Stealthy Poisoning Attacks via Reused KV Cache of Reasoning

What it is

R²ECAP (Reused Reasoning-Cache Poisoning) is a black-box attack by Lin Zhu, Yoojin Jung and Sebastian Szyller (Aalto University, arXiv 2610.22873, October 2026). It targets systems that store the KV cache of earlier reasoning traces and prepend retrieved entries to later queries, a pattern the paper compares to RAG. The attacker needs only the public chat interface.

How it works

The attacker builds a pair of traces with separate jobs.

• R1, the preceding trace. It adopts a modified condition (for example, redefining "%" as multiplication) and reasons toward the attacker's target T instead of the gold answer G.
• R2, the retained response. It stays relevant to the question, begins with a transition sentence linking it to R1, and carries T without reproducing R1's misleading reasoning.

Because R2 is encoded after R1, its KV cache differs from the cache of R2 encoded alone. The paper writes this difference as ΔR2 = C_cond − C_plain. When R1 and its cache are discarded, the ΔR2 residual stays in R2's cache entries.

The attacker cannot insert the pair directly. A "backward trace search" (Algorithm 1) realizes it through normal chat turns. It first finds a prefix prompt that makes the model produce R2 from R1. It then proposes predecessor prompts backward until it reaches an initial prompt, using an evaluator's feedback and a history of failed attempts at each stage. The prompts used to build R1 and R2 are in the paper's Appendix E.

Preconditions / Affected

• The system keeps a shared store of conditioned KV caches from user-committed reasoning traces and retrieves the top-k by cosine similarity of embeddings.
• A user can commit a trace to the store, so the attacker can plant entries through ordinary use.
• The attacker knows the system's high-level design but not the model architecture or the store's contents. Two settings are tested: the exact victim query is known (C1, an upper bound), or only its topic is known (C2).
• No attack-query budget is assumed beyond ordinary rate limits.
• Before commit, an external safety evaluator inspects only the user-visible R2. It never sees R1, which is the gap the attack exploits.

Results

• Up to 79% ASR under exact-query cache reuse.
• 16–46% ASR under cross-query reuse. The 46% figure comes from the realistic retrieval-based log-augmented generation (LAG) system.
• Better than the white-box HijackKV in 8 of 9 resource-constrained settings. HijackKV uses GCG to optimize a hard-token prefix.
• Only 1% of retained responses were flagged by the prompt-injection detector.
• Evaluation covers three open-weight LLMs and three datasets: GPQA Main (answer shifted by a fixed mapping), MBPP and BigCodeBench (a group-specific deviant behavior).

Caveats

• The fetched text is cut off during the experimental setup, so the model names, per-setting ASR and any defense results beyond the single-evaluator check are not available here.
• The paper's own examples use short reasoning tasks. Results come from grouped queries sharing one attack objective, with 10 source and 10 test samples per group for GPQA and BigCode.
• The page gives no mitigation guidance. The paper's own framing points to inspecting what a cache was conditioned on, not just the retained text, but the fetched text does not test that.