A cache attack on AI reasoning reaches 79% success in tests

Researchers made R2ECAP, an attack on AI systems that use a key-value (KV) cache again. A KV cache keeps the work that a model has done, to decrease work time. The attack needs only the chat window of the system. It reached a maximum of 79% attack success on three open-weight models and three datasets. A popular detector for prompt injection found only 1% of the poisoned replies.

How it works

The attacker makes two reasoning traces. The first trace steers the model to a target. The second trace carries that target. The model made the second trace after the first one. Its cache keeps signs of the first trace, also after the system deletes the first trace.

The numbers

• A maximum of 79% attack success rate (ASR).
• 46% ASR in a realistic system that retrieves reasoning traces.
• Better than HijackKV, a white-box attack, in 8 of 9 conditions with small resources.

What is not known

The authors tested only open-weight models. The source does not say how closed systems work with it. It gives no repair. No other group has done the test again.

Insight: Poison reaches AI systems through the stores that they use again

Earlier tests show memory poisoning at 5 interfaces in a test of 6 models, and a data poisoning attack that stays after 11 defenses. This paper adds the reasoning cache. Each cache or memory that an AI system uses again is a new area for attack, and checks on the input alone seem not sufficient. The next move to monitor is a defense for stored reasoning.