‹ back to 2026-07-22

HijackKV: New Threat in Position-Independent KV Cache Reuse

arXiv cs.CR Efficiency & Systems Yichi Zhang, Zhiqi Wang, Huan Zhang, Yuchen Yang 2026-07-22

TL;DR - HijackKV exposes a security flaw in position-independent LLM KV-cache reuse: attacker-contaminated cache entries can alter later victim outputs without malicious text appearing in the victim’s prompt.

The attack exploits KV entries that match benign token chunks but retain context encoded from an attacker-controlled prefix.
HIJACKKV optimizes that prefix while leaving the cache-matched benign text unchanged.
It achieves 94% average single-attempt success and remains effective with 10% cache-hit rates and 50% recomputation.
The attack persists across turns and transfers between models in black-box settings.

view merged work →