Cache Poisoning

The attack exploits discrepancies between the cache key and the application's processing logic. An attacker sends an HTTP request with a malicious, unkeyed header (e.g., X-Forwarded-Host). The cache ignores this header when identifying the cached object but the origin server uses it to generate the response. The cache then stores a poisoned response associated with a clean cache key, serving malicious content to subsequent legitimate users.

A classic technique where an attacker injects carriage return and line feed (CRLF) characters into a request header. If the origin server reflects this input without sanitization, the attacker can craft a response that the cache interprets as two separate responses. The second, fully attacker-controlled response is cached and served for a legitimate URL, enabling cross-site scripting (XSS) or defacement.

Many caches treat GET and HEAD requests as interchangeable for caching purposes. An attacker can send a malicious POST request that triggers a harmful server-side action. If the cache is misconfigured to store the response and serve it for subsequent GET requests to the same path, the attacker poisons the cache with a state-changing operation's result, affecting all users requesting the resource.

An attacker sends a GET request that includes a request body, which is technically allowed by the HTTP specification but rarely expected. If the origin server processes this body to generate the response but the cache key is derived only from the URL and headers, the cache will store a body-influenced response. Any subsequent GET request to the same URL will receive the poisoned response without the attacker's body.

If a cache is configured to route requests to a virtual host based on the Host header but does not include it in the cache key, an attacker can poison the cache. By sending a request with a malicious Host header pointing to an attacker-controlled server, the origin server might generate a response containing a poisoned absolute URL or script. The cache stores this under a clean key, serving the malicious asset to all users.

In AI-powered applications, cache poisoning can corrupt the grounding data or prompt context fetched from a poisoned endpoint. An attacker can inject malicious instructions into a cached API response that a retrieval-augmented generation (RAG) system treats as a trusted source. This leads to the AI model generating harmful outputs, exfiltrating data, or executing tool calls based on the attacker's injected commands.

A specific pathway or method by which an adversary introduces malicious samples into a training dataset to corrupt model behavior. While cache poisoning targets inference-time delivery, data poisoning attacks the model's foundational logic.

• Availability Poisoning: Indiscriminately degrades overall model accuracy
• Targeted Poisoning: Causes misclassification only on specific trigger inputs
• Backdoor Attacks: Embed hidden behaviors activated by an attacker-chosen pattern

A security flaw where malicious instructions override a model's system prompt, hijacking its intended behavior. This is the LLM-era analogue to cache poisoning, where untrusted input manipulates the output served to users.

• Direct Injection: Overriding system instructions with user input like 'Ignore previous directions'
• Indirect Injection: Poisoning data the model retrieves, such as a webpage containing hidden prompts
• Impact: Data exfiltration, misinformation, or tool invocation abuse

A standardized test suite designed to measure a model's resilience against evasion, poisoning, and other adversarial attacks. These benchmarks help quantify how susceptible an AI system is to inputs crafted to cause failure.

• Common Benchmarks: ImageNet-C, RobustBench, AdvGLUE
• Metrics: Attack success rate, perturbation magnitude, certified accuracy
• Relevance: Validates defenses against the same class of integrity attacks as cache poisoning

An exploit that tricks a server-side AI application into making unauthorized requests to internal resources. SSRF is often chained with cache poisoning to inject malicious content into an internal cache from a trusted origin.

• Common Targets: Cloud metadata endpoints (169.254.169.254), internal APIs
• Impact: Credential theft, internal network scanning, RCE
• Cache Poisoning Link: SSRF can poison internal caches by forcing the server to fetch attacker-controlled payloads

A programmable interface that filters or blocks toxic, unsafe, or policy-violating content generated by a model in real-time. This serves as a last-line defense when cache integrity fails and poisoned responses reach users.

• Capabilities: Toxicity scoring, PII redaction, prompt injection detection
• Deployment: Sits between the model output and the user-facing cache
• Limitation: Reactive, not preventive; cannot fix the poisoned cache entry itself