{
  "abstract": "Per-tenant orthogonal rotation of the attention cache lets many tenants share one serving engine and one GPU while a read under the wrong key returns nothing usable. A companion paper (Paper A) measures the density this buys in a production engine. This paper is the red team. We attacked the scheme as built, in a production serving engine on two model families, under pre-registered predictions, and we report what failed.\n\nRotation preserves norms and inner products. At the first layer of the network, a stored cache row depends only on its token, so the row’s norms identify the token. With the public weights and no key, a dictionary attack reads the stored tokens at top-1 accuracy 1.000 on Moonlight (latent attention) and 0.984 to 1.00 on Qwen2.5 (key path). A co-tenant can also read another tenant’s activity and prompt length from scheduling delay, with rotation on or off. Known plaintext recovers a rotation key at about the effective dimension of the cached rows.\n\nWe then built a defence: a keyed byte layer over the stored rows, keyed per tenant, per layer, per row and per request, confined to marked spans and to the first layers, and undone by a staged copy so the stock attention kernel runs unchanged. It is bit-exact against rotation alone. A wrong key reads at chance from a memory dump, and a constant nonce reopens the attack. It costs +1.0% to +1.6% of a decode step at the marked tier, and +8.1% to +21.4% with every block in every layer, depending on the model and on scratch sizing.\n\nThe result is a clear division of labour. Rotation is a tenancy boundary and a density mechanism. Confidentiality of stored forms needs a cipher. Protection against a reader of live GPU memory needs confidential computing.\n\nCompanion paper: “Many Tenants, One Cache” (doi:10.5281/zenodo.23452278).",
  "abstract_shown": true,
  "affiliations": [],
  "article_type": null,
  "arxiv": null,
  "author_total": 1,
  "authors": [
    {
      "name": "Luis Carranza",
      "orcid": "0009-0003-3097-7779"
    }
  ],
  "bibtex": "https://research.draconitic.com/paper/7xax84d9xmdvr.bib",
  "cited_by": 0,
  "doi": "10.5281/zenodo.23452292",
  "fulltext_url": null,
  "id": "7xax84d9xmdvr",
  "issns": [],
  "landing_url": "https://zenodo.org/records/23452292",
  "language": null,
  "licence": "CC-BY-4.0",
  "licence_label": "CC BY 4.0",
  "licence_source": "article",
  "licence_url": "https://creativecommons.org/licenses/by/4.0/",
  "metadata_licence": null,
  "native_subjects": [],
  "openalex": null,
  "pdf_url": "https://zenodo.org/api/records/23452292/files/paper-b-what-rotation-leaks-v1.0.pdf/content",
  "pmcid": null,
  "pmid": null,
  "published": "2026-10-18",
  "publisher": null,
  "ris": "https://research.draconitic.com/paper/7xax84d9xmdvr.ris",
  "sources": [
    {
      "first_seen": "2026-11-01T12:21:07Z",
      "native_id": "23452292",
      "source": "zenodo",
      "url": "https://zenodo.org/records/23452292"
    }
  ],
  "subjects": [],
  "title": "What Per-Tenant Rotation Leaks: Red-Teaming a Rotated Attention Cache, and a Confined Byte Layer That Closes the Gap",
  "title_text": "What Per-Tenant Rotation Leaks: Red-Teaming a Rotated Attention Cache, and a Confined Byte Layer That Closes the Gap",
  "type": "preprint",
  "updated_at": "2026-11-01T12:21:07Z",
  "url": "https://research.draconitic.com/paper/7xax84d9xmdvr",
  "venue": "Zenodo",
  "versions": []
}