When Cache Poisoning Meets LLM Systems: Semantic Cache Poisoning and Its Countermeasures

When Cache Poisoning Meets LLM Systems: Semantic Cache Poisoning and Its Countermeasures

Speakers: Guanlong Wu

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=22XN0Gaei1o

Overview

As large language model (LLM) services face mounting pressure from high API costs and inference latency, semantic caching has emerged as a widely adopted optimization. The idea is simple: if a user asks a question semantically similar to one already answered, serve the cached response instead of recomputing it. Major cloud providers including Azure, AWS, and Alibaba Cloud, as well as open-source frameworks like GPTCache, have adopted this approach. This talk presents the first in-depth demonstration that semantic caches introduce a dangerous new attack surface -- semantic cache poisoning -- where an attacker acting as a regular end user can craft malicious queries that poison the cache and cause victim users to receive attacker-controlled responses.

The research shows that this attack achieves 87-98% success rates across both black-box and white-box settings on real-world cloud infrastructure, and extends beyond text-based LLM systems to text-to-image generation pipelines. The paper also proposes a countermeasure based on cross-request validation that detects whether cached responses actually match the queries they are served for.

Background

▶ Watch: Introduction to semantic caching for LLM systems (0:00)

LLM inference is an autoregressive process that is both computationally expensive and latency-sensitive. Semantic caching addresses this by storing request-response pairs for later reuse. The workflow involves three key steps: first, an embedding model converts the user's text query into a numeric vector; second, a vector database searches for the most similar cached embedding using cosine similarity; and third, an evaluator re-ranks the results and compares them against a similarity threshold to decide whether to serve a cached response (cache hit) or forward the query to the LLM engine (cache miss).

When a cache miss occurs, the LLM computes a fresh response, which is then stored in the vector database alongside its embedding for future queries. This architecture is not merely experimental -- it has been deployed in production by major cloud service providers and is embedded in popular open-source LLM frameworks. The efficiency gains are significant, but the implicit trust placed in cached responses creates a vulnerability that this research systematically exploits.

Key Findings

▶ Watch: Core attack idea: crafting semantically similar malicious queries (4:00)

The core finding is that an attacker operating as a regular end user -- with no visibility into other users, no access to the backend LLM, and only knowledge that semantic caching is deployed -- can poison the cache to control responses delivered to victim users.

The attack achieves success rates of 87% to 98% across different LLM systems in both black-box (Azure, AWS, Alibaba Cloud) and white-box (GPTCache) settings. Two technical challenges must be overcome: ensuring the attacker-defined response is returned by the LLM, and maintaining sufficient semantic similarity between the malicious and target queries to trigger a cache hit.

The researchers also demonstrated that the attack is not limited to text-based LLM systems. It extends to text-to-image generation, where poisoned cache entries can cause image generation systems to return malicious or inappropriate content in place of legitimate target advertisements or images.

The deciding factors for attack success are the similarity of cache queries and the cache hit threshold -- when these factors are unfavorable, the success rate drops sharply, but in typical production configurations, the attack remains highly effective.

Technical Deep Dive

▶ Watch: Black-box vs white-box attack techniques and text-to-image extension (6:00)

The attack workflow proceeds in four steps. First, the attacker selects a target query -- for example, "Where will NDSS 2026 be held?" Second, the attacker crafts a malicious query that is semantically similar to the target but designed to elicit a specific attacker-chosen response from the LLM. Third, the attacker sends this malicious query to the LLM system, which processes it and stores the response in the semantic cache. Fourth, the attacker verifies the poisoning succeeded by submitting a query similar to the target.

Two technical challenges are addressed with distinct approaches:

Ensuring attacker-defined responses: The researchers employ prompt engineering techniques including zero-shot prompting, in-context learning, and prompt injection templates to steer the LLM's response toward attacker-chosen content. This ensures that when the malicious query triggers a cache miss, the LLM generates the exact response the attacker wants cached.

Maintaining semantic similarity: For black-box systems where the attacker cannot observe internal embeddings, the approach uses the target question itself as a prefix for the adversarial query, appending the prompt engineering payload after it. The adversarial query thus takes the form: target_question + prompt_engineering_payload. For white-box systems where embedding model details are known, the researchers use gradient-based optimization to craft an adversarial prefix that minimizes embedding distance from the target query while still triggering the desired LLM response.

The distinction between black-box and white-box approaches is important: the black-box method is universally applicable but slightly less reliable, while the white-box approach using gradient optimization provides tighter control over the embedding similarity.

Demo / Proof of Concept

▶ Watch: Countermeasure: cross-request validation classifier (8:45)

The researchers conducted evaluations on both white-box and black-box systems. The white-box study targeted GPTCache, an open-source semantic caching framework. The black-box studies targeted production cloud services from Azure, AWS, and Alibaba Cloud.

Results demonstrated high attack effectiveness: success rates ranged from 87% to 98% across different LLM systems and configurations. The researchers also demonstrated the attack on text-to-image generation systems, showing that adversarial queries could cause cached image responses to be replaced with malicious content -- for example, substituting a legitimate advertisement image with inappropriate or harmful imagery.

The practical impact extends to any deployment where semantic caching is used to optimize LLM-based services, which increasingly includes enterprise chatbots, customer support systems, and content generation platforms.

Defensive Implications

▶ Watch: Q&A: cache retention time and cache size questions (10:00)

The proposed countermeasure is a cross-request validation mechanism. The core idea is straightforward: train a classifier that performs revalidation on cached responses before serving them. When a cache hit occurs, the system checks whether the cached response genuinely matches the incoming query. If the response does not semantically align with the query, the system flags a potential poisoning attack and falls back to direct LLM computation.

This approach is described as "more effective but not perfect" -- it significantly raises the bar for attackers but does not completely eliminate the threat. The fundamental tension is that semantic caching relies on approximate matching, and any defense must balance security against the performance benefits that motivated caching in the first place.

Organizations deploying semantic caching should evaluate their cache hit thresholds carefully, implement response-query consistency checking, and consider the risk that multi-tenant caching environments expose users to cross-user cache poisoning. The attack surface is particularly concerning because it requires no elevated privileges -- any regular user of the system can attempt it.

Key Takeaways

• Semantic caching in LLM systems introduces a previously unrecognized attack surface where regular users can poison cached responses to control what other users see
• The attack achieves 87-98% success rates on production cloud infrastructure including Azure, AWS, and Alibaba Cloud
• Both black-box (prefix-based) and white-box (gradient-optimized) attack variants are effective, meaning the technique works regardless of how much the attacker knows about the system
• The vulnerability extends beyond text-based LLMs to text-to-image generation systems
• Cross-request validation using response-query consistency checking is the most effective proposed countermeasure, though it is not perfect
• Cache hit thresholds and query similarity are the key deciding factors for attack success, suggesting that tighter thresholds reduce risk at the cost of cache efficiency

About the Speaker(s)

The paper was presented by Fuwei Jiang on behalf of the authors. The primary author is Guanlong Wu. The research team was unable to attend in person, and the presenter acknowledged limited familiarity with some implementation details, deferring several audience questions to the paper and the original authors. The work represents an academic contribution focused on the intersection of caching optimization and LLM security.