Why can a neighbor on my inference cluster reconstruct what I just asked the model?

Modern LLM serving frameworks like vLLM share KV-cache blocks across requests with matching prefixes to reduce compute cost. When multiple tenants share the same inference server, an adversary tenant can probe cache-hit and cache-miss latencies to reconstruct another tenant's private prompt. Three independent attacks published in 2025 and 2026, PROMPTPEEK, EarlyBird, and InputSnatch, demonstrate up to 100% prompt reconstruction accuracy against production-grade serving stacks. Providers can defeat this by running fully isolated instances per tenant, but that eliminates all the memory and compute savings that make shared inference economically viable. The KVGov governance paper from August 2026 proposes per-principal cryptographic cache salts as a fix, but no commercial inference provider has deployed it.