Why can a neighbor on my inference cluster reconstruct what I just asked the model?
機会
Modern LLM serving frameworks like vLLM share KV-cache blocks across requests with matching prefixes to reduce compute cost. When multiple tenants share the same inference server, an adversary tenant can probe cache-hit and cache-miss latencies to reconstruct another tenant's private prompt. Three independent attacks published in 2025 and 2026, PROMPTPEEK, EarlyBird, and InputSnatch, demonstrate up to 100% prompt reconstruction accuracy against production-grade serving stacks. Providers can defeat this by running fully isolated instances per tenant, but that eliminates all the memory and compute savings that make shared inference economically viable. The KVGov governance paper from August 2026 proposes per-principal cryptographic cache salts as a fix, but no commercial inference provider has deployed it.
重要な理由
Shared inference is the cost model that makes AI accessible at scale, but right now it cannot safely carry any sensitive workload without full tenant isolation.
機会をどう評価するか
Opportunity Scoreは測定値ではなく、私自身の見解です。どれほど痛みを伴うか、どれほど頻繁に影響を与えるか、そして今日時点で解決策がいかに少ないか。スコアが高いほど、構築する価値が高いと私は考えています。
それが現れたときにどれほどの痛みをもたらすか。
実際にどれほど頻繁に人々がそれに直面するか。
今日時点で、それに対する優れたツールがいかに少ないか。