contains all other components and omits the salt, so necessity is not established. The abstract and conclusion rest on this 'necessary and sufficient' wording, so the claim should either be demonstrated with the missing ablation or weakened to 'sufficient'.
  4. [§5.5, Table 6] The adversarial load benchmark uses an adversary heuristic that maximizes v_j/(1-p_j), which the paper correctly notes differs from the payoff v_i(1-p_i) optimized by Theorem 1; the benchmark therefore does not validate ORIGAMI's optimality or provide direct evidence for the 12.6% EU reduction reported in the abstract. The admission in §5.5 is commendable, but the abstract and Section 4.3 present the 12.6% figure without this caveat, overstating the empirical support for ORIGAMI.
minor comments (6)
  1. [§5.6, Table 7] The text says the replicator-dynamics sweep uses a five-point grid and brackets the tipping point between the 30% and 35% samples, but Table 7 lists only four rates (0%, 10%, 20%, 50%) and omits the 30% and 35% rows; the table should be reconciled with the text.
  2. [§3.1, equation for rho] The denominator in the Pearson correlation formula has a missing closing norm symbol on the second term, and it would help to state explicitly how the threshold theta=0.85 is applied to decide a match.
  3. [§4.2] The 92.8% retained-cache-efficiency figure is explicitly extrapolated from §5.7 measurements rather than measured end to end; this is disclosed in the Limitations section, but the abstract's wording 'retains an estimated 93%' should carry the extrapolation caveat more prominently.
  4. [§5.1] The sentence claiming judges are 'provably 100% accurate for the simulated attack model' is trivially true given the deterministic construction; please clarify what property is being asserted beyond determinism.
  5. [Table 6] The column header 'Rnd' is ambiguous; it appears to denote random-audit breach rate, but could be read as 'rounds,' which is also reported in the last column. Please rename it to 'Random' or 'Random audit.'
  6. [§4.4, Proposition 1] The numeric value of the tipping point tau*=31.6% depends critically on the chosen payoff parameters V_glb, V_eph, C_glb,eph, C_eph; these parameters are not empirically calibrated, so the paper should clearly state that the 31.6% figure is an illustrative consequence of the model, not a measured property of real deployments.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the zero-ASR guarantee is an explicitly labeled analytic consequence of the HMAC-salt construction plus a stated collision-resistance and authentication assumption, not a disguised reuse of the target result.

full rationale

The paper's central derivation is a cryptographic implication, not a circular reuse of its conclusion. KVGov defines sigma_p = HMAC_K(secret, principal_id), seeds the block-hash chain with it, and then argues that under HMAC/SHA-256 collision resistance an adversary's probes cannot resolve to a victim's entries, so the observed fingerprint is all-MISS and Pearson rho collapses to 0. This is a valid logical derivation from stated assumptions. Crucially, the paper itself labels the extreme columns as analytic rather than empirical: Section 5.2 says 'The 100% and 0% columns are analytic controls, not empirical findings, and we report them as such' and 'the security claim rests on the cryptographic argument, not on these columns.' The ablation's 'HMAC-salt only' condition is likewise a deterministic consequence of the same model, and the paper does not hide that the real TTFT measurements validate the channel, not the defense. There is no self-citation chain: the paper is single-authored and cites external attack papers, a vLLM RFC, and standard game-theory/cryptography references; none of those citations is a same-author uniqueness theorem or an unverified ansatz imported from the authors' prior work. The load-bearing assumptions that could undermine the result are explicitly stated rather than assumed away: Definition 1 requires that the adversary cannot issue requests on behalf of another tenant, and Section 4.2 admits 'the authenticated principal, which the serving layer does not hold.' Section 7 further flags that ASR experiments use a discrete-event simulation and that boundary-salting efficiency figures are extrapolated. These are genuine correctness and deployment risks, but they are not circularity: the derivation does not assume the conclusion it claims to establish. The 0% ASR is presented as a formal consequence of the construction plus external cryptographic assumptions, and the paper transparently distinguishes that from the measured 0.22 and 0.093 TTFT ratios, which confirm the channel but not the defense. Under the hard rule that only quoteable reductions count, no circular step is exhibited.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central security claim rests on HMAC collision resistance and on an unforgeable principal binding that the paper assumes but does not implement. The simulation's 0% ASR is a consequence of these assumptions, not an independent measurement. The ESS and ORIGAMI results depend on hand-chosen parameters.

