vLLM's prefix caching mechanism is susceptible to Rowhammer-induced bit flips within shared KV-cache blocks stored in GPU DRAM. By targeting BF16 precision memory locations, attackers can induce "silent divergence," where LLM outputs remain syntactically coherent but become factually manipulated. This vulnerability allows for targeted attacks on users sharing common prompt prefixes and features persistent error accumulation over time. Because KV-cache blocks lack native integrity protection, these faults evade standard detection and scale linearly with request volume. Remediation requires the implementation of low-overhead checksum verification during the request scheduling phase to validate block integrity before batch processing.

• Threat Model: Prefix Caching Vulnerability

  • vLLM utilizes prefix caching to optimize inference by storing Key-Value (KV) cache blocks in GPU DRAM for reuse across multiple requests.
  • Shared cache blocks are stored without integrity checks, creating a gap where physical memory corruption can affect multiple independent user sessions.
  • The attack surface shifts from traditional prompt injection to hardware-level fault injection targeting the model's temporal context.

• Attack Mechanics: GPU Rowhammer Injection

  • Attackers leverage Rowhammer techniques to induce bit flips in physical GPU memory locations mapped to shared KV-cache blocks.
  • The attack targets the Bfloat16 (BF16) precision format, specifically manipulating the activation state rather than the static model weights.
  • Software-based fault injection frameworks are used to identify and target specific bit positions that maximize adversarial output divergence.

• Impact Analysis: Silent Divergence & Scale

  • Silent Divergence: Research shows 13 out of 16 BF16 bit positions produce coherent but factually incorrect outputs, making detection nearly impossible without a clean baseline.
  • Selective Propagation: Corruption is isolated to specific shared prefixes, allowing attackers to target specific cohorts of users or system prompts.
  • Persistent Accumulation: Unlike transient errors, these bit flips are persistent in the cache; damage scales linearly as more requests utilize the corrupted block.

• Mitigation: Checksum Integrity Verification

  • Implementation of a checksum-based verification logic at the scheduling stage to ensure block integrity before it is assigned to a batch.
  • This approach effectively bounds the "blast radius" of a single corruption event to the immediate batch being processed.
  • Performance testing indicates negligible overhead, making it a viable production-grade defense for high-throughput serving systems.

• Conclusion: Infrastructure Security Implications

  • This research highlights a critical need for hardware-aware security audits in LLM serving stacks, moving beyond the application layer.
  • It demonstrates that optimization features like prefix caching can introduce systemic vulnerabilities if memory integrity is ignored.
  • Future LLM infrastructure must treat GPU DRAM as an untrusted environment when sharing state across tenants.