Black Hat Asia 2026 | Cache Me, Catch You: Exploiting LLM Caching Layers in vLLM, GPTCache & Friends

Large language models (LLMs) are now embedded in every cloud, SOC, and product team—but almost nobody is looking at the “boring” cache layer that keeps them fast. In this Briefing, we will show how that invisible layer becomes a powerful offensive entry point.

Modern serving stacks such as vLLM, SGLang, GPTCache and commercial gateways aggressively cache prefixes, multimodal features, and semantic embeddings to save GPU time. We performed a systematic teardown of these caching implementations and found that performance shortcuts—non‑cryptographic hashes, lossy serialization, and fuzzy similarity matching—open a brand‑new attack surface during inference, not training.

We will walk through six practical attack primitives: system‑prompt hash collisions that silently rewrite assistant instructions for every tenant sharing a cache; block‑wise collisions that make entire malicious blocks “invisible” to the model; multimodal collisions that let a weaponized image inherit a benign cache entry and pass content moderation; and two forms of semantic fuzzy poisoning that turn customer‑support or RAG pipelines into a misinformation delivery channel. Each attack costs under one US dollar to run and, in our experiments, reached up to 100% cache‑hit rate for targeted prompts and 75% poisoned‑hit rate against popular semantic caches.

We then flip to the defender’s perspective. Based on real patches and CVEs issued by major frameworks, we show what actually works in production: salted and cryptographic prefix hashes, canonical serialization for images and tensors, safer cache isolation in multi‑tenant deployments, and cheap LLM‑based filters that sit in front of semantic caches to kill poisoned hits before users see them. Attendees will leave with a concrete checklist they can apply to their own LLM APIs, gateways, and “AI platform” teams to stop cache‑layer abuses before attackers get there first. We will release PoC tooling that operators can immediately run against their own stacks to detect vulnerable deployments.

Xiangfan Wu | Student, Ocean University of China and Tencent Zhuque Lab
Lingyun Ying | Researcher, QI-ANXIN Technology Research Institute
Guoqiang Chen | Security Researcher, QI-ANXIN Technology Research Institute
Yacong Gu | Postdoctoral Researcher, Tsinghua University
Haipeng Qu | Professor, Ocean University of China

https://blackhat.com/asia-26/briefings/schedule/?#cache-me-catch-you-exploiting-llm-caching-layers-in-vllm-gptcache-amp-friends-on-demand-only-51113Black HatRead More