Mirage: Provably Defending Against LLM KV Cache Timing Side Channels with Topology-Aware Isolation

AI summaryResearchers propose the Mirage framework to defend against prefix-matching timing side-channel attacks on the LLM KV cache; the authors claim it can provably limit timing leakage without sacrificing cache-sharing performance. Such attacks exploit the TTFT difference between KV cache hits and misses in multi-tenant shared services to infer sensitive prompt tokens, while existing defenses uniformly restrict cross-tenant cache sharing, incurring excessive performance overhead. Mirage delays token output at the gateway so that attackers observe a natural cache miss distribution while the GPU still serves other requests at full speed; its Privacy Odometer continuously tracks the topological novelty of prefix fan-out expansion to distinguish aggressive probing from normal traffic, and once a prefix exceeds a safety threshold, it activates a two-stage policy that uses a dynamic estimator to pad TTFT to a calibrated cache miss baseline.