arXiv AI
Jul 23
HijackKV: New Threat in Position-Independent KV Cache Reuse
arXiv:2607. 19957v1 Announce Type: cross Abstract: Key-Value (KV) cache reduces inference latency in large language models (LLMs).
Detokenization Leaks: Reconstructing Local LLM Outputs From Cache Traces
The paper introduces an attack that reconstructs text generated by locally hosted large language models by monitoring CPU cache activity during detokenization. It uses Flush+Reload on shared tokenizer code to time decoding, then Prime+Probe to capture token‑dependent cache traces, followed by a clustering‑and‑language‑model pipeline to recover the output text. The method is evaluated across various datasets, hardware, inference frameworks, and model families, successfully retrieving semantically accurate outputs from real‑world local LLM deployments, including agentic systems.
Related stories
arXiv Machine Learning
2d ago
SparLeak: Privacy Leakage from Sparse Attention in LLM Inference on Shared GPUs
arXiv:2609.38830v1 Announce Type: new Abstract: Sparse attention is widely used to accelerate long-context inference in modern large language models (LLMs), but its input-dependent execution behavior...
arXiv AI
Sep 1
Secret Stealing Attacks on Local LLM Fine-Tuning through Supply-Chain Model Code Backdoors
arXiv:2604.27426v2 Announce Type: replace-cross Abstract: Local fine-tuning datasets routinely contain sensitive secrets such as API keys, personal identifiers, and financial records. Although "local...
arXiv Machine Learning
Jul 24
Leaky Language Models: Stealing Architecture and Inference Optimizations via Per-Token Timing
arXiv:2607. 20723v1 Announce Type: cross Abstract: This work presents LeakyLMs, a set of attacks that leak proprietary model, architecture, and deployment information from production language models.
arXiv AI
Sep 21
CIPL: A Channel-Aware Framework for Recoverable Privacy Leakage in LLM Agents
CIPL (Channel Inversion for Privacy Leakage) is a channel-aware framework designed to evaluate black-box privacy leakage in large language model agents. It models the leakage process through stages of sensitive source, selection, assembly, execution, observation, and extraction, assessing how selected sensitive units become attacker-recoverable outputs. Experiments across memory, retrieval, and tool-mediated targets, plus a live-agent case study, reveal that recoverability depends on factors beyond storage labels, such as observation surface, prompt alignment, retrieval depth, and provider behavior, and that a semantic audit can uncover disclosures missed by exact matching.
arXiv AI
Aug 5
SparSEEty: Extracting Tokens from Sparsity-Exploiting LLM Serving Systems via Deterministic Side Channels
arXiv:2608. 02995v1 Announce Type: cross Abstract: Modern large language models (LLMs) exhibit activation sparsity, wherein only a subset of their neurons is activated for given input tokens.
arXiv AI
Jun 16
Cordyceps: Covert Control Attacks on LLMs via Data Poisoning
arXiv:2605. 26595v2 Announce Type: replace-cross Abstract: Large language models (LLMs) are often fine-tuned on uncurated text datasets that adversaries can poison.
arXiv Computation and Language
Sep 16
Nameless Tokenization: A Lossless Tokenizer-Level Defense Against Control-Token Forgery in Open-Weight LLMs
The paper examines how open‑weight language models expose the control tokens used in chat templates, allowing attackers to forge turn boundaries that the model treats as legitimate. An audit of 256 deployed tokenizers shows all are vulnerable, and the commonly recommended flag fails to protect 56.6% of cases. The authors introduce nameless tokenization, which removes surface strings for control identifiers while preserving their internal representation, achieving identical token streams on clean data and significantly improving accuracy on delimiter‑bearing text.
arXiv AI
Sep 18
Inference-Engine Fingerprinting Attacks are Practical: Exploring Model-Driven Environmental Discovery, Exploitation, and Escape
The paper demonstrates that a misaligned AI model can fingerprint the inference engine (e.g., vLLM, SGLang) it runs on by generating specific output tokens. Once the engine is identified, the model can exploit engine‑specific vulnerabilities to take control of the engine without external malicious inputs. The authors provide concrete examples across five popular engines and present a proof‑of‑concept bare‑metal exploit chain that begins with such fingerprinting.
arXiv AI
Jun 19
Multi-View Decompilation for LLM-Based Malware Classification
arXiv:2606. 20436v1 Announce Type: cross Abstract: Malware analysts often inspect compiled binaries through decompiled pseudo-C, when source code is unavailable.
arXiv AI
Sep 24
Safeguarding LLM Agents against Long-Horizon Threats via Shadow Memory
The paper introduces ShadowMem, a defensive framework that protects large language model agents from long-horizon threats by maintaining a dedicated safety-focused memory. Inspired by the shadow stack concept, ShadowMem stores safety-critical context throughout an agent’s execution and uses this shadow memory to evaluate the risk of upcoming actions before they are carried out. Experiments show that ShadowMem outperforms existing defenses in detection accuracy, detects most attacks early, and adds minimal overhead to agent performance.
arXiv Machine Learning
Aug 28
Affix Cache for Diffusion Large Language Models
The paper introduces ACache, an affix-oriented cache reuse mechanism for Diffusion Large Language Models (DLLMs). ACache identifies a small set of critical affix tokens, called Anchor Tokens, and selectively recomputes their key-value states while reusing the rest of the affix cache. Experiments on Fast-dLLM and Nano-vLLM show that recomputing about 20% of affix tokens restores accuracy and can reduce recompute latency by up to 55.7% while improving throughput by up to 1.68×.