Mirage puts a gate on KV-cache timing leaks: probing a sensitive prefix only delays the gateway stream while the GPU keeps reusing cache
Shared prefix caching makes a cache-hit request reach its first token much faster than a miss, and an attacker can exploit that gap to guess another tenant's prompt token by token. Mirage stops isolating caches by content and instead counts new candidate branches under the same sensitive prefix at the gateway; once the budget is spent, it shifts the whole output stream so a hit looks like a natural miss. On SGLang across Qwen, Llama and DeepSeek models and three timing attacks, attack success falls near the random-guessing floor while median first-token latency on public prefixes stays essentially unchanged.