HijackKV: New Threat in Position-Independent KV Cache Reuse

2026-07-22

AI Summary

This work reveals a critical security vulnerability in position-agnostic key-value (KV) cache reuse mechanisms, wherein an adversary can hijack model behavior by manipulating cached context—even when the input itself contains no malicious content. To systematically exploit this flaw, the paper introduces HIJACKKV, a novel attack framework that optimizes an attacker-controlled prefix so that the KV cache associated with benign text implicitly encodes a malicious target. During cache reuse, this enables stealthy control over model outputs. The method achieves an average success rate of 94% in single-shot attacks and remains effective under challenging conditions, including low cache hit rates (10%) and high recomputation rates (50%). Furthermore, it demonstrates cross-model black-box transferability and offers practical recommendations for designing secure caching mechanisms.

Abstract

Key-Value (KV) cache reduces inference latency in large language models (LLMs). Traditional prefix-based reuse has low cache hit rates across inference requests because it requires exact token and position matches. To improve efficiency, recent system optimizations introduce position-independent KV reuse, allowing KV cache to be reused whenever identical text chunks appear, regardless of their position in the sequence. We show this design introduces a new threat, KV Cache Hijacking. Since KV caches are retrieved by token match but encode the context in which they were originally computed, the KV tied to a benign-looking token chunk may encode an attacker-controlled prefix. When later reused in a victim query, this contaminated KV silently hijacks the model's behavior, even if no attacker-controlled text appears in the input. We introduce HIJACKKV, the first attack framework that systematically exploits this vulnerability, demonstrating its severity and practicality. HIJACKKV optimizes an attacker-controlled prefix, so that the KV computed for a subsequent common benign text encodes the attacker's goal, while the text remains unchanged for future cache hits. HIJACKKV achieves an average 94% success rate in a single attempt, remains effective under realistic constraints including low hit rates (10%) and frequent recomputation (50%), persists over multi-turn interactions, and transfers across models in black-box settings. We further provide design insights for building secure KV reuse systems.

Problem

• KV cache hijacking
• position-independent reuse
• large language models
• cache security
• inference attack

Innovation

• KV Cache Hijacking
• position-independent reuse
• LLM security
• cache poisoning
• HIJACKKV