Researchers Find Position-Independent KV Cache Reuse Can Let One User Hijack Another’s LLM Output

Researchers say a speed feature used in some large language model inference systems can create an unexpected security problem: One user may be able to influence another user’s output through shared cached model state, even if the victim’s prompt contains no attacker-written text.

The finding comes from “HijackKV: New Threat in Position-Independent KV Cache Reuse,” an academic paper by Yichi Zhang, Zhiqi Wang, Huan Zhang and Yuchen Yang of The Pennsylvania State University and the University of Illinois Urbana-Champaign. The paper was first posted to arXiv on July 22, 2026, revised July 31, and the arXiv entry says it was accepted to USENIX Security 2026. In the paper’s testing, the authors report an average 94% attack success rate in a single attempt. “We introduce HIJACKKV, the first attack framework that systematically exploits this vulnerability,” the abstract says.

At the center of the work is the KV cache, a standard optimization in transformer-based AI models. It stores internal key and value states from earlier tokens so the model does not have to recompute them each time, reducing latency and compute cost.

Traditional cache reuse usually depends on exact prefix matches and token positions, which limits how often a saved cache can be reused across different requests. Newer systems try to improve hit rates by reusing cached state for matching text chunks even when those chunks appear at different positions in a prompt. In shared or multi-tenant serving environments, that can make inference more efficient across separate users’ requests.

The paper argues that this position-independent reuse weakens the tie between cached state and the full context that originally produced it. According to the authors, a cached state associated with a benign-looking text chunk can still carry the influence of attacker-controlled text that appeared earlier in the original request. If that same chunk is later pulled from cache for another user, the attacker’s earlier context may silently affect the victim model’s behavior. The authors call this “KV cache hijacking.”

To test the idea, the researchers built an attack framework called HIJACKKV and evaluated it on several question-answering benchmarks, including HotpotQA, SQuAD v1 and v2, MedQA and PubMedQA, using multiple open-source models. They used Llama-3.1-8B as a proxy model for optimization and then tested transfer to other models, including Llama-3.3-70B and Qwen variants.

The paper says the attack remained effective under constrained conditions that would matter for real systems. Even with a 10% cache-hit ratio and 50% recomputation — meaning part of the model state is recalculated instead of reused — the attack still worked at meaningful rates. One result cited by the authors is about 39% targeted success at 50% recomputation. The paper also reports that the effect can persist across multi-turn interactions, even after more than 1,000 tokens of unrelated context are inserted.

The researchers further say the attack can transfer across models in black-box settings, where the attacker does not control or inspect the target model directly. One reported result is 75% untargeted and 37% targeted success against Llama-3.3-70B.

The broader implication is that an infrastructure feature meant to cut cost and speed up responses can also create a cross-user influence path in shared inference systems. The paper cites open-source systems in this area, including LMCache/CacheBlend and related work, but it does not claim to have tested production services.

On defenses, the paper says partial recomputation and current heuristic mitigations reduced but did not eliminate the problem. Stronger defenses also carried a notable efficiency penalty: In one setting, a defense pushed normalized recomputation cost to 3.53 times the baseline.

The authors say they did not test production systems or private user data. They also say they made a responsible disclosure before publication to the founders of a startup commercializing position-independent cache reuse technology. The team has released public code and experiment artifacts on GitHub, making the work available for outside review and follow-on testing.