Bit-Flip Vulnerability of Shared KV-Cache Blocks in LLM Serving Systems

• URL: http://arxiv.org/abs/2604.17249v1
• Date: Sun, 19 Apr 2026 04:31:12 GMT
• Title: Bit-Flip Vulnerability of Shared KV-Cache Blocks in LLM Serving Systems
• Abstract summary: In vLLM's Prefix Caching, shared KV-cache blocks exist as a single physical copy without integrity protection.<n>We characterize worst-case severity and identify three properties: silent divergence, selective propagation, and persistent amplification.<n>A persistent integrity-based countermeasure detects any single-bit corruption at scheduling time, bounding cumulative damage to one batch independent of the block's cache lifetime.
• Score: 0.17188280334580197
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Rowhammer on GPU DRAM has enabled adversarial bit flips in model weights; shared KV-cache blocks in LLM serving systems present an analogous but previously unexamined target. In vLLM's Prefix Caching, these blocks exist as a single physical copy without integrity protection. Using software fault injection under ideal bit targeting, we characterize worst-case severity and identify three properties: (1) Silent divergence - 13 of 16 BF16 bit positions produce coherent but altered outputs, indistinguishable from legitimate responses without a clean baseline. (2) Selective propagation - only requests sharing the targeted prefix are affected. (3) Persistent accumulation - no temporal decay occurs, so cumulative damage grows linearly with subsequent requests. Together, these constitute a threat profile distinct from weight corruption: silent divergence and selective propagation enable detection evasion; persistent accumulation then proceeds unchecked, yielding damage amplification bounded only by how long the block remains cached. A checksum-based countermeasure detects any single-bit corruption at scheduling time, bounding cumulative damage to one batch independent of the block's cache lifetime, with negligible overhead. These results argue for integrity protection of prefix blocks before end-to-end exploitation is demonstrated.

