mlsanityData to 14 Oct 2026

Characterizing Contention-Induced Reliability Collapse in KV-Cache Timing Side Channels for Multi-Tenant LLM Serving

arXiv 2609.06853 ↗First posted 6 Sep 2026cs.CR cs.AIcited by 0

On the map: Efficient LLM inference and serving → KV cache optimization

Abstract (arXiv)

Shared key--value (KV) cache reuse improves large language model (LLM) serving, but it can also create a timing side channel that reveals whether a prefix is already cached. Previous work shows that such attacks are possible, but their reliability under realistic multi-tenant contention is less understood. We study this problem through seven experiments on live shared LLM-serving systems. On a vLLM server running DeepSeek-R1-Distill-Llama-8B on NVIDIA GB10, mean Cohen's d drops from 0.7789 with no synthetic workers to 0.2109 with two workers (t=8.412), while higher worker counts cause no statistically detectable further loss. A 120-run sparse-overlap experiment places the best breakpoint at the boundary of the measured range (tau=0, 95% CI [0.000,0.113]), supporting an ambient-versus-loaded regime change rather than an internal physical threshold. AUROC falls from 0.650 at ambient to 0.531 near 61% overlap and partially recovers to 0.574 at saturation. Concurrency-depth variance is the strongest measured correlate of effect size (r=-0.416) and hit consistency (r=-0.637). An interleaved control preserves the same non-monotonic ordering. The main collapse is also reproduced on a real two-node, two-GPU tensor-parallel vLLM setup, where mean d falls from 3.418 to 0.511 (p<0.01). Two SGLang pilots are statistically inconclusive. Overall, KV-cache timing reliability depends strongly on the load regime and serving stack, and measurements on quiet systems can overestimate operational attack reliability.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in KV cache optimization, one of 12 directions in Efficient LLM inference and serving. Builds on 5 of its 8 references that are in the map. First posted on arXiv 6 Sep 2026.

Builds on

5 of 8 references.

Closest ancestors · 3

Same direction, newest first

  1. 2026Governing the KV Cache: Preventing Timing Side-Channel Leakage in Multi-Tenant LLM Inference10 Aug
  2. 2025Selective KV-Cache Sharing to Mitigate Timing Side-Channels in LLM Inference11 Aug
  3. 2023Efficient Memory Management for Large Language Model Serving with PagedAttention12 Sep

Other references · 2

  1. 2024The Early Bird Catches the Leak: Unveiling Timing Side Channels in LLM Serving Systemscited by 29
  2. 2024InputSnatch: Stealing Input in LLM Services via Timing Side-Channel Attackscited by 16

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026CacheRoute: Planned Prefix-Affinity Routing for Large-Scale LLM Serving
  2. 2026GhostServe: A Lightweight Checkpointing System in the Shadow for Fault-Tolerant LLM Serving
  3. 2026CacheFlow: Efficient LLM Serving with 3D-Parallel KV Cache Restoration
  4. 2026From Tensor Buffer to Distributed Memory Hierarchy: A Survey of KV Cache Management for LLM Serving
  5. 2026PrefixWall: Mitigating Prefix Caching Side Channels in Shared LLM Systems
  6. 2026PrefixBench-H100: Characterizing Prefix Reuse and Time-to-First-Token in H100 LLM Serving
  7. 2025Mitigating KV Cache Competition to Enhance User Experience in LLM Inference
  8. 2026The KV Cache Is the New Memory Wall