Mirage puts a gate on KV-cache timing leaks: probing a sensitive prefix only delays the gateway stream while the GPU keeps reusing cache
Synopsis
Shared prefix caching makes a cache-hit request reach its first token much faster than a miss, and an attacker can exploit that gap to guess another tenant's prompt token by token. Mirage stops isolating caches by content and instead counts new candidate branches under the same sensitive prefix at the gateway; once the budget is spent, it shifts the whole output stream so a hit looks like a natural miss. On SGLang across Qwen, Llama and DeepSeek models and three timing attacks, attack success falls near the random-guessing floor while median first-token latency on public prefixes stays essentially unchanged.
Interpretation
Mirage pushes cross-tenant prefix-cache timing leakage to near the random-guessing floor without turning off cache sharing. Earlier defenses partitioned caches, added salts, or isolated prefixes classified as sensitive, so legitimate users of a sensitive prefix lost all cache reuse. On a 500-sample public corpus across DeepSeek-14B, Llama-3-8B and Qwen1.5-1.8B, OptiLeak success drops to 0, EarlyBird to 0 to 0.2, and InputSnatch end-to-end recovery to 0.4 or below.
The detection signal is a behavior the attacker cannot avoid: resolving a high-entropy secret requires opening many new candidate branches beneath one prefix. A content classifier only asks whether a request contains a secret, and cannot separate a legitimate reader of a sensitive document from an adversary hammering it with probes. The Privacy Odometer scores new branches per prefix with time decay; under the default budget the first novel branch passes and a rapid second candidate triggers lockdown.
Lockdown does not stall the GPU; the gateway shifts the entire stream by one offset so first-token latency lands on a calibrated miss quantile. Holding back only the first token would let buffered chunks burst out in a streaming API and expose abnormal inter-token gaps. The miss target comes from online affine regression plus an upper residual quantile and updates with load; median first-token latency on public traffic stays within a small margin of the undefended baseline.
Perspective
The demonstrated setting is single-GPU serving on NVIDIA A40 with models up to 14B, evaluated under SGLang's longest-prefix-match scheduling with one in-flight request, and the security numbers come from a 500-sample corpus of confidential consultation prompts assembled from public sources. The intended reader is a systems engineer or security researcher deploying multi-tenant inference and weighing the privacy cost of prefix caching.
The guarantee is conditional: it degrades if the sensitivity gate misfires, if probes split across metered prefixes, if the schedule leaks beyond the first token, or if equalization is imperfect. Residual leakage is reported as a measured equalization gap rather than a bound over all conceivable tests, and the low-and-slow analysis relies on assumptions about cache residency.