free parameters (4)
  • ESS payoffs = Vglb=0.45, Veph=0.15, Cglb,eph=0.70, Ceph=0.05
    The 31.6% tipping point is computed from these arbitrary values; no data supports them.
  • Simulation hit/miss latencies = 5 ms / 50 ms
    Used for all ASR simulations; not calibrated to the measured 32.8/149.6 ms TTFT values.
  • Pearson correlation threshold = theta=0.85
    Hand-chosen decision boundary for the PROMPTPEEK judge in simulation.
  • Boundary salting workload assumption = 2000-token shared preamble, 119-token private tail
    The 92.8% efficiency retention is extrapolated from an assumed workload, not measured.
assumptions (5)
  • domain assumption HMAC-SHA256 is collision-resistant and the secret K is unknown to tenants.
    The security claim in Section 4.1 depends on the adversary being unable to forge or predict the salt.
  • domain assumption The serving layer can authenticate each request to a principal_id that cannot be spoofed.
    Threat model Definition 1 assumes A cannot issue requests on behalf of another tenant; no implementation demonstrates this.
  • domain assumption The block-hash chain model accurately represents vLLM and SGLang cache lookup.
    Section 2.1 defines keys as chained block hashes; real engines may use radix trees or other indexes, though the paper argues the argument applies unchanged.
  • ad hoc to paper Fixed 5 ms and 50 ms latencies in the ASR simulation adequately model real TTFT distributions.
    Section 5.1 uses fixed latencies; the paper acknowledges real latency variance and does not run adversarial field experiments.
  • standard math Karush-Kuhn-Tucker conditions for the water-filling dual hold.
    Theorem 1 proof uses standard convex optimization and is correctly derived.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Governing the KV Cache: Preventing Timing Side-Channel Leakage in Multi-Tenant LLM Inference." pith.science (2026). https://pith.science/paper/VAKHNVJI

@misc{pith2026260809225,
  author       = {Pith},
  title        = {Pith review of: Governing the KV Cache: Preventing Timing Side-Channel Leakage in Multi-Tenant LLM Inference},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VAKHNVJI}},
  note         = {Machine review of arXiv:2608.09225}
}
read the original abstract

The key-value (KV) cache is the primary throughput optimization in modern large language model (LLM) inference, enabling prefix reuse across requests. In multi-tenant deployments this cache is shared across tenants, creating a timing side channel: an adversarial tenant can reconstruct another tenant's private prompt by probing cache-hit latency. Three published attacks exploit it -- PROMPTPEEK, EarlyBird and InputSnatch -- reaching up to 100% attack success rate against unprotected vLLM and SGLang, with rates varying by cache architecture and prompt structure. We present KVGov, a governance layer addressing all three attack families' prefix-cache paths under one mechanism. A per-principal salt sigma_p = HMAC_K(secret, principal_id) seeds the block-hash chain, making cache keys cryptographically disjoint across principals. An ablation (N=1000 trials, seed 2026, deterministic judges) isolates this salt as the necessary and sufficient component. KVGov adds ORIGAMI, a Stackelberg water-filling audit scheduler that reduces adversary expected utility by 12.6% at realistic tenant heterogeneity (Gini 0.63), and an evolutionary stability analysis giving a 31.6% adversary-prevalence tipping point below which global caching remains stable. On real hardware (Qwen2.5-7B-Instruct, vLLM 0.26.0, NVIDIA A100) we measure a gate-verified cold/cached TTFT ratio of 0.22, confirming the channel is exploitable at production scale; the defense itself is evaluated in simulation calibrated to those measurements. We replicate the channel on an independent stack (llama.cpp on Apple Metal, ratio 0.093). Finally, isolation and cache efficiency need not conflict: identifying information resides only where prompts diverge, so injecting the salt at that boundary rather than the chain root retains an estimated 93% of the prefix-cache benefit with no cross-principal signal.

Figures

Figures reproduced from arXiv: 2608.09225 by the authors.

Figure 2
Figure 2. Ablation study. HMAC-salt alone achieves 0% ASR for both attacks (same as KVGov full), confirming it is the necessary and sufficient mechanism. Noise injection breaks timing-based PROMPT￾PEEK (0.5%) but not InputSnatch (100%), which is independent of timing magnitude. 5.3 Ablation Study [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 4
Figure 4. ESS tipping point at τ ∗ = 31.6% adversary prevalence. Below the threshold global caching dominates (94% at convergence); above it ephemeral caching becomes the ESS [PITH_FULL_IMAGE:figures/full_fig_p008_4.png] view at source ↗

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

31 extracted references · 28 canonical work pages

  1. [1]

    , author Abdelnabi, S

    author Greshake, K. , author Abdelnabi, S. , author Mishra, S. , author Endres, C. , author Holz, T. , author Fritz, M. , year 2023 . title Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection , in: booktitle Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AISec) , ...

