arXiv cs.AI: Mirage: Provable Defense Against LLM KV Cache Timing Side Channels with Topology-Aware Isolation

arXiv cs.AI: Mirage: Provable Defense Against LLM KV Cache Timing Side Channels with Topology-Aware Isolation

In their arXiv abstract, Xiaobei Yan and Tianwei Zhang argue that shared LLM services can leak sensitive prompt tokens: attackers compare time-to-first-token (TTFT) when a KV cache hit occurs with TTFT after a miss. They say existing defenses that restrict cross-tenant cache sharing impose prohibitive performance overhead. Their proposed framework, Mirage, delays token emission at the gateway rather than stalling the GPU or forcing redundant recomputations. A Privacy Odometer tracks the topological novelty of prefix fan-out expansions; when a prefix exceeds a safety threshold, a two-phase policy uses a dynamic estimator to pad TTFT to a calibrated cache-miss baseline. The authors report that, on a 500-sample public corpus across three models, Mirage suppresses the timing side-channel to near the random-guessing floor while maintaining a significantly lower TTFT than defense baselines. They also report results against a strong adaptive adversary and say the same principle carries over to semantic caching layers. The abstract describes those results but does not provide the evaluation details needed to assess the reported comparisons.

Publication: 6bce91ed-c24d-4fb5-8ef5-3cbdb462b9a5

attribution — pass: The reading correctly attributes the arXiv paper and its claims to authors Xiaobei Yan and Tianwei Zhang, and frames the results as the authors' reported findings rather than established facts.

Authors:Xiaobei Yan, Tianwei Zhang

summary — uncertain: The summary tracks the abstract faithfully, but a non-specialist cannot follow the central mechanism. KV cache, TTFT, cross-tenant, prefix sharing and side channel are not explained. It also never says the attack exposes other users' prompts in a shared service, which is the human stake. Privacy Odometer and 'topological novelty of prefix fan-out expansions' are copied without explanation. Smallest repair: one plain sentence saying a cache hit returns the first token faster, so timing can reveal whether another tenant already sent the same prompt beginning. Add term-library tooltips for the remaining terms. The omission of 'provably bounds' is minor.

Large Language Models (LLMs) are increasingly deployed as shared multi-tenant services, relying on advanced optimizations like KV cache and prefix sharing to improve throughput and reduce latency.

date — pass: originalPublished 2026-11-07 matches the v1 submission date on arXiv. The later feed date of November 10 is correctly not used.

[Submitted on 7 Nov 2026]

support — pass: Each claim matches an abstract excerpt and is labeled as source-stated. The limitation and the question correctly note that the abstract lacks evaluation details. No benefits, costs or forecasts are invented.

On a 500-sample public corpus across three models, Mirage suppresses the timing side-channel to near the random-guessing floor, while maintaining a significantly lower TTFT than defense baselines.

media — pass: The selected media is the verified direct link to the original arXiv abstract page. It is the most relevant candidate available.