文章背景与核心概要

共享键值（KV）缓存的复用显著提升了大语言模型（LLM）服务系统的效率，但它也无意中引入了定时侧信道（timing side channels），从而暴露特定前缀是否已被缓存的信息。尽管先前的研究已经证明了这些定时攻击在理论上的可行性，但在真实的、多租户竞争环境下，它们的实际运行可靠性仍缺乏深入了解。

本文通过在共享的 LLM 服务基础设施上进行严格的实地实验，对这一问题进行了深入探讨。研究结果表明，系统资源竞争会导致定时侧信道的可靠性发生严重崩溃，这说明在安静或隔离系统上进行的评估会严重高估这些攻击的实际有效性。

Characterizing Contention-Induced Reliability Collapse in KV-Cache Timing Side Channels for Multi-Tenant LLM Serving

Characterizing Contention-Induced Reliability Collapse in KV-Cache Timing Side Channels for Multi-Tenant LLM Serving

Authors: Rana Abu Bakar
Published: September 6, 2026
Primary Subject: Cryptography and Security (cs.CR)
Secondary Subjects: Artificial Intelligence (cs.AI)
ArXiv ID: arXiv:2609.06853
DOI: 10.48550/arXiv.2609.06853

Authors: Rana Abu Bakar
Published: September 6, 2026
Primary Subject: Cryptography and Security (cs.CR)
Secondary Subjects: Artificial Intelligence (cs.AI)
ArXiv ID: arXiv:2609.06853
DOI: 10.48550/arXiv.2609.06853

Summary

Summary

共享键值（KV）缓存复用显著提升了大语言模型（LLM）服务系统的效率，但它也可能无意中引入定时侧信道，暴露特定前缀是否已被缓存。虽然先前的研究证明了这些定时攻击的理论可行性，但在真实的、多租户竞争环境下，其操作可靠性仍未得到充分理解。

Shared key-value (KV) cache reuse significantly improves the efficiency of large language model (LLM) serving systems, but it can inadvertently introduce timing side channels that reveal whether a specific prefix has already been cached. While previous studies have demonstrated the theoretical feasibility of these timing attacks, their operational reliability under realistic, multi-tenant contention remains poorly understood.

本文通过在共享的LLM服务基础设施上进行严格的实时实验来研究此问题。研究结果表明，系统竞争会导致定时侧信道可靠性发生严重崩溃，这表明在安静或隔离系统上进行的评估会大大高估这些攻击的实际效力。

This paper investigates this problem through rigorous live experimentation on shared LLM-serving infrastructures. The findings reveal that system contention causes a severe collapse in timing side-channel reliability, indicating that evaluations performed on quiet or isolated systems can drastically overestimate the practical effectiveness of these attacks.

Key Findings & Experimental Results

Key Findings & Experimental Results

工作线程竞争的影响：
在运行于NVIDIA GB10上的DeepSeek-R1-Distill-Llama-8B的vLLM服务器上：
平均效应量（Cohen’s \(d\)）从0.7789（无合成背景工作线程）急剧下降至0.2109（具有两个背景工作线程，\(t = 8.412\)）。
进一步增加工作线程数量不会带来统计学上可检测到的进一步退化。

Impact of Worker Contention:
On a vLLM server running DeepSeek-R1-Distill-Llama-8B on an NVIDIA GB10:

The mean effect size (Cohen’s \(d\)) drops dramatically from 0.7789 (with zero synthetic background workers) to 0.2109 (with two background workers, \(t = 8.412\)).

Pushing worker counts even higher yields no statistically detectable further degradation.

机制转变与断点：
一项包含120次运行的稀疏重叠实验在测得范围的极端边界（\(\tau = 0\)，\(95\%\) 置信区间 \([0.000, 0.113]\)）确定了最佳断点。这指向了“环境状态与高负载状态”的操作机制转变，而非内部物理阈值。

Regime Shifts & Breakpoints:
A 120-run sparse-overlap experiment identified the best breakpoint at the extreme boundary of the measured range (\(\tau = 0\), \(95\%\) CI \([0.000, 0.113]\)). This points toward an "ambient-versus-loaded" operational regime change rather than an internal physical threshold.

分类准确率（AUROC）：
受试者工作特征曲线下面积（AUROC）：
在环境条件下从0.650下降。
在资源重叠度接近61%时降至0.531。
在系统饱和状态下部分恢复至0.574。

Classification Accuracy (AUROC):
The Area Under the Receiver Operating Characteristic curve:

Falls from 0.650 under ambient conditions.

Drops to 0.531 near 61% resource overlap.

Partially recovers to 0.574 under system saturation.

攻击成功的相关因素：
并发深度方差成为效应量（\(r = -0.416\)）和命中一致性（\(r = -0.637\)）的最强测得相关因素。
交错对照组成功保持了相同的非单调排序模式。

Correlates of Attack Success:

Concurrency-depth variance emerges as the strongest measured correlate of both effect size (\(r = -0.416\)) and hit consistency (\(r = -0.637\)).

An interleaved control group successfully preserves the identical non-monotonic ordering pattern.

跨设置可复现性：
核心可靠性崩溃已在一个物理双节点、双GPU张量并行vLLM设置中成功复现，其中平均效应量（\(d\)）从3.418降至0.511（\(p < 0.01\)）。使用SGLang服务栈的试点评估在统计学上尚无定论。

Cross-Setup Reproducibility:
The core reliability collapse was successfully reproduced on a physical two-node, two-GPU tensor-parallel vLLM setup, where the mean effect size (\(d\)) dropped from 3.418 down to 0.511 (\(p < 0.01\)). Pilot evaluations using the SGLang serving stack proved statistically inconclusive.

Conclusion

Conclusion

KV缓存定时侧信道的可靠性在很大程度上取决于所使用的具体负载机制和Serving架构。因此，在安静的单租户系统上进行的安全性测量无法反映真实的多租户动态，往往会导致高估实操攻击的可靠性。

The reliability of KV-cache timing side channels is heavily contingent upon the specific load regime and serving architecture in use. Consequently, security measurements conducted on quiet, single-tenant systems fail to reflect real-world multi-tenant dynamics, often leading to an overestimation of operational attack reliability.

查看许可证 |

View License |