The Key-Value (KV) cache, which stores intermediate attention computations (Key and Value pairs) to avoid redundant calculations, is a fundamental mechanism for accelerating Large Language Model (LLM) inference. However, this efficiency optimization introduces significant yet underexplored privacy risks. This paper provides the first comprehensive analysis of these vulnerabilities, demonstrating that an attacker can reconstruct sensitive user inputs directly from the KV-cache. We design and implement three distinct attack vectors: a direct Inversion Attack, a more broadly applicable and potent Collision Attack, and a semantic-based Injection Attack. These methods demonstrate the practicality and severity of KV-cache privacy leakage issues. To mitigate this, we propose KV-Cloak, a novel, lightweight, and efficient defense mechanism. KV-Cloak uses a reversible matrix-based obfuscation scheme, combined with operator fusion, to secure the KV-cache. Our extensive experiments show that KV-Cloak effectively thwarts all proposed attacks, reducing reconstruction quality to random noise. Crucially, it achieves this robust security with virtually no degradation in model accuracy and minimal performance overhead, offering a practical solution for trustworthy LLM deployment.

翻译：键值（KV）缓存通过存储中间注意力计算（键值对）以避免冗余计算，是加速大语言模型推理的基础机制。然而，这种效率优化引入了显著但尚未被充分探索的隐私风险。本文首次全面分析了这些漏洞，证明攻击者可直接从KV缓存中重构敏感用户输入。我们设计并实现了三种不同的攻击向量：直接的反演攻击、适用性更广且更强大的碰撞攻击，以及基于语义的注入攻击。这些方法证明了KV缓存隐私泄露问题的实际性与严重性。为缓解此问题，我们提出了KV-Cloak，一种新颖、轻量且高效的防御机制。KV-Cloak采用基于可逆矩阵的混淆方案，并结合算子融合技术，以保护KV缓存。我们的大量实验表明，KV-Cloak能有效抵御所有提出的攻击，将重构质量降至随机噪声水平。至关重要的是，它在实现强大安全性的同时，几乎不降低模型精度，且性能开销极小，为可信赖的大语言模型部署提供了实用解决方案。