mlsanityData to 14 Oct 2026

Shadow in the Cache: Unveiling and Mitigating Privacy Risks of KV-cache in LLM Inference

arXiv 2508.09442 ↗First posted 13 Aug 2025cs.CR cs.AI cs.CLcited by 21

On the map: Efficient LLM inference and serving → KV cache optimization

Abstract (arXiv)

The Key-Value (KV) cache, which stores intermediate attention computations (Key and Value pairs) to avoid redundant calculations, is a fundamental mechanism for accelerating Large Language Model (LLM) inference. However, this efficiency optimization introduces significant yet underexplored privacy risks. This paper provides the first comprehensive analysis of these vulnerabilities, demonstrating that an attacker can reconstruct sensitive user inputs directly from the KV-cache. We design and implement three distinct attack vectors: a direct Inversion Attack, a more broadly applicable and potent Collision Attack, and a semantic-based Injection Attack. These methods demonstrate the practicality and severity of KV-cache privacy leakage issues. To mitigate this, we propose KV-Cloak, a novel, lightweight, and efficient defense mechanism. KV-Cloak uses a reversible matrix-based obfuscation scheme, combined with operator fusion, to secure the KV-cache. Our extensive experiments show that KV-Cloak effectively thwarts all proposed attacks, reducing reconstruction quality to random noise. Crucially, it achieves this robust security with virtually no degradation in model accuracy and minimal performance overhead, offering a practical solution for trustworthy LLM deployment.

Key facts. Cited by 21 papers in the map (data through 14 Oct 2026). Placed in KV cache optimization, one of 12 directions in Efficient LLM inference and serving. Builds on 33 of its 54 references that are in the map. First posted on arXiv 13 Aug 2025.

Builds on

33 of 54 references.

Closest ancestors · 1

Same direction, newest first

  1. 2023Efficient Memory Management for Large Language Model Serving with PagedAttention12 Sep

Other references · 32

  1. 2017Attention Is All You Needcited by 60,361
  2. 2024The Llama 3 Herd of Modelscited by 14,715
  3. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,132
  4. 2021Training Verifiers to Solve Math Word Problemscited by 10,109
  5. 2020Measuring Massive Multitask Language Understandingcited by 7,963
  6. 2025DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learningcited by 6,330
  7. 2019BERTScore: Evaluating Text Generation with BERTcited by 5,512
  8. 2021RoFormer: Enhanced Transformer with Rotary Position Embeddingcited by 4,703
  9. 2016SQuAD: 100,000+ Questions for Machine Comprehension of Textcited by 4,148
  10. 2022OPT: Open Pre-trained Transformer Language Modelscited by 3,512
  11. 2017Outrageously Large Neural Networks: The Sparsely-Gated Mixture-of-Experts Layercited by 3,509
  12. 2016Deep Learning with Differential Privacycited by 2,728
20 more
  1. 2023A Survey of Large Language Modelscited by 2,576
  2. 2020Extracting Training Data from Large Language Modelscited by 2,189
  3. 2023GQA: Training Generalized Multi-Query Transformer Models from Multi-Head Checkpointscited by 1,346
  4. 2024DeepSeek-V2: A Strong, Economical, and Efficient Mixture-of-Experts Language Modelcited by 1,135
  5. 2024Qwen2.5-Math Technical Report: Toward Mathematical Expert Model via Self-Improvementcited by 1,090
  6. 2020Aligning AI With Shared Human Valuescited by 723
  7. 2022Efficiently Scaling Transformer Inferencecited by 539
  8. 2023LMSYS-Chat-1M: A Large-Scale Real-World LLM Conversation Datasetcited by 461
  9. 2023Text Embeddings Reveal (Almost) As Much As Textcited by 192
  10. 2023Efficient Large Language Models: A Surveycited by 186
  11. 2017A Survey on Homomorphic Encryption Schemes: Theory and Implementationcited by 156
  12. 2023Sentence Embedding Leaks More Information than You Expect: Generative Embedding Inversion Attack to Recover the Whole Sentencecited by 81
  13. 2024Infinite-LLM: Efficient LLM Service for Long Context with DistAttention and Distributed KVCachecited by 73
  14. 2019Differentially Private Model Publishing for Deep Learningcited by 71
  15. 2025Rethinking Data Protection in the (Generative) Artificial Intelligence Eracited by 18
  16. 2021Teacher Model Fingerprinting Attacks Against Transfer Learningcited by 16
  17. 2025On Benchmarking Code LLMs for Android Malware Analysiscited by 13
  18. 2024Information Leakage from Embedding in Large Language Modelscited by 10
  19. 2024A First Look At Efficient And Secure On-Device LLM Inference Against KV Leakagecited by 8
  20. 2024LeftoverLocals: Listening to LLM Responses Through Leaked GPU Local Memorycited by 5

