提出PrefixWall，安全防护大模型推理中的缓存侧信道攻击。
PrefixWall: Mitigating Prefix Caching Side Channels in Shared LLM Systems
- 通过监控跨用户缓存复用，仅在可疑时隔离前缀。
- 相比现有防御提升70%缓存复用率，降低30%延迟。
- 兼顾安全与性能，适合多租户大模型服务场景。
大型语言模型（LLM）依赖自动前缀缓存（APC）加速推理，通过复用相同开头请求的计算状态提高效率。但该机制引入了可被利用的时序侧信道：缓存命中比未命中更快，攻击者可通过观察命中/未命中模式逐步重构其他用户的敏感请求内容。现有防御手段采用粗暴隔离策略，禁用缓存共享以牺牲效率换取安全。本文提出PrefixWall系统，在不降低性能的前提下抵御此类侧信道攻击。其通过监测跨用户缓存复用行为，识别可疑共享并仅对特定前缀实施选择性隔离。实验表明，相比传统隔离方法，PrefixWall可实现最高70%的缓存复用率提升和30%的推理延迟降低。其轻量设计证明了大模型服务的安全性无需以过度牺牲性能为代价。
原文摘要 · Abstract (English)
Large Language Models (LLMs) rely on optimizations like Automatic Prefix Caching (APC) to accelerate inference. APC works by reusing previously computed states for the beginning part of a request (prefix), when another request starts with the same text. While APC improves throughput, it introduces timing side channels: cache hits are faster than misses, creating observable latency differences. In multi-tenant systems, attackers can exploit these differences to infer sensitive information, e.g., by incrementally reconstructing another user's request by observing hit/miss patterns. Current defenses take a sledgehammer approach: they disable APC and cache sharing, isolating users, and sacrificing efficiency for regular users. This paper presents PrefixWall, a system that secures multi-tenant LLM serving systems against APC side channels without sacrificing performance and efficiency. PrefixWall monitors cache reuse across users, flags suspicious sharing, and selectively isolates prefixes, restricting their reuse only when necessary. Evaluation shows that PrefixWall enables up to 70% higher cache reuse and 30% lower inference latency compared to existing defenses that isolate users. PrefixWall's lightweight design demonstrates how security in LLM serving does not have to come at the cost of unnecessarily reduced performance or unbearable overheads.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。