mlsanityData to 14 Oct 2026

Agent-Assisted Side-Channel Attacks on Non-Prefix KV Cache in RAG

arXiv 2606.21842 ↗First posted 20 Jun 2026cs.CRcited by 2

On the map: Retrieval-augmented generation → Privacy and security of RAG

also in 1 more
Abstract (arXiv)

Modern Large Language Model (LLM) serving engines increasingly rely on Retrieval-Augmented Generation (RAG) and non-prefix Key-Value (KV) cache fusion to accelerate long-context, multi-tenant inference. While existing KV cache side-channel attacks require strict linear prefix alignment--rendering them ineffective against real-world RAG queries that contain unique, user-specific private prefixes--we uncover a critical class of structural vulnerabilities inherent to chunk-aware memory scheduling. We demonstrate that the deterministic micro-architectural mechanisms used to align and fuse disjoint memory chunks inadvertently leak a continuous "Step-Wave" timing signature. Exploiting this physical observation, we introduce SpliceLeak, the first end-to-end side-channel attack targeting non-prefix KV cache fusion. SpliceLeak executes a systematic two-phase privacy breach: it first structurally fingerprints the exact length of hidden private prompts, and subsequently manipulates boundary collisions to extract exact semantic content token-by-token. Extensive evaluations on production-grade frameworks (vLLM integrated with LMCache) demonstrate that SpliceLeak achieves up to a 100% extraction success rate in bounded-entropy scenarios. Driven by a deterministic +104 ms hardware latency void, the attack requires as few as 63 requests per token, piercing through realistic continuous batching noise. To resolve the inherent conflict between memory deduplication and security, we propose SpliceDefense, a bipartite mitigation framework consisting of Quantized Chunk Padding (QCP) and Constant-Time Boundary Fusion (CTBF). Our evaluations confirm that SpliceDefense effectively flattens the side-channel signal (Delta TTFT ~ 0) with negligible throughput overhead, preserving the critical benefits of global cache sharing.

Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 33 of its 49 references that are in the map. First posted on arXiv 20 Jun 2026.

Builds on

33 of 49 references.

Closest ancestors · 7

Same direction, newest first

  1. 2025ImportSnare: Directed "Code Manual" Hijacking in Retrieval-Augmented Code Generation9 Sep
  2. 2025Give LLMs a Security Course: Securing Retrieval-Augmented Code Generation via Knowledge Injection23 Apr
  3. 2025Topic-FlipRAG: Topic-Orientated Adversarial Opinion Manipulation Attacks to Retrieval-Augmented Generation Models3 Feb
  4. 2025RAG-WM: An Efficient Black-Box Watermarking Approach for Retrieval-Augmented Generation of Large Language Models9 Jan
  5. 2025FlippedRAG: Black-Box Opinion Manipulation Adversarial Attacks to Retrieval-Augmented Generation Models6 Jan
  6. 2024Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documents9 Jun
  7. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models12 Feb

Other references · 26

  1. 2017Attention Is All You Needcited by 60,361
  2. 2024The Llama 3 Herd of Modelscited by 14,715
  3. 2023Efficient Memory Management for Large Language Model Serving with PagedAttentioncited by 5,944
  4. 2020Longformer: The Long-Document Transformercited by 3,413
  5. 2023A Survey of Large Language Modelscited by 2,576
  6. 2023A Survey on Hallucination in Large Language Models: Principles, Taxonomy, Challenges, and Open Questionscited by 1,601
  7. 2020Constructing A Multi-hop QA Dataset for Comprehensive Evaluation of Reasoning Stepscited by 1,282
  8. 2023A Survey on Evaluation of Large Language Modelscited by 1,242
  9. 2024Qwen2.5-Coder Technical Reportcited by 1,203
  10. 2023SGLang: Efficient Execution of Structured Language Model Programscited by 1,141
  11. 2025OpenAI GPT-5 System Cardcited by 989
  12. 2021MuSiQue: Multihop Questions via Single-hop Question Compositioncited by 916
14 more
  1. 2024DistServe: Disaggregating Prefill and Decoding for Goodput-optimized Large Language Model Servingcited by 617
  2. 2024Retrieval-Augmented Generation for AI-Generated Content: A Surveycited by 354
  3. 2024InfiniGen: Efficient Generative Inference of Large Language Models with Dynamic KV Cache Managementcited by 245
  4. 2024CacheBlend: Fast Large Language Model Serving for RAG with Cached Knowledge Fusioncited by 223
  5. 2025LMCache: An Efficient KV Cache Layer for Enterprise-Scale LLM Inferencecited by 126
  6. 2024LoongServe: Efficiently Serving Long-Context Large Language Models with Elastic Sequence Parallelismcited by 112
  7. 2024Infinite-LLM: Efficient LLM Service for Long Context with DistAttention and Distributed KVCachecited by 73
  8. 2025Cache-Craft: Managing Chunk-Caches for Efficient Retrieval-Augmented Generationcited by 36
  9. 2025Shadow in the Cache: Unveiling and Mitigating Privacy Risks of KV-cache in LLM Inferencecited by 21
  10. 2025Selective KV-Cache Sharing to Mitigate Timing Side-Channels in LLM Inferencecited by 18
  11. 2025Breaking the Boundaries of Long-Context LLM Inference: Adaptive KV Management on a Single Commodity GPUcited by 4
  12. 2025MPCache: MPC-Friendly KV Cache Eviction for Efficient Private LLM Inferencecited by 3
  13. 2026CryptoGen: Secure Transformer Generation with Encrypted KV-Cache Reusecited by 3
  14. 2026HillInfer: Efficient Long-Context LLM Inference on the Edge with Hierarchical KV Eviction using SmartSSDcited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026Unified AI Gateway: A Framework for Joint Model Routing and KV Cache Managementcited by 0
  2. 2026When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systemscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Governing the KV Cache: Preventing Timing Side-Channel Leakage in Multi-Tenant LLM Inference
  2. 2026HijackKV: New Threat in Position-Independent KV Cache Reuse
  3. 2025Token-Level Precise Attack on RAG: Searching for the Best Alternatives to Mislead Generation
  4. 2026From Similarity to Vulnerability: Key Collision Attack on LLM Semantic Caching
  5. 2025Can Transformer Memory Be Corrupted? Investigating Cache-Side Vulnerabilities in Large Language Models
  6. 2026SparLeak: Privacy Leakage from Sparse Attention in LLM Inference on Shared GPUs
  7. 2026Detokenization Leaks: Reconstructing Local LLM Outputs From Cache Traces
  8. 2026Fine-Tuning a KV Cache Concatenation-Aware Model or Recomputing KV Caches? Why Not Both?