mlsanityData to 14 Oct 2026

Can Transformer Memory Be Corrupted? Investigating Cache-Side Vulnerabilities in Large Language Models

arXiv 2510.17098 ↗First posted 20 Oct 2025cs.CR cs.AIcited by 3

Not on the map. Why?

Abstract (arXiv)

Even when prompts and parameters are secured, transformer language models remain vulnerable because their key-value (KV) cache during inference constitutes an overlooked attack surface. This paper introduces Malicious Token Injection (MTI), a modular framework that systematically perturbs cached key vectors at selected layers and timesteps through controlled magnitude and frequency, using additive Gaussian noise, zeroing, and orthogonal rotations. A theoretical analysis quantifies how these perturbations propagate through attention, linking logit deviations to the Frobenius norm of corruption and softmax Lipschitz dynamics. Empirical results show that MTI significantly alters next-token distributions and downstream task performance across GPT-2 and LLaMA-2/7B, as well as destabilizes retrieval-augmented and agentic reasoning pipelines. These findings identify cache integrity as a critical yet underexplored vulnerability in current LLM deployments, positioning cache corruption as a reproducible and theoretically grounded threat model for future robustness and security research.

Key facts. Cited by 3 papers in the map (data through 14 Oct 2026). Builds on 23 of its 33 references that are in the map. First posted on arXiv 20 Oct 2025.

Builds on

23 of 33 references.

References · 23

  1. 2020Language Models are Few-Shot Learnerscited by 32,419
  2. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,132
  3. 2017On Calibration of Modern Neural Networkscited by 4,960
  4. 2016SQuAD: 100,000+ Questions for Machine Comprehension of Textcited by 4,148
  5. 2018HotpotQA: A Dataset for Diverse, Explainable Multi-hop Question Answeringcited by 3,754
  6. 2023Qwen Technical Reportcited by 3,344
  7. 2016Pointer Sentinel Mixture Modelscited by 3,096
  8. 2024Mixtral of Expertscited by 1,823
  9. 2017Get To The Point: Summarization with Pointer-Generator Networkscited by 1,292
  10. 2024DeepSeek-V2: A Strong, Economical, and Efficient Mixture-of-Experts Language Modelcited by 1,135
  11. 2024Gemma: Open Models Based on Gemini Research and Technologycited by 916
  12. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 722
11 more
  1. 2023Prompt Injection attack against LLM-integrated Applicationscited by 605
  2. 2017Adversarial Examples for Evaluating Reading Comprehension Systemscited by 571
  3. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 290
  4. 2019Certified Robustness to Adversarial Word Substitutionscited by 168
  5. 2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 113
  6. 2024The Early Bird Catches the Leak: Unveiling Timing Side Channels in LLM Serving Systemscited by 29
  7. 2025TransMLA: Multi-Head Latent Attention Is All You Needcited by 23
  8. 2025Shadow in the Cache: Unveiling and Mitigating Privacy Risks of KV-cache in LLM Inferencecited by 21
  9. 2025Selective KV-Cache Sharing to Mitigate Timing Side-Channels in LLM Inferencecited by 18
  10. 2024BadCLM: Backdoor Attack in Clinical Language Models for Electronic Health Recordscited by 5
  11. 2024Trojans in Large Language Models of Code: A Critical Review through a Trigger-Based Taxonomycited by 2

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 1; 2026: 2.

3 papers.

  1. 2025Whose Narrative is it Anyway? A KV Cache Manipulation Attackcited by 3
  2. 2026HijackKV: New Threat in Position-Independent KV Cache Reusecited by 2
  3. 2026Hardware Design and Security in the Era of Chiplets and LLMscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Detokenization Leaks: Reconstructing Local LLM Outputs From Cache Traces
  2. 2026Governing the KV Cache: Preventing Timing Side-Channel Leakage in Multi-Tenant LLM Inference
  3. 2025Taming the Fragility of KV Cache Eviction in LLM Inference
  4. 2026On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models
  5. 2026A Lifecycle and Application-Stack Survey of Large Language Model Vulnerabilities: Attacks, Risks, Defenses, and Open Problems
  6. 2025Exposing the Ghost in the Transformer: Abnormal Detection for Large Language Models via Hidden State Forensics
  7. 2024Automatic and Universal Prompt Injection Attacks against Large Language Models
  8. 2025Prompt Injection as an Emerging Threat: Evaluating the Resilience of Large Language Models