Skip to main content
LLM Security Database
Skip to research details
Back to research findings
LMVD-ID: f930fc6d
Paper published August 18, 2026
Entry analyzed September 9, 2026
Paper-reported evidence
Confidence: Source-linked

The LMVD-ID is an internal research identifier, not an official CVE identifier.

Shared relay credentials weaken prompt-cache isolation

API gateways can pool distinct customers into one upstream cache identity. The authors observe cross-customer cache reuse in five deliberately pooled gateway configurations through two provider interfaces.

Infrastructure
Side channel
API
Data privacy
Data security
Read primary paperBibTeX citation

Paper-evaluated models

No paper-evaluated models are recorded for this entry.

Description

API gateways can pool distinct customers into one upstream cache identity. The authors observe cross-customer cache reuse in five deliberately pooled gateway configurations through two provider interfaces.

Examples

See the primary study (opens in a new tab).

Impact

Cache feedback can disclose prior use of known content. Results depend on the final route, identity mapping and observation window. Relay model labels do not establish a defect in the underlying foundation model or every gateway deployment.

Affected Systems

  • Evaluated configurations of NewAPI, uni-api, MetaAPI, LiteLLM and Sub2API.

Mitigation Steps

  • Preserve authenticated tenant identity through retries, fallbacks and nested relays.
  • Require provider-enforced cache isolation and fail closed when unavailable.
  • Verify isolation in controlled tenant environments after routing changes.

Evidence

Research context and confidence

Evidence and verification
Paper-reported; independent reproduction is not documented.
Primary source plus a dedicated evidence section.
Severity
Not rated by this catalog.
Source and publication type
arXiv · Research preprint.
Peer-review status is not provided by this source.
Author and publication status
Author metadata is not stored; see the primary paper.
Threat model and attacker access
Not explicitly classified; consult the primary paper..
Related deployment categories
Model APIs
Taxonomy labels only; paper-specific deployment prerequisites are not inferred.
Affected systems
Evaluated configurations of NewAPI, uni-api, MetaAPI, LiteLLM and Sub2API.

Research Paper

KeyPooling: Measuring Where LLM API Relay Paths Collapse Prompt Cache Isolation

Primary source: arXiv. Findings are reported by the cited research and have not been independently verified.

View Paper

Related research