为多租户大模型推理设计防侧信道泄漏的缓存治理机制。
Governing the KV Cache: Preventing Timing Side-Channel Leakage in Multi-Tenant LLM Inference
- 用主身份密钥生成随机盐，使不同租户缓存键加密隔离。
- 实测冷热请求延迟比达0.22，证明侧信道可被利用于生产环境。
- 防御方案在不损失93%缓存效率前提下，有效阻断三种攻击。
键值（KV）缓存是现代大语言模型推理的主要吞吐优化手段，支持请求间前缀复用。在多租户部署中，该缓存共享导致时序侧信道：恶意租户可通过探测缓存命中延迟重构其他租户的私有提示。已有三类攻击（PROMPTPEEK、EarlyBird、InputSnatch）利用此漏洞，对未防护的vLLM和SGLang实现最高100%的成功率，成功率随缓存架构与提示结构变化。本文提出KVGov，通过统一机制防御所有攻击家族的前缀缓存路径。每个主体使用基于密钥的哈希函数生成盐值sigma_p = HMAC_K(secret, principal_id)，驱动块哈希链，使缓存键在密码学上互不重叠。消融实验（N=1000次试验，种子2026，确定性裁判）确认该盐为必要且充分条件。KVGov引入ORIGAMI——一种堆叠尔伯格水填审计调度器，在真实租户异构性（吉尼系数0.63）下使攻击者期望收益降低12.6%；并提供演化稳定性分析，得出全局缓存稳定的阈值为攻击者占比低于31.6%。在真实硬件（Qwen2.5-7B-Instruct，vLLM 0.26.0，NVIDIA A100）上测量到门控验证的冷/热请求TTFT比为0.22，证实通道在生产规模可被利用；防御方案通过校准至该测量结果的仿真评估。独立栈验证（llama.cpp on Apple Metal，比例0.093）重现该通道。最后，隔离与缓存效率可共存：仅在提示分叉边界注入盐值，而非链根，即可保留约93%前缀缓存收益，无跨主体信号泄露。
原文摘要 · Abstract (English)
The key-value (KV) cache is the primary throughput optimization in modern large language model (LLM) inference, enabling prefix reuse across requests. In multi-tenant deployments this cache is shared across tenants, creating a timing side channel: an adversarial tenant can reconstruct another tenant's private prompt by probing cache-hit latency. Three published attacks exploit it -- PROMPTPEEK, EarlyBird and InputSnatch -- reaching up to 100% attack success rate against unprotected vLLM and SGLang, with rates varying by cache architecture and prompt structure. We present KVGov, a governance layer addressing all three attack families' prefix-cache paths under one mechanism. A per-principal salt sigma_p = HMAC_K(secret, principal_id) seeds the block-hash chain, making cache keys cryptographically disjoint across principals. An ablation (N=1000 trials, seed 2026, deterministic judges) isolates this salt as the necessary and sufficient component. KVGov adds ORIGAMI, a Stackelberg water-filling audit scheduler that reduces adversary expected utility by 12.6% at realistic tenant heterogeneity (Gini 0.63), and an evolutionary stability analysis giving a 31.6% adversary-prevalence tipping point below which global caching remains stable. On real hardware (Qwen2.5-7B-Instruct, vLLM 0.26.0, NVIDIA A100) we measure a gate-verified cold/cached TTFT ratio of 0.22, confirming the channel is exploitable at production scale; the defense itself is evaluated in simulation calibrated to those measurements. We replicate the channel on an independent stack (llama.cpp on Apple Metal, ratio 0.093). Finally, isolation and cache efficiency need not conflict: identifying information resides only where prompts diverge, so injecting the salt at that boundary rather than the chain root retains an estimated 93% of the prefix-cache benefit with no cross-principal signal.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。