Closing the Unowned Trust Boundary: Runtime KV-Cache Integrity Verification against Safety-Bypass Tampering

This is the most technically impressive submission I have reviewed. The core idea is elegant: the attack hides by keeping the forward pass bit-identical, but that same property leaves the pre-projection hidden state clean, so you can recompute the true value vector from the model's own weights and catch the tampering. The thing that makes the attack invisible to other checks is exactly what makes it visible to yours. That is a sharp piece of reasoning, and the separation you report is a real physical gap, not a fitted one, which makes the near-perfect AUC believable rather than suspicious. The reframing from "systems exploit" to an unowned trust boundary is also a genuine contribution, and the disclosure story — ten maintainers and vendors, nobody claiming ownership, no CVE — is the evidence that backs it.

A few things to work on, in order of importance:

1. The biggest gap is the tension between your threat model and your defense. Your main adversary is a malicious operator with full runtime control who passes every audit. But your defense is a runtime monitor. By your own argument, an operator who controls the runtime can disable that monitor or feed it a spoofed input, the same way they neutralized every other check. So the work does not really close the boundary against the primary threat — it moves it from cache content to the integrity of the detector itself. That is still useful, but it is a weaker claim than the title makes. You need to say who runs the detector and why the operator cannot evade it — a trusted execution environment or hardware root of trust is the natural answer, and it should be in the paper, not just hinted at in the conclusion.

2. The defense is tested against one attack — your own SCALPEL, which is under resubmission with code withheld. Building on your own work is fine, but it means the whole loop is author-built: your attack, reproduced by you, defended by you, with no adversary you did not design. Robustness to attack variants is argued on the game-theoretic frontier rather than tested. Adding even one independent or varied attack would strengthen this a lot.

3. The deployment story has a gap you call engineering but is closer to science. The attack transfers to vLLM, but the defense is HF-only, and you concede that vLLM's PagedAttention path may not expose the pre-projection input your detector needs. That is the exact input the whole method depends on, sitting right where the threat is real. Quantized KV cache (fp8/int8), which is standard in production, has the same issue since it raises the noise floor. Both deserve more than a deferral.

4. Smaller points: the large sample counts are per-entry, derived from only 20 tampered and 10 benign prompts on a single model, so the generalization and robustness claims rest on thin prompt and model diversity, not on the big numbers. And "the attacker has no winning move" is shown for two head configurations, not the whole space — the cumulative-detection argument is strong, but an attacker varying head selection or erasure strength is not ruled out empirically.

On presentation: this is precise, well-structured, and the figures are well-sourced. The regulatory section is careful and correctly separates the operator case from the third-party case. Two notes — the paper is dense and asks a lot of the reader, and the tone occasionally oversells ("no escape," "no winning move") past what the experiments show.

Overall this is sharp, original work on a surface the field has ignored. The next step is to close the loop honestly: specify where the detector runs so it actually binds your primary adversary, and test against an attack you did not build yourself.

This is among the strongest papers I reviewed at this hackathon. The core reframing — cache erasure is not a systems exploit but an attestation gap owned by no one — is both precise and actionable. The regulatory anchoring (EU AI Act Articles 15/26, NIST AI RMF, White House Voluntary Commitments) correctly identifies why this matters beyond the academic setting. The game-theoretic result is clean and well-supported: the attacker faces a genuine dilemma where reducing detectable heads also collapses attack success, with no escape.

A few suggestions for strengthening the paper: (1) The threshold margin of ~1.28x (benign ceiling 8.2e-4 vs. tau=1e-3) is uncomfortably thin for production recommendation — the paper wisely recommends tau=1.5-2e-3 in discussion, but the main results should lead with that operating point, not tau=1e-3. (2) The framework-independence claim is well-argued in theory but the vLLM PagedAttention limitation (pre-projection x_t not exposed at execution boundary) is a real deployment gap — a brief pointer to how a production framework could expose this hook would strengthen the practical case. (3) The iceberg structure figure (Figure 1) is informative but the cross-model comparison is visually hard to distinguish in log-scale; clearer legend differentiation would help.

These are minor points. The responsible-disclosure posture is exactly right, and the paper sets a high bar for what hackathon-scale technical safety work can achieve.

This is an ambitious and well-presented systems-safety project that identifies an important gap between integrity checks applied to model weights and the mutable runtime state used during inference. Reframing KV-cache manipulation as an attestation and trust-boundary problem is valuable, and the proposed recomputation-based detector is technically intuitive: comparing sampled cached value vectors against values independently reconstructed from the protected weights and hidden state directly targets the modification introduced by the evaluated attack. The report is particularly strong in connecting the attack’s requirement for repeated per-step erasure to cumulative detection, measuring the benign numerical noise floor, testing batching and prompt-distribution shifts, and quantifying the trade-off between sampling rate and latency. The empirical separation between benign and tampered entries is impressive in the evaluated configuration.

The most important unresolved issue is the relationship between the primary threat model and the trust assumptions of the defense. The report defines the main adversary as a malicious operator with legitimate control over the runtime, but the proposed detector appears to execute within that same operator-controlled serving environment. Such an operator could disable the monitor, alter its sampling process, falsify its results, replace the recomputation inputs, or selectively apply tampering when verification is inactive. Recomputing (W_Vx_t) establishes what the cache should contain only if the weights, hidden state, detector code, random sampler, comparison result, and reporting channel are protected by an independent trust anchor. The project should therefore specify where the verifier runs and how its integrity is established—for example, through a trusted execution environment, isolated accelerator kernel, remotely attested sidecar, signed audit log, or verifier controlled by a party other than the model operator. Without such an architecture, the detector is compelling against accidental corruption or a narrowly constrained cache-writing adversary, but it does not yet close the malicious-operator trust boundary that motivates the paper.