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 3; 2026: 18.

21 papers.

Sort:

By area:

  1. 2025SoK: Large Language Model Copyright Auditing via Fingerprintingcited by 15
  2. 2026LCGuard: Latent Communication Guard for Safe KV Sharing in Multi-Agent Systemscited by 6
  3. 2026From Similarity to Vulnerability: Key Collision Attack on LLM Semantic Cachingcited by 4
  4. 2026AgenTEE: Confidential LLM Agent Execution on Edge Devicescited by 4
  5. 2025Can Transformer Memory Be Corrupted? Investigating Cache-Side Vulnerabilities in Large Language Modelscited by 3
  6. 2025Countermind: A Multi-Layered Security Architecture for Large Language Modelscited by 2
  7. 2026LLM Benchmark Datasets Should Be Contamination-Resistantcited by 2
  8. 2026Agent-Assisted Side-Channel Attacks on Non-Prefix KV Cache in RAGcited by 2
  9. 2026HijackKV: New Threat in Position-Independent KV Cache Reusecited by 2
  10. 2026OptiLeak: Efficient Prompt Reconstruction via Reinforcement Learning in Multi-tenant LLM Servicescited by 1
  11. 2026An Efficient and Privacy-Preserving Architecture for Cross-Institutional Collaborative RAGcited by 1
  12. 2026LaCache: Robust Semantic Caching for LLM Servingcited by 1
9 more
  1. 2026Good-Enough LLM Obfuscation (GELO)cited by 0
  2. 2026Computational Challenges in Token Economics: Bridging Economic Theory and AI System Designcited by 0
  3. 2026Hidden-State Privacy Has an Empty Middlecited by 0
  4. 2026SparSEEty: Extracting Tokens from Sparsity-Exploiting LLM Serving Systems via Deterministic Side Channelscited by 0
  5. 2026LLMscope: Extracting LLM Assets from Edge AI Chips via Optical Probingcited by 0
  6. 2026Unified AI Gateway: A Framework for Joint Model Routing and KV Cache Managementcited by 0
  7. 2026When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systemscited by 0
  8. 2026SparLeak: Privacy Leakage from Sparse Attention in LLM Inference on Shared GPUscited by 0
  9. 2026When Goals Leak Across Relationships: How Cached Goal Representations Shape Cross-Client Decisionscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Selective KV-Cache Sharing to Mitigate Timing Side-Channels in LLM Inference
  2. 2026Governing the KV Cache: Preventing Timing Side-Channel Leakage in Multi-Tenant LLM Inference
  3. 2026KV Cache Optimization Strategies for Scalable and Efficient LLM Inference
  4. 2026Fast KVzip: Efficient and Accurate LLM Inference with Gated KV Eviction
  5. 2025SOFT: Selective Data Obfuscation for Protecting LLM Fine-tuning against Membership Inference Attacks
  6. 2026Coverage-Driven KV Cache Eviction for Efficient and Improved Inference of LLM
  7. 2026Privacy-Aware Split Inference with Speculative Decoding for Large Language Models over Wide-Area Networks
  8. 2025KVSink: Understanding and Enhancing the Preservation of Attention Sinks in KV Cache Quantization for LLMs