Your KV Cache Is Now Part of Your Attack Surface

R²ECAP hits 79% attack success rate through the chat interface alone. Your prompt-injection detector won't catch it.

Modern LLM systems reuse key-value (KV) caches to accelerate inference. Recent work showed that reusing KV caches from reasoning traces can also improve task performance — similar to retrieval-augmented generation (RAG). arXiv:2610.22873 demonstrates that this optimization introduces a new poisoning attack primitive.

R²ECAP (Reused Reasoning-Cache Poisoning) is a black-box attack that plants poisoned reasoning traces solely through a system’s chat interface. No internal access, no cache-write privilege, no model internals required. An adversary only needs to talk to the chat.

The attack works in two traces: a preceding trace that steers the model toward an adversarial target, and a retained trace that carries the target forward. Because the retained trace is generated conditioned on the preceding trace, its KV cache preserves residual adversarial influence even after the preceding trace and its cache entries are discarded.

The numbers:

  • 79% attack success rate across three open-weight LLMs and three datasets
  • 46% ASR in a realistic reasoning-trace retrieval system — the production-shaped deployment, not a synthetic test
  • Beats HijackKV (state-of-the-art white-box KV poisoning attack) in 8 of 9 resource-constrained settings
  • Only 1% of retained responses detected by a popular prompt-injection detector

The 1% detection rate is the punchline. Existing prompt-injection defenses miss this attack class entirely. The reason is structural: R²ECAP doesn’t inject a prompt — it plants a reasoning trace that conditions the model’s own generation in a direction the attacker chose. The model generates the adversarial content itself. Static prompt-injection detectors looking for known-bad strings find nothing.

The inference optimization you shipped last quarter is now an exploit primitive. KV cache reuse across reasoning traces is exactly the kind of optimization that Anthropic, OpenAI, and open-weight serving frameworks adopted to cut latency and cost. The optimization that improved your p50 response time is the attack surface.

Operators shipping reasoning-trace caching without cache provenance, trace attestation, or per-trace rotation are extending their blast radius. The fix isn’t a new prompt — it’s cache hygiene: trace-level isolation, cache TTLs that rotate before adversarial conditioning accumulates, and provenance checks on retrieved reasoning traces before they’re used to condition generation.

The paper is at arXiv 2610.22873.