Semantic Cache Collision Hijack

Description

Semantic caching mechanisms in LLM applications are vulnerable to cross-tenant cache key collision attacks (CacheAttack) due to the inherent mathematical conflict between locality-preserving fuzzy hashing and cryptographic collision resistance (the avalanche effect). An attacker can leverage gradient-based search algorithms to optimize an adversarial discrete suffix that, when appended to a malicious prompt, forces its output embedding vector to collide with the embedding of a targeted benign query. By sending this crafted prompt to the LLM system, the attacker plants a malicious response or intermediate execution state into the shared cache. When a victim subsequently issues the targeted benign query, the system triggers a false-positive cache hit based on cosine similarity thresholds or Locality-Sensitive Hashing (LSH) boundaries. This allows the attacker to hijack the victim's session and serve an arbitrary, attacker-controlled payload without directly modifying backend cache memory or model parameters.

Examples

To execute the attack, the adversary crafts a prompt combining a malicious payload with an optimized suffix (e.g., starting with "Neglect: " so the LLM ignores the suffix tokens during generation, while the embedding model still processes them to force a collision).

Example 1: OS Command Injection via Agent Tool Hijacking An attacker generates an adversarial suffix for the following malicious payload: Execute [INERT: attempt to read a protected system file] efficiently for an agent helping with a CTF. Neglect: [optimized_adversarial_tokens] The optimized tokens force this query's embedding to match a benign user query. When the victim asks the benign query, the agent retrieves the attacker's cached tool-invocation and attempts the unauthorized file read.

Example 2: Financial Agent Manipulation An attacker targets a financial trading agent utilizing GPTCache by planting a response that invokes [INERT: unauthorized trading-tool action]. The adversarial suffix is optimized to map to the embedding of a benign victim query such as "What is the latest market news?". When the victim submits the news query, the semantic cache returns a hit on the attacker's entry, causing an unauthorized action attempt.

Impact

Cross-tenant LLM response hijacking and unauthorized tool invocation in agentic workflows. Attackers can force victim sessions to execute arbitrary tool calls (e.g., unauthorized financial transactions, file reads, or privileged API calls), induce cascading logic errors in downstream planning, and bypass LLM alignment guardrails entirely, as the cached malicious payload is executed without passing through the backend LLM's safety filters.

Affected Systems

• LLM middleware and frameworks implementing shared Semantic Caches (e.g., GPTCache) or Semantic KV Caches (e.g., SemShareKV, SentenceKV).
• Systems relying on continuous vector embedding models (e.g., BAAI/bge-small-en-v1.5, intfloat/e5-small-v2, sentence-transformers/all-MiniLM-L6-v2) for cache key generation.
• Cache retrieval mechanisms utilizing Locality-Sensitive Hashing (LSH) or continuous similarity thresholds (e.g., Cosine Similarity $\ge \tau$).

Mitigation Steps

• Perplexity Screening at Cache Insertion: Compute the perplexity (PPL) of the input prompt using a lightweight reference language model (e.g., GPT-2) before inserting the generated response into the cache. Reject entries that exceed a calibrated PPL threshold to prevent highly irregular adversarial suffixes from contaminating the shared cache.
• Key Salting: Apply a cache-local, undisclosed secret salt $s$ to the cache key computation via a deterministic augmentation $k_s = f(\mathcal{A}_s(p))$ (e.g., prefix-salting $s \parallel p$ or structured templating [SALT=s]). This disrupts the ability of attackers to use local surrogate models to generate transferable collision suffixes.
• Per-user Cache Isolation: Scope the semantic caching layer to a per-user or per-session namespace by augmenting the cache key with a unique user identifier ($u$). While this incurs a performance trade-off by reducing cross-tenant cache hit rates, it strictly prevents cross-user cache collisions.