Related papers

• SafeCA: Safe Cross-Attention Localization and Regulation for Text-to-Video Jailbreak Defense [77.70598852234149]
  Text-to-Video (T2V) generative models are vulnerable to jailbreak attacks in real-world deployment.<n>We propose SafeCA, a feature-level defense mechanism for safe cross-attention localization and regularization.<n> Experimental results show that SafeCA reduces the jailbreak success rate by about 20% on mainstream T2V models.
  arXiv  Detail & Related papers  (2026-08-11T14:01:24Z)
• When Collaboration Becomes a Trigger: Collective Evidence-Threshold Backdoors in Multi-Agent Systems [57.450132281381066]
  Backdoor behavior can be activated when peer evidence reaches a hidden threshold, rather than being determined by any single message.<n>We introduce a collective evidence-threshold backdoor paradigm for MAS and Boundary-Conditioned Backdoor Injection (BCBI)<n>We propose LAtent Transition Test-time Evaluation (LATTE), a clean-only latent-transition defense that learns benign communication dynamics and quarantines anomalous agent updates.
  arXiv  Detail & Related papers  (2026-08-02T08:38:44Z)
• MemPoison: Uncovering Persistent Memory Threats and Structural Blind Spots in LLM Agents [20.418842618724607]
  We propose a comprehensive benchmark and analysis framework featuring 1227 hand-validated cases across four attack types.<n>We introduce a three-tier taxonomy: (L1) direct single-record corruption, (L2) compositional multi-record corruption and (L3) context-triggered dormant corruption.<n>Our evaluations reveal a distinct defense frontier: while baseline write-time defenses, such as consistency checks, substantially suppress direct L1 attacks, they fail to reliably suppress L2 and L3 attacks.
  arXiv  Detail & Related papers  (2026-07-16T07:19:33Z)
• Agent-Assisted Side-Channel Attacks on Non-Prefix KV Cache in RAG [17.045113249152234]
  We introduce the first end-to-end side-channel attack targeting non- KV cache fusion.<n>SpliceLeak executes a systematic two-phase privacy breach.<n>SpliceDefense effectively flattens the side-channel signal (Delta TTFT 0) with negligible throughput overhead.
  arXiv  Detail & Related papers  (2026-06-20T02:28:28Z)
• Prefix-Adaptive Block Diffusion for Efficient Document Recognition [52.15352911463151]
  Block Diffusion Models (BDMs) support parallel generation, flexible-length output, and KV caching, making them promising for efficient document parsing.<n>We propose the Prefix- Block Diffusion Model (PA-BDM) which replaces intra-block bidirectional denoising with causal denoising from prefix to suffix.<n> Experiments show that the 3B PA-BDM achieves higher recognition scores on several benchmarks and improves inference throughput by 71.6% over the 2.5B MinerU-Diffusion.
  arXiv  Detail & Related papers  (2026-05-16T07:50:13Z)
• MemLineage: Lineage-Guided Enforcement for LLM Agent Memory [3.058164432275431]
  We introduce MemLineage, a defense for LLM agent memory that attaches cryptographic provenance and LLM-mediated lineage to every entry.<n>Recent and concurrent work shows that untrusted content can be written into persistent agent state and re-enter later sessions as an instruction.<n>MemLineage treats this as a chain-of-custody problem rather than a filtering problem.
  arXiv  Detail & Related papers  (2026-05-14T06:07:54Z)
• TwinGate: Stateful Defense against Decompositional Jailbreaks in Untraceable Traffic via Asymmetric Contrastive Learning [60.68349524623048]
  Decompositional jailbreaks pose a critical threat to large language models.<n>We present TwinGate, a stateful dual-encoder defense framework.<n>We construct a comprehensive dataset of over 3.62 million instructions spanning 8,600 distinct malicious intents.
  arXiv  Detail & Related papers  (2026-04-30T13:44:01Z)
• Compiling Activation Steering into Weights via Null-Space Constraints for Stealthy Backdoors [48.881343993730844]
  Safety-aligned large language models (LLMs) are increasingly deployed in real-world pipelines.<n> adversaries can distribute backdoored checkpoints that behave normally under standard evaluation but jailbreak when a hidden trigger is present.<n>Recent post-hoc weight-editing methods offer an efficient approach to injecting such backdoors.
  arXiv  Detail & Related papers  (2026-04-14T06:48:33Z)
• Jailbreaking the Matrix: Nullspace Steering for Controlled Model Subversion [12.201783188544093]
  Head-Masked Nullspace Steering (HMNS) identifies attention heads most causally responsible for a model's default behavior.<n>This is the first jailbreak method to leverage geometry-aware, interpretability-informed interventions.
  arXiv  Detail & Related papers  (2026-04-11T19:19:05Z)
• RAIN: Secure and Robust Aggregation under Shuffle Model of Differential Privacy [46.52109845749167]
  We present Robust Aggregation in Noise (RAIN), a framework that reconciles privacy, robustness, and verifiability under Shuffle-DP.<n>RAIN adopts sign-space aggregation to robustly measure update consistency and limit malicious influence under noise and anonymization.<n>We show that RAIN maintains strong privacy guarantees under Shuffle-DP and remains robust to poisoning attacks with negligible degradation in accuracy and convergence.
  arXiv  Detail & Related papers  (2026-03-03T15:41:54Z)
• TrapSuffix: Proactive Defense Against Adversarial Suffixes in Jailbreaking [52.72486831074384]
  Suffix-based jailbreak attacks append an adversarial suffix, i.e., a short token sequence, to steer aligned LLMs into unsafe outputs.<n>We propose TrapSuffix, a lightweight fine-tuning approach that injects trap-aligned behaviors into the base model without changing the inference pipeline.<n>Across diverse suffix-based jailbreak settings, TrapSuffix reduces the average attack success rate to below 0.01 percent and achieves an average tracing success rate of 87.9 percent.
  arXiv  Detail & Related papers  (2026-02-06T11:43:56Z)
• RedVisor: Reasoning-Aware Prompt Injection Defense via Zero-Copy KV Cache Reuse [47.85771791033142]
  We propose RedVisor, a framework that synthesizes the explainability of detection systems with the seamless integration of prevention strategies.<n>RedVisor is the first approach to leverage fine-grained reasoning paths to simultaneously detect attacks and guide the model's safe response.<n> Experiments demonstrate that RedVisor outperforms state-of-the-art defenses in detection accuracy and throughput while incurring negligible utility loss.
  arXiv  Detail & Related papers  (2026-02-02T08:26:51Z)
• NeuroFilter: Privacy Guardrails for Conversational LLM Agents [50.75206727081996]
  This work addresses the computational challenge of enforcing privacy for agentic Large Language Models (LLMs)<n>NeuroFilter is a guardrail framework that operationalizes contextual integrity by mapping norm violations to simple directions in the model's activation space.<n>A comprehensive evaluation across over 150,000 interactions, covering models from 7B to 70B parameters, illustrates the strong performance of NeuroFilter.
  arXiv  Detail & Related papers  (2026-01-21T05:16:50Z)
• ByteShield: Adversarially Robust End-to-End Malware Detection through Byte Masking [3.9604662604261858]
  Research has proven that end-to-end malware detectors are vulnerable to adversarial attacks.<n>We propose a novel defense mechanism designed to harden end-to-end malware detectors by leveraging masking at the byte level.
  arXiv  Detail & Related papers  (2025-12-10T18:13:28Z)
• DiffuGuard: How Intrinsic Safety is Lost and Found in Diffusion Large Language Models [50.21378052667732]
  We conduct an in-depth analysis of dLLM vulnerabilities to jailbreak attacks across two distinct dimensions: intra-step and inter-step dynamics.<n>We propose DiffuGuard, a training-free defense framework that addresses vulnerabilities through a dual-stage approach.
  arXiv  Detail & Related papers  (2025-09-29T05:17:10Z)
• Predictive-CSM: Lightweight Fragment Security for 6LoWPAN IoT Networks [0.0]
  This work explores a defense strategy that takes a more adaptive, behavior-aware approach to this problem.<n>Our system, called Predictive-CSM, introduces a combination of two lightweight mechanisms.<n>We put this system to the test using a set of targeted attack simulations, including early fragment injection, replayed headers, and flooding with fake data.
  arXiv  Detail & Related papers  (2025-06-02T15:15:18Z)
• Neural Antidote: Class-Wise Prompt Tuning for Purifying Backdoors in CLIP [51.04452017089568]
  Class-wise Backdoor Prompt Tuning (CBPT) is an efficient and effective defense mechanism that operates on text prompts to indirectly purify CLIP.<n>CBPT significantly mitigates backdoor threats while preserving model utility.
  arXiv  Detail & Related papers  (2025-02-26T16:25:15Z)
• Certified Adversarial Robustness of Machine Learning-based Malware Detectors via (De)Randomized Smoothing [9.881799766856476]
  We introduce a certifiable defense against patch attacks that guarantees, for a given executable and an adversarial patch size, no adversarial EXEmple exist. Our method is inspired by (de)randomized smoothing which provides deterministic robustness certificates. Results show that our method exhibits unmatched robustness against strong content-insertion attacks, outperforming randomized smoothing-based defenses in the literature.
  arXiv  Detail & Related papers  (2024-05-01T08:45:57Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.