Closing the Unowned Trust Boundary: KV-Cache Integrity Verification

This is a technically strong and well-motivated project. The paper identifies an important gap in current LLM serving security: KV-cache contents are safety-relevant runtime state, but existing compliance and integrity checks mostly focus on weights, hooks, inputs, outputs, or behavioral spot checks. Reframing KV-cache tampering as an “unowned trust boundary” is a clear and useful conceptual contribution.

The proposed defense is elegant: recomputing sampled value vectors from the model’s own weights and comparing them against cached values directly targets the attack surface. The empirical results are impressive, especially the near-perfect AUC, zero observed false positives under tested conditions, sequence-level detection at low sampling rates, and the latency/overhead analysis. The game-theoretic argument that reducing tampering also weakens the attack is also a strong addition.

The main area for improvement is scope and external validation. The experiments are limited to HF Transformers, one model, fp16 cache assumptions, and a relatively small prompt set. Since the claim is about production serving integrity, the paper would be much stronger with at least a minimal vLLM/PagedAttention prototype, tests on quantized KV caches, and additional model families. The “sub-1% with kernel fusion” claim is plausible but currently projected rather than demonstrated, so it should be framed more cautiously unless implemented.

The security framing is compelling, but some claims are stated very strongly. “No winning move” and “structurally zero false positives” may overstate what is proven under adaptive attackers, different kernels, quantization, batching regimes, and runtime nondeterminism. It would help to discuss adaptive attacks more explicitly, such as tampering with the exposed hidden state used for recomputation, attacking the detector path, or modifying cache values only in contexts unlikely to be sampled.

Overall, this is an innovative and high-impact technical safety project with a clear defense proposal and strong initial evidence. The next step is broader systems validation across real serving stacks and cache formats.

This is the most technically impressive submission I have reviewed. The core idea is elegant: the attack hides by keeping the forward pass bit-identical, but that same property leaves the pre-projection hidden state clean, so you can recompute the true value vector from the model's own weights and catch the tampering. The thing that makes the attack invisible to other checks is exactly what makes it visible to yours. That is a sharp piece of reasoning, and the separation you report is a real physical gap, not a fitted one, which makes the near-perfect AUC believable rather than suspicious. The reframing from "systems exploit" to an unowned trust boundary is also a genuine contribution, and the disclosure story — ten maintainers and vendors, nobody claiming ownership, no CVE — is the evidence that backs it.

A few things to work on, in order of importance:

1. The biggest gap is the tension between your threat model and your defense. Your main adversary is a malicious operator with full runtime control who passes every audit. But your defense is a runtime monitor. By your own argument, an operator who controls the runtime can disable that monitor or feed it a spoofed input, the same way they neutralized every other check. So the work does not really close the boundary against the primary threat — it moves it from cache content to the integrity of the detector itself. That is still useful, but it is a weaker claim than the title makes. You need to say who runs the detector and why the operator cannot evade it — a trusted execution environment or hardware root of trust is the natural answer, and it should be in the paper, not just hinted at in the conclusion.

2. The defense is tested against one attack — your own SCALPEL, which is under resubmission with code withheld. Building on your own work is fine, but it means the whole loop is author-built: your attack, reproduced by you, defended by you, with no adversary you did not design. Robustness to attack variants is argued on the game-theoretic frontier rather than tested. Adding even one independent or varied attack would strengthen this a lot.

3. The deployment story has a gap you call engineering but is closer to science. The attack transfers to vLLM, but the defense is HF-only, and you concede that vLLM's PagedAttention path may not expose the pre-projection input your detector needs. That is the exact input the whole method depends on, sitting right where the threat is real. Quantized KV cache (fp8/int8), which is standard in production, has the same issue since it raises the noise floor. Both deserve more than a deferral.

4. Smaller points: the large sample counts are per-entry, derived from only 20 tampered and 10 benign prompts on a single model, so the generalization and robustness claims rest on thin prompt and model diversity, not on the big numbers. And "the attacker has no winning move" is shown for two head configurations, not the whole space — the cumulative-detection argument is strong, but an attacker varying head selection or erasure strength is not ruled out empirically.

On presentation: this is precise, well-structured, and the figures are well-sourced. The regulatory section is careful and correctly separates the operator case from the third-party case. Two notes — the paper is dense and asks a lot of the reader, and the tone occasionally oversells ("no escape," "no winning move") past what the experiments show.

Overall this is sharp, original work on a surface the field has ignored. The next step is to close the loop honestly: specify where the detector runs so it actually binds your primary adversary, and test against an attack you did not build yourself.