Runtime-Instantiated Secret Loyalty: Covert Serving-State Substitution at an Unowned Trust Boundary
Lianyu Lu
A secret loyalty does not have to be trained in. We instantiate one in the
serving-layer KV cache: served weights stay bit-identical to the released
checkpoint, no training dataset exists, and the prompt log holds only a benign
system prompt — so dataset monitoring, the defence Lamerton & Roger found
effective against trained organisms, inspects an empty room.
Reusing their metrics, affordance levels and audit prompts, we find the effect
is principal-conditioned, established by a principal-swap organism rather than
a within-arm slot comparison, shifting principal probability 0.017 → 0.237.
One finding transfers beyond our setting: decisiveness tracks the principal's
prior standing with the model, not injection strength — the same injection is
merely relative for a principal the model rates poorly and decisive for one it
already favours.
We separate two axes a trained-loyalty setup conflates: a cache buys
artifact-invisibility, not interrogation resistance. Our defence recomputes the
cache from the logged prompt inside a trusted verifier; the cheap length check
is trivially evaded and recompute is the load-bearing one. Two token-free
attack families failed under four controls and are reported as failures.
This paper makes a valuable systems-security contribution by distinguishing verified weights and logged prompts from the serving state actually consumed during inference. The principal-swap control, reporting of absolute decisiveness, length-matched detector test, negative low-norm experiments, and candid provenance audit are particularly strong. The central claim should remain narrowly framed as covert prompt substitution through KV state rather than a newly learned form of loyalty. The most important next step is a native serving-stack demonstration: implement the attack and verifier in vLLM or another production runtime, specify the exact compromise path that bypasses ordinary deployment review, and measure recomputation under batching, tensor parallelism, quantization, prefix reuse, and realistic nondeterminism. Detector validation should include a substantially larger clean sample, joint noise conditions, ROC analysis across multiple norms, and an explicit time-of-check/time-of-use test. Behavioral evaluation would also benefit from randomized option positions, free-generation decisions, additional models, and multiple principal swaps. The paper could be made substantially more effective by separating the primary attack-and-defense result from the exploratory audit and activation-steering studies.
This is excellent work. One observation I had: your channel table treats the KV cache as not inspected. But the attack still needs code that decouples the served cache from the logged prompt, and that decoupling is the same invariant your own detector checks. So a reviewed serving path gives a partial and cheaper defense than your table would allow. Say this, and promote the compromised CI credential from one example to your central case. Additionally you can raise the audit sample above three per cell.
Optimize Verification: Implement a cryptographic hash-matching layer for the KV cache to avoid a full compute-heavy rebuild on every request.
Dynamic Vulnerability Mapping: Probe how shifting benign system prompts alters the model's "prior standing" toward specific principals.
Harden the Data Pipeline: Secure the logging pipeline inside a trusted execution environment (TEE) to guarantee the verifier reads the exact prompt the model processed.
Cite this work
@misc {
title={
(HckPrj) Runtime-Instantiated Secret Loyalty: Covert Serving-State Substitution at an Unowned Trust Boundary
},
author={
Lianyu Lu
},
date={
},
organization={Apart Research},
note={Research submission to the research sprint hosted by Apart.},
howpublished={https://apartresearch.com}
}