    work page 2023

  2. [2]

    , author Lipp, M

    author Gruss, D. , author Lipp, M. , author Schwarz, M. , author Fellner, R. , author Maurice, C. , author Mangard, S. , year 2017 . title KASLR is Dead: Long Live KASLR , in: booktitle Engineering Secure Software and Systems (ESSoS) , publisher Springer

    work page 2017

  3. [3]

    , author Sigmund, K

    author Hofbauer, J. , author Sigmund, K. , year 1988 . title The Theory of Evolution and Dynamical Systems . publisher Cambridge University Press

    work page 1988

  4. [4]

    , author Daly, R

    author Kim, Y. , author Daly, R. , author Kim, J. , author Fallin, C. , author Lee, J.H. , author Lee, D. , author Wilkerson, C. , author Lai, K. , author Mutlu, O. , year 2014 . title Flipping Bits in Memory Without Accessing Them: An Experimental Study of DRAM Disturbance Errors , in: booktitle Proceedings of the 41st Annual International Symposium on C...

    work page 2014

  5. [5]

    , author Li, Z

    author Kwon, W. , author Li, Z. , author Zhuang, S. , author Sheng, Y. , author Zheng, L. , author Yu, C.H. , author Gonzalez, J.E. , author Zhang, H. , author Stoica, I. , year 2023 . title Efficient Memory Management for Large Language Model Serving with PagedAttention , in: booktitle Proceedings of the 29th Symposium on Operating Systems Principles (SO...

    work page 2023

  6. [7]

    , author Schmidt, L

    author Milli, S. , author Schmidt, L. , author Dragan, A.D. , author Hardt, M. , year 2019 . title Model Reconstruction from Model Explanations , in: booktitle Proceedings of the 2019 Conference on Fairness, Accountability, and Transparency (FAccT) , publisher ACM

    work page 2019

  7. [8]

    , author Ribeiro, I

    author Perez, F. , author Ribeiro, I. , year 2022 . title Ignore Previous Prompt: Attack Techniques for Language Models , in: booktitle NeurIPS ML Safety Workshop

    work page 2022

  8. [10]

    , year 2011

    author Tambe, M. , year 2011 . title Security and Game Theory: Algorithms, Deployed Systems, Lessons Learned . publisher Cambridge University Press

    work page 2011

Show all 31 references
  1. [11]

    , author Zhang, F

    author Tram \`e r, F. , author Zhang, F. , author Juels, A. , author Reiter, M.K. , author Ristenpart, T. , year 2016 . title Stealing Machine Learning Models via Prediction APIs , in: booktitle Proceedings of the 25th USENIX Security Symposium , publisher USENIX Association

    2016

  2. [12]

    title RFC: Prefix Cache Isolation via cache\_salt

    author vLLM Project , year 2025 . title RFC: Prefix Cache Isolation via cache\_salt . howpublished https://github.com/vllm-project/vllm/issues/16016 . note VLLM RFC \#16016; cache\_salt request field, released in vLLM 0.9

    2025

  3. [13]

    , author Feng, S

    author Wallace, E. , author Feng, S. , author Kandpal, N. , author Gardner, M. , author Singh, S. , year 2019 . title Universal Adversarial Triggers for Attacking and Analyzing NLP , in: booktitle Proceedings of the 2019 Conference on Empirical Methods in Natural Language Proc...

    2019

  4. [14]

    , author Zhang, Z

    author Wu, G. , author Zhang, Z. , author Zhang, Y. , author Liu, M. , author Gao, Y. , author Tang, R. , author Wang, Q. , year 2025 . title I Know What You Asked: Prompt Leakage via KV-Cache Sharing in Multi-Tenant LLM Serving , in: booktitle Proceedings of the 2025 Network ...

    2025

  5. [15]

    , author Falkner, K

    author Yarom, Y. , author Falkner, K. , year 2014 . title FLUSH+RELOAD : A High Resolution, Low Noise, L3 Cache Side-Channel Attack , in: booktitle Proceedings of the 23rd USENIX Security Symposium , publisher USENIX Association

    2014

  6. [16]

    , author Yin, L

    author Zheng, L. , author Yin, L. , author Xie, Z. , author Sun, J. , author Huang, C. , author Yu, C.H. , author Cao, S. , author Kozyrakis, C. , author Stoica, I. , author Gonzalez, J.E. , author Barrett, C. , author Sheng, Y. , year 2024 a. title SGLang: Efficient Execution...

