Cache reuse lets attackers hijack prompts with zero injected text

HijackKV breaks inference servers that reuse KV cache for any matching chunk, not just shared prefixes, per a new arXiv paper. The attack hits a 94 percent success rate in a single attempt, with zero malicious text anywhere in the visible prompt.

The cached KV for a completely benign chunk can secretly encode an attacker-controlled prefix. When a victim's query reuses that chunk, the model gets steered toward the attacker's goal. The attack still works when only 10% of requests hit the cache and half the KV needs recomputing. That's closer to how production caches behave than a lab best case. It also persists across multi-turn conversations and transfers black-box across different models, so this isn't a quirk of one architecture.

Here's the part worth sitting with. Prefix-only KV caching, which only reuses cache when the preceding text matches exactly, doesn't have this hole. Chunk-level reuse, matching on content regardless of position, is what opens the door. Teams turned chunk-level reuse on for throughput. Nobody was evaluating it as an attack surface, because the exploit needs no injected text. The risk sits in the cache policy, not the prompt.

If you run a self-hosted inference stack, or you're evaluating one, ask this directly. Is KV cache reuse scoped to prefixes only, or does it match on chunk content regardless of position? The paper doesn't say whether serving frameworks ship chunk-level reuse on by default or as an opt-in. That's the detail I'd want before deciding how urgent this is for any specific stack.