arXiv: HijackKV: New Threat in Position-Independent KV Cache Reuse

A new research paper, "HijackKV: New Threat in Position-Independent KV Cache Reuse," published on arXiv, identifies a novel security vulnerability in large language model (LLM) inference systems. The attack exploits the reuse of key-value (KV) caches—a common optimization for speeding up text generation—by injecting malicious data into the cache. This allows an attacker to hijack the model's output, potentially causing it to generate harmful, biased, or unauthorized content, even when the original input appears benign. The paper demonstrates that this threat is particularly effective in systems using position-independent cache reuse, which is increasingly adopted for efficiency.

This vulnerability primarily affects organizations deploying LLMs in production environments, especially those using shared or multi-tenant inference infrastructure, such as cloud AI providers, enterprise chatbots, and customer service automation platforms. Sectors handling sensitive data—finance, healthcare, legal, and government—face heightened risk, as an attacker could manipulate model outputs to leak confidential information or bypass safety guardrails. Any compliance team overseeing AI systems under the EU AI Act or similar frameworks should consider this a material security concern.

Compliance teams should immediately review their LLM deployment architectures to determine if KV cache reuse is enabled. If so, they must assess whether input validation and cache isolation controls are in place to prevent injection attacks. Teams should also update their AI risk registers to include this threat vector and coordinate with engineering to implement cache sanitization or disable position-independent reuse until mitigations are validated. Finally, monitor for official guidance from ENISA or national AI safety authorities, as this paper may trigger updated security recommendations.