Cache Poisoning

LLM serving infrastructure uses multiple cache layers to reduce latency and cost: KV-cache (stores attention key-value pairs for prefix reuse), semantic cache (returns stored responses for semantically similar queries), and prompt cache (reuses pre-computed context for shared system prompts). The design assumption is that cached content is equivalent to freshly computed content and that cache boundaries align with trust boundaries. The gap: caches create cross-request state that can be manipulated.

• Monitor cache hit ratios per user — anomalously high hit rates on novel queries indicate probing
• Instrument TTFT variance and alert on systematic sequential probing patterns
• Validate cached responses against fresh model output on a sampling basis
• Log cache population events with user attribution for forensic analysis

Cache poisoning enables persistent indirect prompt injection (T1-AT-series) that survives session boundaries. Cache timing side channels (T5-AP-003B) enable T5-AT-014 (Side Channel Attacks) and feed T5-AT-005 (Model Fingerprinting).