攻击者可篡改大模型推理缓存，导致输出错误。
Can Transformer Memory Be Corrupted? Investigating Cache-Side Vulnerabilities in Large Language Models
- 通过噪声、置零、旋转等手段干扰注意力缓存中的键向量。
- 实测使GPT-2和LLaMA-2/7B的生成结果显著偏离，任务性能下降。
- 揭示缓存完整性是当前大模型部署中被忽视的安全漏洞。
即使提示词和参数受到保护，变压器语言模型在推理过程中仍存在安全风险，因为其关键-值（KV）缓存构成一个被忽视的攻击面。本文提出恶意令牌注入（MTI）框架，通过添加高斯噪声、置零和正交旋转等方式，在特定层和时间步对缓存键向量进行系统性扰动，控制扰动幅度与频率。理论分析量化了这些扰动在注意力机制中的传播路径，将逻辑值偏差与扰动的弗罗贝尼乌斯范数及softmax李普希茨动态关联起来。实验表明，MTI显著改变GPT-2和LLaMA-2/7B的下一个词分布，并影响下游任务表现，同时破坏检索增强与代理式推理流程的稳定性。研究揭示缓存完整性是当前大型语言模型部署中的关键但未受重视的漏洞，将缓存污染定位为未来鲁棒性与安全研究中可复现且理论扎实的威胁模型。
原文摘要 · Abstract (English)
Even when prompts and parameters are secured, transformer language models remain vulnerable because their key-value (KV) cache during inference constitutes an overlooked attack surface. This paper introduces Malicious Token Injection (MTI), a modular framework that systematically perturbs cached key vectors at selected layers and timesteps through controlled magnitude and frequency, using additive Gaussian noise, zeroing, and orthogonal rotations. A theoretical analysis quantifies how these perturbations propagate through attention, linking logit deviations to the Frobenius norm of corruption and softmax Lipschitz dynamics. Empirical results show that MTI significantly alters next-token distributions and downstream task performance across GPT-2 and LLaMA-2/7B, as well as destabilizes retrieval-augmented and agentic reasoning pipelines. These findings identify cache integrity as a critical yet underexplored vulnerability in current LLM deployments, positioning cache corruption as a reproducible and theoretically grounded threat model for future robustness and security research.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。