mlsanityData to 7 Oct 2026

Whose Narrative is it Anyway? A KV Cache Manipulation Attack

arXiv 2511.12752 ↗First posted 16 Nov 2025cs.CR cs.AIcited by 3

On the map: Efficient LLM inference and serving → KV cache optimization

Abstract (arXiv)

The Key Value(KV) cache is an important component for efficient inference in autoregressive Large Language Models (LLMs), but its role as a representation of the model's internal state makes it a potential target for integrity attacks. This paper introduces "History Swapping," a novel block-level attack that manipulates the KV cache to steer model generation without altering the user-facing prompt. The attack involves overwriting a contiguous segment of the active generation's cache with a precomputed cache from a different topic. We empirically evaluate this method across 324 configurations on the Qwen 3 family of models, analyzing the impact of timing, magnitude, and layer depth of the cache overwrite. Our findings reveal that only full-layer overwrites can successfully hijack the conversation's topic, leading to three distinct behaviors: immediate and persistent topic shift, partial recovery, or a delayed hijack. Furthermore, we observe that high-level structural plans are encoded early in the generation process and local discourse structure is maintained by the final layers of the model. This work demonstrates that the KV cache is a significant vector for security analysis, as it encodes not just context but also topic trajectory and structural planning, making it a powerful interface for manipulating model behavior.

Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Placed in KV cache optimization, one of 12 directions in Efficient LLM inference and serving. Builds on 6 of its 14 references that are in the map. First posted on arXiv 16 Nov 2025.

Builds on

6 of 14 references.

Closest ancestors · 3

Same direction, newest first

  1. 2025LMCache: An Efficient KV Cache Layer for Enterprise-Scale LLM Inference8 Oct
  2. 2025Selective KV-Cache Sharing to Mitigate Timing Side-Channels in LLM Inference11 Aug
  3. 2024GEAR: An Efficient KV Cache Compression Recipe for Near-Lossless Generative Inference of LLM8 Mar

Other references · 3

  1. 2024KVQuant: Towards 10 Million Context Length LLM Inference with KV Cache Quantizationcited by 571
  2. 2025Steering LLMs for Formal Theorem Provingcited by 4
  3. 2025Can Transformer Memory Be Corrupted? Investigating Cache-Side Vulnerabilities in Large Language Modelscited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 3.

3 papers.

  1. 2026HijackKV: New Threat in Position-Independent KV Cache Reusecited by 1
  2. 2026Bit-Flip Vulnerability of Shared KV-Cache Blocks in LLM Serving Systemscited by 0
  3. 2026Probing the Prompt KV Cache: Where It Becomes Dispensablecited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Positions Are Not Facts: The Mismatch Between KV Caches and Memory
  2. 2026Recency/Frequency Adaptive KV Caching for Large Language Model Serving
  3. 2025Taming the Fragility of KV Cache Eviction in LLM Inference
  4. 2025Shadow in the Cache: Unveiling and Mitigating Privacy Risks of KV-cache in LLM Inference
  5. 2026Coverage-Driven KV Cache Eviction for Efficient and Improved Inference of LLM
  6. 2025Krul: Efficient State Restoration for Multi-turn Conversations with Dynamic Cross-layer KV Sharing
  7. 2026Reformulating KV Cache Eviction Problem for Long-Context LLM Inference
  8. 2025Judge Q: Trainable Queries for Optimized Information Retention in KV Cache Eviction