    2024

  7. [18]

    Proceedings of the 2025 Network and Distributed System Security Symposium (NDSS) , year =

    Wu, Guangjing and Zhang, Zheng and Zhang, Yanping and Liu, Mingzhe and Gao, Yansong and Tang, Run and Wang, Qiben , title =. Proceedings of the 2025 Network and Distributed System Security Symposium (NDSS) , year =

    2025

  8. [19]

    arXiv preprint arXiv:2409.20002 , year =

    Song, Lingjuan and Pang, Zheng and Wang, Wei and He, Bingsheng and Shan, Elaine and Zhang, Ji , title =. arXiv preprint arXiv:2409.20002 , year =

  9. [20]

    arXiv preprint arXiv:2411.18191 , year =

    Zheng, Xinyue and Han, Hao and Shi, Shuai and Qian, Jun and Geng, Zhiyuan and Zhang, Wei , title =. arXiv preprint arXiv:2411.18191 , year =

    arXiv

  10. [21]

    and Zhang, Hao and Stoica, Ion , title =

    Kwon, Woosuk and Li, Zhuohan and Zhuang, Siyuan and Sheng, Ying and Zheng, Lianmin and Yu, Cody Hao and Gonzalez, Joseph E. and Zhang, Hao and Stoica, Ion , title =. Proceedings of the 29th Symposium on Operating Systems Principles (SOSP) , year =

  11. [22]

    and Barrett, Clark and Sheng, Ying , title =

    Zheng, Lianmin and Yin, Liangsheng and Xie, Zhiqiang and Sun, Jeff and Huang, Chuyue and Yu, Cody Hao and Cao, Shiyi and Kozyrakis, Christos and Stoica, Ion and Gonzalez, Joseph E. and Barrett, Clark and Sheng, Ying , title =. Advances in Neural Information Processing Systems ...

  12. [23]

    arXiv preprint arXiv:2405.16444 , year =

    Liu, Yuhan and Li, Hanchen and Du, Yihua and Su, Shan and Shan, Jiayi and Qian, Yilong and Rinard, Martin and Stoica, Ion and Zhang, Hao and Chen, Zhuohan , title =. arXiv preprint arXiv:2405.16444 , year =

    arXiv

  13. [24]

    Proceedings of the 23rd USENIX Security Symposium , year =

    Yarom, Yuval and Falkner, Katrina , title =. Proceedings of the 23rd USENIX Security Symposium , year =

  14. [25]

    Engineering Secure Software and Systems (ESSoS) , year =

    Gruss, Daniel and Lipp, Moritz and Schwarz, Michael and Fellner, Richard and Maurice, Cl\'. Engineering Secure Software and Systems (ESSoS) , year =

  15. [26]

    Proceedings of the 41st Annual International Symposium on Computer Architecture (ISCA) , year =

    Kim, Yoongu and Daly, Ross and Kim, Jeremie and Fallin, Chris and Lee, Ji Hye and Lee, Donghyuk and Wilkerson, Chris and Lai, Konrad and Mutlu, Onur , title =. Proceedings of the 41st Annual International Symposium on Computer Architecture (ISCA) , year =

  16. [27]

    Topics in Cryptology -- CT-RSA , year =

    Osvik, Dag Arne and Shamir, Adi and Tromer, Eran , title =. Topics in Cryptology -- CT-RSA , year =

  17. [28]

    Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AISec) , year =

    Greshake, Kai and Abdelnabi, Sahar and Mishra, Shailesh and Endres, Christoph and Holz, Thorsten and Fritz, Mario , title =. Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AISec) , year =

  18. [29]

    NeurIPS ML Safety Workshop , year =

    Perez, F. NeurIPS ML Safety Workshop , year =

  19. [30]

    Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing (EMNLP) , year =

    Wallace, Eric and Feng, Shi and Kandpal, Nikhil and Gardner, Matt and Singh, Sameer , title =. Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing (EMNLP) , year =

    2019

  20. [31]

    Proceedings of the 25th USENIX Security Symposium , year =

    Tram. Proceedings of the 25th USENIX Security Symposium , year =

  21. [32]

    and Hardt, Moritz , title =

    Milli, Smitha and Schmidt, Ludwig and Dragan, Anca D. and Hardt, Moritz , title =. Proceedings of the 2019 Conference on Fairness, Accountability, and Transparency (FAccT) , year =

    2019

  22. [33]

    2011 , publisher =

    Tambe, Milind , title =. 2011 , publisher =

    2011

  23. [34]

    1988 , publisher =

    Hofbauer, Josef and Sigmund, Karl , title =. 1988 , publisher =

    1988

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.