The adaptive-attacker analysis should also be narrowed. The claim that the attacker has “no winning move” is demonstrated only for reducing the number of erased heads under the specific SCALPEL-style value-erasure attack. An adaptive adversary might instead alter the pre-projection hidden state and cache consistently, tamper with keys or later activations, modify logits or decoding, restore cache entries immediately before verification, predict or influence sampled locations, or move the intervention to another unattested state. These alternatives may or may not succeed, but they are outside the current experiment. The conclusion should be stated as “no effective sparsity-based evasion was found for the evaluated attack” unless a broader adaptive red-team evaluation is performed.

Several statistical claims also need more cautious wording. An empirical false-positive count of zero over a finite sample does not demonstrate a structurally zero false-positive rate. The paper should report a confidence bound on the true per-entry FPR and translate it into expected false alarms per request, per million tokens, and per production day. This matters because a very small per-entry error can accumulate when verification is applied repeatedly across long generations and high-throughput serving. Similarly, cumulative detection probabilities reported as 1.0 are likely rounded values rather than literal guarantees. Exact probabilities, uncertainty intervals, and the assumptions behind accumulation across decoding steps should be stated. Because hundreds of thousands of head-step measurements come from only 30 prompts, evaluation should also account for clustering and dependence within a sequence rather than treating every cache entry as an independent test example. Threshold calibration and final evaluation should ideally use separate prompts and workloads.

The production-cost argument is promising but currently partly projected rather than demonstrated. The measured 5.9% overhead is meaningful, but the claim that kernel fusion will reduce this below 1% requires an implemented fused kernel and benchmarking in a realistic serving stack. Evaluation should include continuous batching, PagedAttention or equivalent production cache management, mixed sequence lengths, concurrent users, prefill and decode throughput, and quantized FP8 or INT8 caches. The present experiments use one model, one GPU, Hugging Face Transformers, FP16 cache, and a small prompt set; therefore, claims of framework and model independence should be presented as a design hypothesis pending validation across architectures and serving systems.

The detector’s placement and timing should be explained more precisely as well. A production design needs to establish whether verification occurs after the cache write but before the cache value is consumed, how time-of-check/time-of-use manipulation is prevented, whether sampling is unpredictable to the operator, and how failures are surfaced without allowing the serving process to suppress them. These details are central to converting the strong proof of concept into an enforceable attestation mechanism.

Overall, this is a creative and technically substantive project with a clear AI-safety motivation, strong empirical results against the evaluated attack, and unusually good systems framing. Its central contribution would become considerably stronger by introducing an explicit trusted-verifier architecture, evaluating broader adaptive attacks, separating calibration from testing, reporting sequence-level confidence and operational false-alarm rates, and implementing the defense in a production serving framework rather than extrapolating from the Hugging Face proof of concept.

Scores

| Criterion | Score | Rationale |

| --------------------------------- | ------: | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

| Impact Potential & Innovation | 4.5 | Identifies a meaningful runtime integrity gap and proposes a direct, potentially deployable verification mechanism |

| Execution Quality | 3.5 | Strong proof of concept and measurements, but the malicious-operator trust model, statistical independence, adaptive attacks, and production deployment remain unresolved |

| Presentation & Clarity | 4.5 | Exceptionally clear structure, threat-model discussion, figures, and cost/detection narrative, with a few claims stated more strongly than the evidence supports |

This is a technically strong and well-motivated project. The paper identifies an important gap in current LLM serving security: KV-cache contents are safety-relevant runtime state, but existing compliance and integrity checks mostly focus on weights, hooks, inputs, outputs, or behavioral spot checks. Reframing KV-cache tampering as an “unowned trust boundary” is a clear and useful conceptual contribution.

The proposed defense is elegant: recomputing sampled value vectors from the model’s own weights and comparing them against cached values directly targets the attack surface. The empirical results are impressive, especially the near-perfect AUC, zero observed false positives under tested conditions, sequence-level detection at low sampling rates, and the latency/overhead analysis. The game-theoretic argument that reducing tampering also weakens the attack is also a strong addition.

The main area for improvement is scope and external validation. The experiments are limited to HF Transformers, one model, fp16 cache assumptions, and a relatively small prompt set. Since the claim is about production serving integrity, the paper would be much stronger with at least a minimal vLLM/PagedAttention prototype, tests on quantized KV caches, and additional model families. The “sub-1% with kernel fusion” claim is plausible but currently projected rather than demonstrated, so it should be framed more cautiously unless implemented.

The security framing is compelling, but some claims are stated very strongly. “No winning move” and “structurally zero false positives” may overstate what is proven under adaptive attackers, different kernels, quantization, batching regimes, and runtime nondeterminism. It would help to discuss adaptive attacks more explicitly, such as tampering with the exposed hidden state used for recomputation, attacking the detector path, or modifying cache values only in contexts unlikely to be sampled.

Overall, this is an innovative and high-impact technical safety project with a clear defense proposal and strong initial evidence. The next step is broader systems validation across real serving stacks and cache formats.