What Per-Tenant Rotation Leaks: Red-Teaming a Rotated Attention Cache, and a Confined Byte Layer That Closes the Gap
Abstract
Per-tenant orthogonal rotation of the attention cache lets many tenants share one serving engine and one GPU while a read under the wrong key returns nothing usable. A companion paper (Paper A) measures the density this buys in a production engine. This paper is the red team. We attacked the scheme as built, in a production serving engine on two model families, under pre-registered predictions, and we report what failed.
Rotation preserves norms and inner products. At the first layer of the network, a stored cache row depends only on its token, so the row’s norms identify the token. With the public weights and no key, a dictionary attack reads the stored tokens at top-1 accuracy 1.000 on Moonlight (latent attention) and 0.984 to 1.00 on Qwen2.5 (key path). A co-tenant can also read another tenant’s activity and prompt length from scheduling delay, with rotation on or off. Known plaintext recovers a rotation key at about the effective dimension of the cached rows.
We then built a defence: a keyed byte layer over the stored rows, keyed per tenant, per layer, per row and per request, confined to marked spans and to the first layers, and undone by a staged copy so the stock attention kernel runs unchanged. It is bit-exact against rotation alone. A wrong key reads at chance from a memory dump, and a constant nonce reopens the attack. It costs +1.0% to +1.6% of a decode step at the marked tier, and +8.1% to +21.4% with every block in every layer, depending on the model and on scratch sizing.
The result is a clear division of labour. Rotation is a tenancy boundary and a density mechanism. Confidentiality of stored forms needs a cipher. Protection against a reader of live GPU memory needs confidential computing.
Companion paper: “Many Tenants, One Cache” (doi:10.5281/zenodo.23452278).
Related
- Many Tenants, One Cache: Per-Tenant Rotation of the Attention Cache in a Production Serving Engine
- GCGFormer: Geometry-Compatibility-Guided Attention for Rotated Object Detection
- RoLaQ: Joint Rotation and Range Calibration for 2-Bit KV Caches in Multi-Head Latent Attention
- A pilot-wellness-informed ecological framework for human-autonomy teaming in future fighter aviation
- Building Barricades: Red-Teaming Agentic Biosynthesis Planning
BibTeX
@misc{carranza2026what,
title = {{What Per-Tenant Rotation Leaks: Red-Teaming a Rotated Attention Cache, and a Confined Byte Layer That Closes the Gap}},
author = {Luis Carranza},
howpublished = {Zenodo},
year = {2026},
month = oct,
doi = {10.5281/zenodo.23452292},
url = {https://zenodo.org/records/23452292},
note = {CC BY 4.0},
}
RIS
TY - UNPB
TI - What Per-Tenant Rotation Leaks: Red-Teaming a Rotated Attention Cache, and a Confined Byte Layer That Closes the Gap
AU - Luis Carranza
PY - 2026
DA - 2026/10/18
PB - Zenodo
DO - 10.5281/zenodo.23452292
UR - https://zenodo.org/records/23452292
AB - Per-tenant orthogonal rotation of the attention cache lets many tenants share one serving engine and one GPU while a read under the wrong key returns nothing usable. A companion paper (Paper A) measures the density this buys in a production engine. This paper is the red team. We attacked the scheme as built, in a production serving engine on two model families, under pre-registered predictions, and we report what failed. Rotation preserves norms and inner products. At the first layer of the network, a stored cache row depends only on its token, so the row’s norms identify the token. With the public weights and no key, a dictionary attack reads the stored tokens at top-1 accuracy 1.000 on Moonlight (latent attention) and 0.984 to 1.00 on Qwen2.5 (key path). A co-tenant can also read another tenant’s activity and prompt length from scheduling delay, with rotation on or off. Known plaintext recovers a rotation key at about the effective dimension of the cached rows. We then built a defence: a keyed byte layer over the stored rows, keyed per tenant, per layer, per row and per request, confined to marked spans and to the first layers, and undone by a staged copy so the stock attention kernel runs unchanged. It is bit-exact against rotation alone. A wrong key reads at chance from a memory dump, and a constant nonce reopens the attack. It costs +1.0% to +1.6% of a decode step at the marked tier, and +8.1% to +21.4% with every block in every layer, depending on the model and on scratch sizing. The result is a clear division of labour. Rotation is a tenancy boundary and a density mechanism. Confidentiality of stored forms needs a cipher. Protection against a reader of live GPU memory needs confidential computing. Companion paper: “Many Tenants, One Cache” (doi:10.5281/zenodo.23452278).
ER -