Stealthy Poisoning Attacks via Reused KV Cache of Reasoning

Summary

Researchers show that reusing key-value caches built from reasoning traces, which can improve task performance much like RAG, opens new poisoning vulnerabilities in LLM systems. Their black-box attack, R$^2$ECAP, plants poisoned traces through a chat interface alone, and the retained trace keeps adversarial influence after the preceding trace's cache entries are discarded. It reaches up to 79% attack success rate on three open-weight LLMs and three datasets, and 46% in a realistic reasoning-trace retrieval system, while only 1% of its retained responses were flagged by a popular prompt injection detector.

Related items

• MediumCVE-2026-111991: WongKinYiu yolov9 code injection via ONNX Metadata HandlerSimilar attack · NVD/CVE Database
• LowWhat are self-replicating ‘AI worms’, and why is Anthropic worried about them?Similar attack · The Guardian Technology
• MediumCVE-2026-112047: OneUptime incorrect authorization in cluster actions by project membersSimilar attack · NVD/CVE Database
• HighCVE-2026-96620: Claude Agent SDK argument injection via resume option enabling command executionSimilar attack · NVD/CVE Database
• HighCVE-2026-59970: Tandoor Recipes SSRF through AI provider URL in AI actionsSimilar attack · NVD/CVE Database