Diffusion models are a powerful class of generative models that produce images and other content from user prompts, but they are computationally intensive. To mitigate this cost, recent academic and industry work has adopted approximate caching, which reuses intermediate states from similar prompts in a cache. While efficient, this optimization introduces new security risks by breaking isolation among users. This paper provides a comprehensive assessment of the security vulnerabilities introduced by approximate caching. First, we demonstrate a remote covert channel established with the approximate cache, where a sender injects prompts with special keywords into the cache system and a receiver can recover that even after days, to exchange information. Second, we introduce a prompt stealing attack using the approximate cache, where an attacker can recover existing cached prompts from hits. Finally, we introduce a poisoning attack that embeds the attacker's logos into the previously stolen prompt, leading to unexpected logo rendering for the requests that hit the poisoned cache prompts. These attacks are all performed remotely through the serving system, demonstrating severe security vulnerabilities in approximate caching. The code for this work is available.

翻译：扩散模型是一类强大的生成模型，能够根据用户提示生成图像及其他内容，但其计算成本高昂。为降低这一成本，近期学术界和工业界采用近似缓存技术，该技术通过复用缓存中相似提示的中间状态来提升效率。然而，这种优化在提升效率的同时，因打破用户隔离而引入新的安全风险。本文全面评估了近似缓存引入的安全漏洞。首先，我们展示了一种基于近似缓存的远程隐蔽信道：发送者将含有特殊关键词的提示注入缓存系统，接收者即使在数日后仍能恢复这些信息以实现数据交换。其次，我们提出一种利用近似缓存的提示窃取攻击，攻击者可通过缓存命中恢复现有缓存提示。最后，我们介绍一种投毒攻击，通过将攻击者标志嵌入先前窃取的提示中，导致后续命中被投毒缓存提示的请求渲染出意外标志。上述攻击均通过服务系统远程实施，揭示了近似缓存存在严重安全漏洞。本文相关代码已公开。