Chat-only attack poisons reused reasoning KV caches in LLMs
Original title: Stealthy Poisoning Attacks via Reused KV Cache of Reasoning
R2ECAP reached up to 79% success on three open-weight models and beat HijackKV in eight of nine constrained settings.
A paper shows that reusing key-value caches from reasoning traces can be poisoned through a system's chat interface. R2ECAP plants a preceding trace that steers the model and a retained trace whose cache keeps residual adversarial influence after the preceding trace is discarded. Across three open-weight LLMs and three datasets, success reached 79%, and 46% in a reasoning-trace retrieval system. A popular prompt-injection detector flagged 1% of retained responses.
Unconfirmed: The abstract does not name the three models, datasets, or detector.
- The attack is black-box and uses only chat interactions.
- It beat white-box HijackKV in 8 of 9 resource-constrained settings.
- Success was 46% against a reasoning-trace retrieval system.
- Only 1% of retained responses were detected as prompt injection.
Impact: Poisoned caches steer later model outputs toward an attacker target
From the original article
1 min read at arxiv.orgModern large language model (LLM) systems reuse key-value (KV) caches to accelerate inference. Recent work has shown that reusing KV caches from reasoning traces can also improve task performance, similar to retrieval-augmented generation (RAG). We demonstrate that this form of KV cache reuse introduces new poisoning vulnerabilities.
By L. Zhu · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.