Runtime-Instantiated Secret Loyalty: Covert Serving-State Substitution at an Unowned Trust Boundary

This is excellent work. One observation I had: your channel table treats the KV cache as not inspected. But the attack still needs code that decouples the served cache from the logged prompt, and that decoupling is the same invariant your own detector checks. So a reviewed serving path gives a partial and cheaper defense than your table would allow. Say this, and promote the compromised CI credential from one example to your central case. Additionally you can raise the audit sample above three per cell.

This paper makes a valuable systems-security contribution by distinguishing verified weights and logged prompts from the serving state actually consumed during inference. The principal-swap control, reporting of absolute decisiveness, length-matched detector test, negative low-norm experiments, and candid provenance audit are particularly strong. The central claim should remain narrowly framed as covert prompt substitution through KV state rather than a newly learned form of loyalty. The most important next step is a native serving-stack demonstration: implement the attack and verifier in vLLM or another production runtime, specify the exact compromise path that bypasses ordinary deployment review, and measure recomputation under batching, tensor parallelism, quantization, prefix reuse, and realistic nondeterminism. Detector validation should include a substantially larger clean sample, joint noise conditions, ROC analysis across multiple norms, and an explicit time-of-check/time-of-use test. Behavioral evaluation would also benefit from randomized option positions, free-generation decisions, additional models, and multiple principal swaps. The paper could be made substantially more effective by separating the primary attack-and-defense result from the exploratory audit and activation-steering studies.

Optimize Verification: Implement a cryptographic hash-matching layer for the KV cache to avoid a full compute-heavy rebuild on every request.

Dynamic Vulnerability Mapping: Probe how shifting benign system prompts alters the model's "prior standing" toward specific principals.

Harden the Data Pipeline: Secure the logging pipeline inside a trusted execution environment (TEE) to guarantee the verifier reads the exact prompt the model processed.