What it is
Distinct from INF01. INF01 is an authorization failure. INF05 is a side channel that persists even where direct access is correctly denied. Fixing one does not fix the other.
It is inherent to sharing. Eliminating cross-principal timing leakage means eliminating cross-principal sharing, which is the cache's whole purpose. The class is managed, not eliminated, and the management decision is often never made explicitly.
Variants and records
Timing leak in a shipped engine
A request that hits the cache returns its first token faster than one that misses. By timing responses, a user can tell whether someone else already sent a particular prompt.
vLLM chunk-based prefix caching, CVE-2025-46570 (GHSA-4qjh-9fv9-r85r), published 2025-05-28, fixed in 0.9.0.
Research
Academic work shows attackers can recover other users' prompts from cache timing, and proposes limiting how much sharing is allowed. These are lab results on controlled systems.
Early Bird (arXiv 2409.20002) and InputSnatch (arXiv 2411.18191) show the attacks. Selective KV-cache sharing (arXiv 2508.08438) and PrefixWall (arXiv 2603.10726v2, v1 was titled CacheSolidarity) propose defences.
One rule. Decide your cache sharing policy explicitly, and verify the isolation instead of assuming it.
Check your stack
Tests
Each test has a positive control: a condition under which it must fail. A test that cannot fail proves nothing. These are procedures. Hedgerow has not run them.
Hit versus miss timing
- Do
- Collect paired hit and miss first-token latencies from one tenant for content only another tenant sent, under idle and loaded baselines. Compare the distributions with a non-parametric test, with the method and threshold fixed before the run.
- Pass
- No significant difference at the pre-registered threshold.
- Must fail when
- Sharing is enabled across tenants. The difference must appear, or the method lacks power.
Metrics exposure
- Do
- Scrape metrics as a tenant.
- Pass
- No per-entry or per-tenant cache counters.
- Must fail when
- A build known to export them.
Policy record
- Do
- Ask for the written sharing policy.
- Pass
- It exists and names the trust domains.
- Must fail when
- No written policy exists.
Mapping to AISVS, ATLAS and CWE
| Framework | Mapping |
|---|---|
| OWASP AISVS 1.01 | Closest: 5.3.1 and 5.3.2 (a tenant must not observe another's operations through shared infrastructure or compute; 5.3.2 is level 3 and names hardware partitioning, confidential computing or dedicated compute). |
| MITRE ATLAS 5.6.0 | No technique fits well. AML.T0063 Discover AI Model Outputs is about exposed outputs, not timing. |
| CWE | CWE-208 Observable Timing Discrepancy, as assigned in the advisory. |
Controls
- Scope reuse to a trust domain rather than globally.
- Consider selective sharing for genuinely public content (system prompts, shared documents), with isolation for the rest.
- Restrict metrics granularity and access.
- Accept that timing noise is mitigation, not prevention.
What this page does not claim
- The tests have not been run by Hedgerow.
- Standards mappings reflect the versions named and may change as they do.
- A cited record shows the mechanism occurred in at least one implementation. It does not say any given system is affected.