From similarity to vulnerability: key-collision attacks against LLM semantic caches
From Similarity to Vulnerability: Key Collision Attack on LLM Semantic Caching
Quick read
Based on 论文全文 （AI 生成）; refer to the original
The researchers propose CacheAttack, a key-collision attack framework against LLM semantic caches, which hijacks model responses by optimizing an adversarial suffix so that malicious queries hit the same cache key as benign queries. The paper models semantic cache keys as locality-preserving fuzzy hashes and points out an inherent conflict with the avalanche effect required for collision resistance. On GPTCache and SemShareKV with Qwen3-8B as the backend, CacheAttack-1 achieves an average hit rate above 0.86 and an injection success rate above 0.82; in the agent tool-calling scenario, the hit rate reaches 90.6%, tool selection drops by up to 84.5%, and answer accuracy drops by 83.8%, and it can transfer across embedding models. In the financial agent case, the attack triggers an unauthorized sell order. For defenses, key salting, perplexity screening, and per-user cache isolation are evaluated, all with efficiency-security trade-offs.
- 语义缓存用 embedding 向量作缓存键，被 AWS、Microsoft 等广泛用于降低 LLM 延迟与重复计算。作者指出其键匹配本质是保局部性的模糊哈希，与抗碰撞所需的雪崩效应相冲突，而此前研究多关注隐私与侧信道，完整性风险未被系统研究。
- 把语义键建模为模糊哈希，形式化局部性（性能）与抗碰撞（安全）的权衡，并给出误命中概率下界。提出 CacheAttack 生成器-验证器框架：用 GCG 搜索对抗后缀制造键碰撞，通过延迟侧信道统计推断是否命中；CacheAttack-1 直接验证目标模型，CacheAttack-2 用代理模型过滤以减少查询。
- 在 GPTCache 与 SemShareKV 上，CacheAttack 在 LLM 响应劫持中命中率约 86%、注入成功率约 82%，在 AWS Bedrock 与 Azure API Management 上也有效；劫持 agent 工具调用时命中率 90.6%，工具选择率与答案准确率最多下降约 84%；攻击可跨 embedding 模型迁移，并在一金融 agent 案例中触发非预期的卖出下单。
- 作者讨论的缓解手段（key salting、困惑度筛查、按用户隔离缓存）都只能部分降低风险，且会牺牲缓存命中率与效率，性能与安全的权衡难以消除；结论是当前语义缓存实现存在固有漏洞，需发展抗碰撞的缓存架构。
The paper models semantic cache keys as fuzzy hashes, provides attack success rates for cross-model transfer and the trade-offs of three defenses, and teams deploying multi-tenant caches can use this to assess integrity risks.