{"id":"https://openalex.org/W7165618382","doi":"https://doi.org/10.48550/arxiv.2606.21842","title":"Agent-Assisted Side-Channel Attacks on Non-Prefix KV Cache in RAG","display_name":"Agent-Assisted Side-Channel Attacks on Non-Prefix KV Cache in RAG","publication_year":2026,"publication_date":"2026-06-20","ids":{"openalex":"https://openalex.org/W7165618382","doi":"https://doi.org/10.48550/arxiv.2606.21842"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.21842","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.21842","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.21842","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5089948458","display_name":"He Sun","orcid":"https://orcid.org/0009-0003-5403-4732"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sun, He","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103870133","display_name":"Liu S","orcid":"https://orcid.org/0000-0001-7255-0982"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Shinan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139201409","display_name":"Siyuan Ma","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ma, Siyuan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139146081","display_name":"Junhao Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Junhao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139170538","display_name":"Mingjun Xiao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xiao, Mingjun","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5139176486","display_name":"Wenhao Jiang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jiang, Wenhao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.8938000202178955,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.8938000202178955,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.016300000250339508,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11181","display_name":"Advanced Data Storage Technologies","score":0.007699999958276749,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/cache","display_name":"Cache","score":0.765999972820282},{"id":"https://openalex.org/keywords/prefix","display_name":"Prefix","score":0.4788999855518341},{"id":"https://openalex.org/keywords/disjoint-sets","display_name":"Disjoint sets","score":0.4223000109195709},{"id":"https://openalex.org/keywords/cpu-cache","display_name":"CPU cache","score":0.39169999957084656},{"id":"https://openalex.org/keywords/latency","display_name":"Latency (audio)","score":0.3779999911785126},{"id":"https://openalex.org/keywords/data-deduplication","display_name":"Data deduplication","score":0.3635999858379364},{"id":"https://openalex.org/keywords/throughput","display_name":"Throughput","score":0.3626999855041504},{"id":"https://openalex.org/keywords/cache-algorithms","display_name":"Cache algorithms","score":0.3312999904155731}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8476999998092651},{"id":"https://openalex.org/C115537543","wikidata":"https://www.wikidata.org/wiki/Q165596","display_name":"Cache","level":2,"score":0.765999972820282},{"id":"https://openalex.org/C141603448","wikidata":"https://www.wikidata.org/wiki/Q134830","display_name":"Prefix","level":2,"score":0.4788999855518341},{"id":"https://openalex.org/C173608175","wikidata":"https://www.wikidata.org/wiki/Q232661","display_name":"Parallel computing","level":1,"score":0.46970000863075256},{"id":"https://openalex.org/C45340560","wikidata":"https://www.wikidata.org/wiki/Q215382","display_name":"Disjoint sets","level":2,"score":0.4223000109195709},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.42010000348091125},{"id":"https://openalex.org/C189783530","wikidata":"https://www.wikidata.org/wiki/Q352090","display_name":"CPU cache","level":3,"score":0.39169999957084656},{"id":"https://openalex.org/C82876162","wikidata":"https://www.wikidata.org/wiki/Q17096504","display_name":"Latency (audio)","level":2,"score":0.3779999911785126},{"id":"https://openalex.org/C32587265","wikidata":"https://www.wikidata.org/wiki/Q1182260","display_name":"Data deduplication","level":2,"score":0.3635999858379364},{"id":"https://openalex.org/C157764524","wikidata":"https://www.wikidata.org/wiki/Q1383412","display_name":"Throughput","level":3,"score":0.3626999855041504},{"id":"https://openalex.org/C38556500","wikidata":"https://www.wikidata.org/wiki/Q13404475","display_name":"Cache algorithms","level":4,"score":0.3312999904155731},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.31630000472068787},{"id":"https://openalex.org/C152124472","wikidata":"https://www.wikidata.org/wiki/Q1204361","display_name":"Redundancy (engineering)","level":2,"score":0.31470000743865967},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.28999999165534973},{"id":"https://openalex.org/C68043766","wikidata":"https://www.wikidata.org/wiki/Q267416","display_name":"Static random-access memory","level":2,"score":0.289900004863739},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.2881999909877777},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.28540000319480896},{"id":"https://openalex.org/C110251889","wikidata":"https://www.wikidata.org/wiki/Q1569697","display_name":"Model checking","level":2,"score":0.2847000062465668},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.2777999937534332},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.26249998807907104},{"id":"https://openalex.org/C69016650","wikidata":"https://www.wikidata.org/wiki/Q1364211","display_name":"Multitenancy","level":5,"score":0.26010000705718994},{"id":"https://openalex.org/C197657726","wikidata":"https://www.wikidata.org/wiki/Q174733","display_name":"Bipartite graph","level":3,"score":0.25679999589920044},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.25360000133514404}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.21842","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.21842","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.21842","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.21842","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.4305694103240967,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Modern":[0],"Large":[1],"Language":[2],"Model":[3],"(LLM)":[4],"serving":[5],"engines":[6],"increasingly":[7],"rely":[8],"on":[9,129],"Retrieval-Augmented":[10],"Generation":[11],"(RAG)":[12],"and":[13,69,116,183,198],"non-prefix":[14,94],"Key-Value":[15],"(KV)":[16],"cache":[17,27,96,227],"fusion":[18],"to":[19,55,67,121,141],"accelerate":[20],"long-context,":[21],"multi-tenant":[22],"inference.":[23],"While":[24],"existing":[25],"KV":[26,95],"side-channel":[28,91,211],"attacks":[29],"require":[30],"strict":[31],"linear":[32],"prefix":[33],"alignment--rendering":[34],"them":[35],"ineffective":[36],"against":[37],"real-world":[38],"RAG":[39],"queries":[40],"that":[41,61,137,206],"contain":[42],"unique,":[43],"user-specific":[44],"private":[45,114],"prefixes--we":[46],"uncover":[47],"a":[48,76,100,142,152,188],"critical":[49,223],"class":[50],"of":[51,112,193,225],"structural":[52],"vulnerabilities":[53],"inherent":[54,178],"chunk-aware":[56],"memory":[57,72,181],"scheduling.":[58],"We":[59],"demonstrate":[60,136],"the":[62,88,109,159,177,210,222],"deterministic":[63,153],"micro-architectural":[64],"mechanisms":[65],"used":[66],"align":[68],"fuse":[70],"disjoint":[71],"chunks":[73],"inadvertently":[74],"leak":[75],"continuous":[77,172],"\"Step-Wave\"":[78],"timing":[79],"signature.":[80],"Exploiting":[81],"this":[82],"physical":[83],"observation,":[84],"we":[85,185],"introduce":[86],"SpliceLeak,":[87],"first":[89,106],"end-to-end":[90],"attack":[92,160],"targeting":[93],"fusion.":[97],"SpliceLeak":[98,138],"executes":[99],"systematic":[101],"two-phase":[102],"privacy":[103],"breach:":[104],"it":[105],"structurally":[107],"fingerprints":[108],"exact":[110,123],"length":[111],"hidden":[113],"prompts,":[115],"subsequently":[117],"manipulates":[118],"boundary":[119],"collisions":[120],"extract":[122],"semantic":[124],"content":[125],"token-by-token.":[126],"Extensive":[127],"evaluations":[128,204],"production-grade":[130],"frameworks":[131],"(vLLM":[132],"integrated":[133],"with":[134,217],"LMCache)":[135],"achieves":[139],"up":[140],"100%":[143],"extraction":[144],"success":[145],"rate":[146],"in":[147],"bounded-entropy":[148],"scenarios.":[149],"Driven":[150],"by":[151],"+104":[154],"ms":[155],"hardware":[156],"latency":[157],"void,":[158],"requires":[161],"as":[162,164],"few":[163],"63":[165],"requests":[166],"per":[167],"token,":[168],"piercing":[169],"through":[170],"realistic":[171],"batching":[173],"noise.":[174],"To":[175],"resolve":[176],"conflict":[179],"between":[180],"deduplication":[182],"security,":[184],"propose":[186],"SpliceDefense,":[187],"bipartite":[189],"mitigation":[190],"framework":[191],"consisting":[192],"Quantized":[194],"Chunk":[195],"Padding":[196],"(QCP)":[197],"Constant-Time":[199],"Boundary":[200],"Fusion":[201],"(CTBF).":[202],"Our":[203],"confirm":[205],"SpliceDefense":[207],"effectively":[208],"flattens":[209],"signal":[212],"(Delta":[213],"TTFT":[214],"~":[215],"0)":[216],"negligible":[218],"throughput":[219],"overhead,":[220],"preserving":[221],"benefits":[224],"global":[226],"sharing.":[228]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-06-24T00:00:00"}