Characterizing Contention-Induced Reliability Collapse in KV-Cache Timing Side Channels for Multi-Tenant LLM Serving
cs.CR · cs.AI
Quick verdict
Shows KV-cache timing side-channel reliability on vLLM collapses at contention onset (d 0.78→0.21); methodologically careful, external validity limited.
Summary
This paper empirically characterizes how multi-tenant contention degrades the reliability of KV-cache timing side channels in shared LLM serving. On a live vLLM 0.28.0 server (DeepSeek-R1-Distill-Llama-8B, NVIDIA GB10) carrying uncontrolled production traffic, the author runs seven progressive studies using paired cached/uncached latency probes. The central result is a contention-onset regime change: mean Cohen's d falls from 0.7789 with zero synthetic workers to 0.2109 with two workers (Welch t=8.412), while higher worker counts add no statistically detectable further loss. A 120-run sparse-overlap study shows attack-level AUROC declining from 0.650 at ambient to 0.531 near 61% measured overlap, then partially recovering to 0.574 at saturation; a bootstrapped change-point analysis places the breakpoint at the range boundary (tau=0, CI [0.000,0.113]), favoring an ambient-versus-loaded split over an interior threshold. Concurrency-depth variance is the strongest correlate of effect size (r=-0.416) and hit consistency (r=-0.637). An interleaved control reproduces the non-monotonic ordering, mitigating time-of-day confounds. The collapse replicates on a two-node two-GPU tensor-parallel vLLM (d 3.418 to 0.511, p<0.01); two SGLang pilots are statistically inconclusive under an MPS co-residency confound. Main limitations: a single accelerator architecture and model family, uncontrolled ambient traffic, and correlational-only evidence for the concurrency-depth mechanism.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Introducing sustained synthetic contention collapses the KV-cache timing signal on vLLM: mean Cohen's d falls from 0.7789 (ambient) to 0.2109 with two workers (Welch t=8.412), with no statistically detectable further loss at 4 or 8 workers.
- The reliability change is an ambient-versus-loaded regime change rather than an interior physical threshold: the bootstrapped change-point over measured overlap sits at tau=0 with 95% CI [0.000, 0.113] touching the range boundary.
- Attack-level AUROC declines from 0.650 at ambient to 0.531 near 61% measured overlap and partially recovers to 0.574 at saturation, remaining above chance in every tested bin.
- Concurrency-depth variance is the strongest measured request-layer correlate of timing instability (r=-0.416 with Cohen's d; r=-0.637 with hit consistency), exceeding measured overlap (r=-0.106/-0.504).
- The collapse reproduces on a two-node two-GPU tensor-parallel vLLM deployment (d 3.418→0.511, Welch t≈4.09, p<0.01), while SGLang framework generality remains unresolved under MPS co-residency.
Strengths
Progressive experimental design
Each study targets a weakness exposed by the previous one (Table I): pilot (Study 1) → worker dose-response (Study 2, n=12/level) → workload-shape disentangling (Study 3) → instrumented overlap (Study 4) → 120-run sparse-overlap sampling (Study 5) → interleaved control (Study 6) → cross-instance and two-GPU replication (Study 7).
Statistical hygiene above field norm
Bootstrap CIs (2,000 resamples) on d, H, and AUROC; Welch tests with Satterthwaite df (Table IV: t=8.412, df=18.5 for 0→2 workers); Mann-Whitney AUROC; odd-k majority voting (k∈{1,3,5,9}) explicitly to remove tie-breaking artifacts; a pre-registered change-point decision rule applied against the authors' own preferred interpretation.
Direct confound management
Honest boundary results
Reproducibility artifact
Weaknesses
Unstable ambient anchor
Single-accelerator external validity
Correlational-only mechanism
No multiple-comparison control
Framework generality left open
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper (arXiv 2609.06853, submitted to IEEE TDSC) characterizes how multi-tenant contention degrades the statistical reliability of KV-cache timing side channels in shared LLM serving. It positions itself against attack work (PROMPTPEEK, EarlyBird, InputSnatch) that reports attack feasibility, and defense work (SafeKV, KVGov) that reports defense efficacy, arguing — defensibly and narrowly — that none of these measures the residual signal's effect size, AUROC, hit consistency, or repeated-probe budgets as functions of *directly measured* overlap and concurrency structure. Five contributions are enumerated in Section I, and the claims are consistently narrower than the data support: no defense claim, no universality claim, SGLang generality explicitly left open. This self-restraint is a genuine strength.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is the KV-cache timing side channel in LLM serving?
In LLM serving systems with shared prefix caching (e.g., vLLM), a request whose text prefix is already in the cache completes faster because prefill computation is skipped. By timing requests containing a candidate prefix, a remote attacker can infer whether another user's content is cached — and with iterative probing, potentially reconstruct prompts.
Does server load or contention eliminate the timing attack?
No. In this paper, attack-level AUROC stayed above chance (0.5) in every tested load condition, with the lowest value 0.531 at about 61% measured overlap. Contention weakens the signal sharply (Cohen's d dropped from 0.7789 to 0.2109 with just two background workers) but mainly raises the number of probes an attacker needs, rather than closing the channel.
Is heavy load a viable defense against KV-cache timing attacks?
The paper argues explicitly against treating contention as a defense: it is uncontrolled, workload-dependent, disappears during quiet periods, and an adaptive attacker can wait for favorable windows or condition on observable load. Real defenses must isolate cache state across tenants (e.g., cryptographic cache-identity separation).
What hardware and software were used in these experiments?
The primary target was vLLM 0.28.0 running DeepSeek-R1-Distill-Llama-8B on one NVIDIA GB10 (DGX Spark), with real production traffic present throughout. Replications used a second GB10 node and a two-node, two-GPU tensor-parallel vLLM 0.26.0 deployment; SGLang 0.5.17 pilots were also run but were inconclusive due to an MPS co-residency confound.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures appear in the extracted text only as axis labels and captions (Figs. 1-6); the plotted data points could not be visually inspected.
- The arXiv abstract supplied in the task metadata is cut mid-sentence, but the full embedded text contains the complete abstract and reference list — no substantive truncation was found.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.