Semantic caching has emerged as a pivotal technique for scaling LLM applications, widely adopted by major providers including AWS and Microsoft. By utilizing semantic embedding vectors as cache keys, this mechanism effectively minimizes latency and redundant computation for semantically similar queries. In this work, we conceptualize semantic cache keys as a form of fuzzy hashes. We demonstrate that the locality required to maximize cache hit rates fundamentally conflicts with the cryptographic avalanche effect necessary for collision resistance. Our conceptual analysis formalizes this inherent trade-off between performance (locality) and security (collision resilience), revealing that semantic caching is naturally vulnerable to key collision attacks. While prior research has focused on side-channel and privacy risks, we present the first systematic study of integrity risks arising from cache collisions. We introduce CacheAttack, an automated framework for launching black-box collision attacks. We evaluate CacheAttack in security-critical tasks and agentic workflows. It achieves a hit rate of 86\% in LLM response hijacking and can induce malicious behaviors in LLM agent, while preserving strong transferability across different embedding models. A case study on a financial agent further illustrates the real-world impact of these vulnerabilities. Finally, we discuss mitigation strategies.

翻译：语义缓存已成为扩展LLM应用的关键技术，被AWS和微软等主流服务商广泛采用。该机制通过将语义嵌入向量作为缓存键，有效减少了语义相似查询的延迟和冗余计算。在本研究中，我们将语义缓存键概念化为模糊哈希的一种形式。我们证明，最大化缓存命中率所需的局部性本质上与抗碰撞性所需的密码学雪崩效应相冲突。我们的概念分析形式化了性能（局部性）与安全性（抗碰撞性）之间的固有权衡，揭示了语义缓存天然易受关键碰撞攻击的特性。尽管先前研究主要关注侧信道和隐私风险，我们首次系统研究了由缓存碰撞引发的完整性风险。我们提出了CacheAttack——一个用于发起黑盒碰撞攻击的自动化框架。我们在安全关键任务和智能体工作流中评估了CacheAttack。该框架在LLM响应劫持中实现了86%的命中率，能够诱导LLM智能体产生恶意行为，同时在不同嵌入模型间保持强大的可迁移性。针对金融智能体的案例研究进一步揭示了这些漏洞在现实场景中的实际影响。最后，我们探讨了相应的缓解策略。