Researchers Identify Bit-Flip Vulnerability in Shared KV-Cache Blocks of LLM Serving Systems
A peer-reviewed study accepted at SECRYPT 2026 identifies a previously unexamined security vulnerability in vLLM's Prefix Caching system, where shared KV-cache blocks lack integrity protection against adversarial bit-flip attacks. The research characterizes three dangerous properties of such attacks—silent divergence, selective propagation, and persistent accumulation—that together allow undetected, compounding damage to LLM outputs. The findings argue for proactive integrity protection of prefix cache blocks before real-world exploitation is demonstrated.
Researchers have identified a novel threat vector in large language model (LLM) serving infrastructure: shared KV-cache blocks used in vLLM's Prefix Caching feature are stored as a single physical copy without any integrity protection, making them potentially susceptible to Rowhammer-style bit-flip attacks on GPU DRAM. Using software fault injection under ideal bit-targeting conditions to characterize worst-case severity, the study found that 13 of 16 BF16 bit positions produce outputs that are coherently altered yet indistinguishable from legitimate responses without a clean baseline—a property termed 'silent divergence.' Critically, only requests sharing the targeted prefix are affected ('selective propagation'), enabling attackers to target specific users or query types while evading broad detection. Unlike weight corruption attacks, the damage does not decay over time; instead, it accumulates linearly with each subsequent request sharing the corrupted block ('persistent accumulation'), creating a damage amplification effect bounded only by the block's cache lifetime. The researchers propose a checksum-based countermeasure that detects any single-bit corruption at scheduling time, limiting cumulative damage to a single batch regardless of how long the block remains cached, with negligible performance overhead. The paper argues these properties collectively constitute a distinct and serious threat profile that warrants integrity protections being deployed proactively.
What's missing
The study relies on software fault injection under idealized bit-targeting conditions rather than a demonstrated end-to-end hardware exploit on real GPU DRAM, so the practical feasibility of triggering such bit flips in deployed systems remains unvalidated. The research focuses solely on vLLM's Prefix Caching and does not assess whether other LLM serving frameworks with similar shared-cache architectures are equally vulnerable. The overhead characterization of the proposed checksum countermeasure is described only as 'negligible' without detailed benchmarking data presented in the abstract.
What different sources said
- arXiv cs.LGCenter
Bit-Flip Vulnerability of Shared KV-Cache Blocks in LLM Serving Systems
Related
Gut Bacteria Enzyme Found to Break Down Heat-Processed Food Compounds, Producing Novel Biogenic Amines
Researchers have discovered that an enzyme in common gut bacteria can degrade N-epsilon-carboxymethyllysine (CML), a compound formed during thermal food processing, producing previously unknown biogenic amines. The enzyme, ornithine decarboxylase SpeC from enterobacteria, acts on CML and related modified lysine derivatives through a low-level 'underground' catalytic activity. This finding suggests a previously unrecognized communication axis between thermally processed dietary compounds and gut microbial physiology, with potential implications for host health.
Full-Length Gene Sequencing Reveals Two Distinct Bacterial Communities in Black-Legged Ticks Expanding Into Canada
Researchers used Oxford Nanopore full-length 16S rRNA gene sequencing to characterize the microbiome of Ixodes scapularis black-legged ticks collected in Nova Scotia, Canada, distinguishing between tick-adapted bacteria and environmentally acquired bacteria. The study comes as I. scapularis — the primary vector of Lyme disease — is rapidly expanding northward into Canada due to climate change. The findings suggest that environmentally derived bacteria in tick microbiomes are not mere contamination, which has implications for how tick microbiome data is collected and interpreted across surveillance studies.
Study Identifies Metabolic Link Between Cell Envelope Stress and Biofilm Formation in Bacteria
Researchers have discovered that the metabolite acetyl-CoA directly inhibits enzymes that degrade the bacterial signaling molecule c-di-GMP, connecting cell envelope biosynthesis stress to biofilm formation in Pseudomonas aeruginosa. The study found that sub-inhibitory concentrations of antibiotics targeting early peptidoglycan biosynthesis — but not other antibiotic classes — elevate c-di-GMP levels by reducing phosphodiesterase activity, with acetyl-CoA competing for the enzyme active site. Because the relevant enzyme domain is broadly conserved across bacterial species, this checkpoint mechanism may be widespread and could have implications for understanding antibiotic-induced biofilm responses.