{"slug": "characterizing-contention-induced-reliability-collapse-in-kv-cache-timing-side", "title": "Characterizing Contention-Induced Reliability Collapse in KV-Cache Timing Side Channels for Multi-Tenant LLM Serving", "summary": "A study of seven experiments on live shared LLM-serving systems found that KV-cache timing side-channel reliability collapses under multi-tenant contention, with mean Cohen's d on a vLLM server running DeepSeek-R1-Distill-Llama-8B on NVIDIA GB10 dropping from 0.7789 with no synthetic workers to 0.2109 with two workers (t=8.412). AUROC fell from 0.650 at ambient load to 0.531 near 61% overlap before partially recovering to 0.574 at saturation, and the collapse reproduced on a real two-node, two-GPU tensor-parallel vLLM setup where mean d fell from 3.418 to 0.511 (p<0.01). The authors conclude that KV-cache timing reliability depends strongly on the load regime and serving stack, so measurements on quiet systems can overestimate operational attack reliability.", "body_md": "arXiv:2609.06853v1 Announce Type: cross \nAbstract: Shared key--value (KV) cache reuse improves large language model (LLM) serving, but it can also create a timing side channel that reveals whether a prefix is already cached. Previous work shows that such attacks are possible, but their reliability under realistic multi-tenant contention is less understood. We study this problem through seven experiments on live shared LLM-serving systems. On a vLLM server running DeepSeek-R1-Distill-Llama-8B on NVIDIA GB10, mean Cohen's d drops from 0.7789 with no synthetic workers to 0.2109 with two workers (t=8.412), while higher worker counts cause no statistically detectable further loss. A 120-run sparse-overlap experiment places the best breakpoint at the boundary of the measured range (tau=0, 95% CI [0.000,0.113]), supporting an ambient-versus-loaded regime change rather than an internal physical threshold. AUROC falls from 0.650 at ambient to 0.531 near 61% overlap and partially recovers to 0.574 at saturation. Concurrency-depth variance is the strongest measured correlate of effect size (r=-0.416) and hit consistency (r=-0.637). An interleaved control preserves the same non-monotonic ordering. The main collapse is also reproduced on a real two-node, two-GPU tensor-parallel vLLM setup, where mean d falls from 3.418 to 0.511 (p<0.01). Two SGLang pilots are statistically inconclusive. Overall, KV-cache timing reliability depends strongly on the load regime and serving stack, and measurements on quiet systems can overestimate operational attack reliability.", "url": "https://wpnews.pro/news/characterizing-contention-induced-reliability-collapse-in-kv-cache-timing-side", "canonical_source": "https://www.machinebrief.com/news/characterizing-contention-induced-reliability-collapse-in-kv-3tsu", "published_at": "2026-09-10 04:00:00+00:00", "updated_at": "2026-09-10 05:51:58.434837+00:00", "lang": "en", "topics": ["ai-safety", "large-language-models", "ai-infrastructure", "ai-research"], "entities": ["vLLM", "DeepSeek-R1-Distill-Llama-8B", "NVIDIA GB10", "SGLang"], "alternates": {"html": "https://wpnews.pro/news/characterizing-contention-induced-reliability-collapse-in-kv-cache-timing-side", "markdown": "https://wpnews.pro/news/characterizing-contention-induced-reliability-collapse-in-kv-cache-timing-side.md", "text": "https://wpnews.pro/news/characterizing-contention-induced-reliability-collapse-in-kv-cache-timing-side.txt", "jsonld": "https://wpnews.pro/news/characterizing-contention-induced-reliability-collapse-in-kv-cache-timing-side.jsonld"}}