Research map / Adversarial robustness and security / Attacks on text and graphs

LaCache: Robust Semantic Caching for LLM Serving

NeurIPS 2026 · Adversarial robustness and security › Attacks on text and graphs · approach: LLM jailbreak and injection defense · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes LaCache, a semantic-cache redesign that adds a lookahead check on the first k response tokens (via embedding hash) so cache-collision attacks producing semantically different responses are detected, with near-zero attack hit rate while keeping most benign hit rate.

Problem

Semantic caches in LLM serving are vulnerable to cache-collision attacks, where adversarial queries collide with victim query keys and cause the cache to return adversary-chosen responses; existing query-side defenses are evadable by optimized adversarial queries.

Approach

Shift the integrity check from the query to the response: each cache entry also stores a hash of the first k response tokens, and a cache hit is served only if the lookahead prefix hash also matches; the paper argues the response prefix is hard for an adversary to control, giving a probabilistic detection guarantee.

Key results

• On Qwen3 + BGE, LaCache reduces attack hit rate for Kca from 0.80 to 0.00 and for Scp-p from 0.95 to 0.01 while keeping benign hit rate at 0.93 (vs 1.00 undefended).
• Compared with PPL, QR-PPL and LLM-as-Judge on white-box attacks, LaCache gives the lowest AHR on Kca, Scp-z, and Scp-p (0.00, 0.04, 0.01), though Scp-i reaches 0.14.
• Adaptive attacks achieve 0/200 end-to-end success on Kca and 4/200 (2.0%) on Scp-p against LaCache on Qwen3 + BGE.

Surprising findings

• LLM-as-Judge catches Kca well (AHR 0.01) mainly because the Kca adversarial query contains an unrelated core prompt, a side effect of attack structure rather than a general defense.
• Ensembling embedding models helps only against Scp-Z and Scp-I; for Kca and Scp-p a single check already saturates security.

Limitations

• The guarantee applies only to attacks whose adversarial response is semantically distinct from the genuine response; subtle misinformation attacks fall outside its scope.
• Ensemble amplification to 1 - p2^m does not fully materialize when embedding models are correlated.
• Scp-i (in-context variant) remains a harder case with AHR 0.14.

Experimental setup

Datasets: Natural Questions MS MARCO

Benchmarks: KCA attack set SCP attack set (MS MARCO)

Metrics: attack hit rate (AHR) benign hit rate (BHR) injection success rate (ISR) latency

Baselines: PPL QR-PPL LLM-as-Judge Undefended

Builds on: GPTCache speculative decoding GCG locality-sensitive hashing

Closest papers by meaning

• vCache: Verified Semantic Prompt Caching (ICLR 2026 · similarity 0.87)
• RazorAttention: Efficient KV Cache Compression Through Retrieval Heads (ICLR 2025 · similarity 0.86)
• Taming the Fragility of KV Cache Eviction in LLM Inference (ICLR 2026 · similarity 0.86)
• Robustifying Learning-Augmented Caching Efficiently without Compromising 1-Consistency (NeurIPS 2025 · similarity 0.86)
• Auditing Prompt Caching in Language Model APIs (ICML 2025 · similarity 0.85)
• Randomization Boosts KV Caching, Learning Balances Query Load: A Joint Perspective (ICLR 2026 · similarity 0.85)