Key-Value Cache Poisoning

The core mechanism of KV cache poisoning involves overwriting or injecting adversarial Key-Value pairs into the cache. Since the attention mechanism computes relevance by comparing query vectors against stored keys, a poisoned cache causes the model to allocate disproportionate attention weights to attacker-controlled tokens. This effectively silences legitimate system prompts or retrieved context, redirecting the model's focus to malicious instructions hidden within the cache state.

In serving systems that use prefix caching for efficiency, multiple users or requests may share a common KV cache prefix. An attacker can poison this shared prefix with adversarial key-value states. Subsequent requests that reuse the cached prefix inherit the poisoned attention pattern, enabling a cross-request attack where one user's malicious payload influences another user's model outputs without direct interaction.

This advanced variant bypasses token-level manipulation by directly injecting a crafted residual stream vector into the model's forward pass. The injected vector is added to the hidden states before they are projected into keys and values, effectively steering the entire attention computation. This allows an attacker to override internal representations without needing to place visible adversarial tokens in the text input, making detection significantly harder.

Transformers with finite cache sizes must evict older KV pairs to make room for new tokens. Attackers exploit eviction policies by flooding the context with padding tokens that displace critical safety instructions from the cache. Once the system prompt's KV pairs are evicted, the model operates without safety constraints. This is a temporal attack that weaponizes the cache's limited capacity against itself.

In conversational agents that persist the KV cache across dialogue turns, an attacker can poison the cache in an early turn and have the malicious attention pattern persist indefinitely. The poisoned keys and values remain resident in memory, influencing all subsequent reasoning. This long-range contamination is particularly dangerous because the attack surface extends across the entire session lifetime, not just a single prompt.

Systems using speculative decoding generate candidate tokens with a draft model and verify them with the target model, sharing KV caches between the two. An attacker who compromises the draft model can inject poisoned KV states that the target model inherits during verification. This creates a supply-chain attack vector where a weaker, less-secured model poisons a more capable one through shared cache infrastructure.