Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-23 · high
HijackKV attacks inference servers that reuse KV cache across matching text chunks instead of only shared prefixes, hitting a 94 percent success rate.
Why now: Covered in the July 23 briefing off the arXiv paper.
HijackKV breaks inference servers that reuse KV cache for any matching chunk, not just shared prefixes, per a new arXiv paper. The attack hits a 94 percent success rate in a single attempt, with zero malicious text anywhere in the visible prompt.
The cached KV for a completely benign chunk can secretly encode an attacker-controlled prefix. When a victim's query reuses that chunk, the model gets steered toward the attacker's goal. The attack still works when only 10% of requests hit the cache and half the KV needs recomputing. That's closer to how production caches behave than a lab best case. It also persists across multi-turn conversations and transfers black-box across different models, so this isn't a quirk of one architecture.
Here's the part worth sitting with. Prefix-only KV caching, which only reuses cache when the preceding text matches exactly, doesn't have this hole. Chunk-level reuse, matching on content regardless of position, is what opens the door. Teams turned chunk-level reuse on for throughput. Nobody was evaluating it as an attack surface, because the exploit needs no injected text. The risk sits in the cache policy, not the prompt.
If you run a self-hosted inference stack, or you're evaluating one, ask this directly. Is KV cache reuse scoped to prefixes only, or does it match on chunk content regardless of position? The paper doesn't say whether serving frameworks ship chunk-level reuse on by default or as an opt-in. That's the detail I'd want before deciding how urgent this is for any specific stack.
Each link below shares sources, entities, or timing with this story.
Same source domain / Shared topic / Tension
Reported by the same outlet (arxiv.org); overlapping topics (against, attack, model); pushes against this story (against).
Same source domain / Shared topic / Downstream implication
Reported by the same outlet (arxiv.org); overlapping topics (against, attack, attacker); traces where this leads (which means).
Same source domain / Shared topic / Tension
Reported by the same outlet (arxiv.org); overlapping topics (against, attack, attacker); pushes against this story (against).
Reported by the same outlet (arxiv.org); overlapping topics (against, attack); pushes against this story (but).
Reported by the same outlet (arxiv.org); overlapping topics (against, model); pushes against this story (against).
Reported by the same outlet (arxiv.org); overlapping topics (against, attack); pushes against this story (against).
Reported by the same outlet (arxiv.org); overlapping topics (against, model); pushes against this story (against).
Reported by the same outlet (arxiv.org); overlapping topics (against, attack); pushes against this story (against).