HijackKV: Position-Independent KV Cache Reuse Lets an Attacker Hijack Queries With 94% Success and Zero Malicious Text in the Prompt

arXiv 2607.19957·high signal

Serving stacks that adopted position-independent KV reuse (reusing cache for any identical text chunk regardless of position, to raise hit rates over prefix-only matching) inherit a new attack class: the cached KV for a benign chunk can secretly encode an attacker-controlled prefix. HIJACKKV optimizes that prefix so a victim query reusing the chunk is steered to the attacker's goal — 94% average success in a single attempt, still effective at 10% cache hit rates and 50% recomputation, persisting across multi-turn turns and transferring black-box across models. If you enabled chunk-level KV reuse for throughput, this is a live config risk, not a theoretical one.