arXiv (Computer Science - Cryptography and Security) • 8w
Bit-Flip Vulnerability in vLLM Prefix Caching via GPU Rowhammer
vLLM's prefix caching mechanism is susceptible to Rowhammer-induced bit flips within shared KV-cache blocks stored in GPU DRAM. By targeting BF16 precision memory locations, attackers can induce "silent divergence," where LLM outputs remain syntactically coherent but become factually manipulated. This vulnerability allows for targeted attacks on users sharing common prompt prefixes and features persistent error accumulation over time. Because KV-cache blocks lack native integrity protection, these faults evade standard detection and scale linearly with request volume. Remediation requires the implementation of low-overhead checksum verification during the request scheduling phase to validate block integrity before batch processing.