---
格式版本: 2
标题: "KeyPooling: Measuring Where LLM API Relay Paths Collapse Prompt Cache Isolation"
原文链接: "https://arxiv.org/abs/2608.17485"
发布日期: "2026-08-18"
发布时间校准状态: "found"
发布时间需复核: "否"
发布时间来源: "rule:local:strict_original_body"
发布时间证据: "**\\[v1\\]** Tue, 18 Aug 2026 08:12:34 UTC (242 KB)"
发布时间校准原因: "规则确认唯一严格发布时间，来源 local:strict_original_body"
发布时间校准置信度: "high"
发布时间候选数量: 18
发布时间严格候选数量: 6
发布时间原页读取状态: "source template page reused from URL open"
发布时间未找到原因: ""
发布时间校准时间: "2026-08-20T15:09:44+08:00"
发布时间仲裁状态: "skipped"
发布时间仲裁尝试次数: 0
发布时间仲裁耗时毫秒: 0
发现时间: "2026-08-20T15:03:44+08:00"
入库时间: "2026-08-20T07:09:44.861Z"
来源平台: "arXiv 学术论文搜索"
搜索渠道: "source_template"
搜索词: "https://arxiv.org/search/?query=OpenAI&searchtype=all"
匹配关键词:
  []
相关厂家:
  - "OpenAI"
相关专家:
  []
内容类型: "网页"
抓取工具: "Free Fetch + Defuddle"
清洗工具: "Defuddle Markdown + Defuddle/Readability 正文提取"
原始附件:
  []
AI优质: "否"
AI打分: 16
AI分档: "非优质"
AI质检状态: "不通过"
AI打分理由: "该 arXiv 论文主题为 LLM API 中继的 prompt cache 隔离安全测量，与超节点/AI Rack/机柜级基础设施、供电、液冷、高速互连等均无关联，仅因搜索词 OpenAI 出现，明显无关。"
AI质检模型: "ali-deepseek-v4-flash"
AI质检时间: "2026-08-20T15:10:42+08:00"
AI主题相关性: 2
AI来源权威性: 6
AI新颖性: 2
AI技术细节: 2
AI商业部署信号: 0
AI完整性: 4
AI摘要: "KeyPooling 是一种测量 LLM API 中继路径提示缓存隔离失效的方法。研究发现，五个开源网关连接 OpenAI 和 Anthropic 时，默认均未将客户绑定到上游独立凭证，在共享凭证下都会产生跨客户缓存读取；"
AI摘要模型: "ali-deepseek-v4-flash"
AI摘要时间: "2026-09-07T03:21:53.350Z"
采集批次: "2026年8月20日14点19分32秒"
采集批次ID: "20260820-141932-079"
去重键: "https://arxiv.org/abs/2608.17485"
---

## Computer Science > Cryptography and Security

## Title:KeyPooling: Measuring Where LLM API Relay Paths Collapse Prompt Cache Isolation

Authors:[Bowen Sun](https://arxiv.org/search/cs?searchtype=author&query=Sun,+B), [Yixi Cai](https://arxiv.org/search/cs?searchtype=author&query=Cai,+Y), [Xiaogeng Liu](https://arxiv.org/search/cs?searchtype=author&query=Liu,+X), [Zhengyue Zhao](https://arxiv.org/search/cs?searchtype=author&query=Zhao,+Z), [Yinzhi Cao](https://arxiv.org/search/cs?searchtype=author&query=Cao,+Y), [Chaowei Xiao](https://arxiv.org/search/cs?searchtype=author&query=Xiao,+C)

[View PDF](https://arxiv.org/pdf/2608.17485) [HTML (experimental)](https://arxiv.org/html/2608.17485v1)

> Abstract:Large language model (LLM) API relays authenticate customers separately but often forward requests through shared provider credentials. Providers scope prompt caches to upstream principals and namespaces, so relay customers mapped to one cache identity can observe each other's cache state. Prior work showed cache sharing at selected endpoints but did not identify which credential, pool, adapter, or nested hop controls the finalidentity. We present KeyPooling, a measurement method that traces customer identity through cache lookup and write, verifies runtime transformations, and tests one predicted identity component at a time. Across five open-source gateways connected to OpenAI and Anthropic, none bound customers to upstream credentials by default; under a shared credential, all five exposed cross-customer cache reads for both providers. Principal and namespace splits, pool associations, and adapter and nested-relay contrasts localized the controlling transformations. In an outcome-independent weekly OpenRouter frame, tests covered 80.5% of eligible token volume and found cross-account reads for 12 of 28 labels carrying 33.7% of volume. On one production route, a controlled procedure recovered eight consecutive target positions without target access. Broader tests identify cache granularity, routing, rate limits, attribution, and budget as conditions for token-by-token recovery, not security controls. We derive a defense contract: every customer must enter a provider-enforced domain, or a namespace derived from authenticated identity must survive every final cache lookup and write. Placing this split after reusable public prefixes preserved most modeled reuse at a 1.7-2.5% cost increase.

| Subjects: | Cryptography and Security (cs.CR) |
| --- | --- |
| Cite as: | [arXiv:2608.17485](https://arxiv.org/abs/2608.17485) \[cs.CR\] |
|  | (or [arXiv:2608.17485v1](https://arxiv.org/abs/2608.17485v1) \[cs.CR\] for this version) |
|  | [https://doi.org/10.48550/arXiv.2608.17485](https://doi.org/10.48550/arXiv.2608.17485) |

## Submission history

From: Bowen Sun \[[view email](https://arxiv.org/show-email/0cbe2bdc/2608.17485)\]  
**\[v1\]** Tue, 18 Aug 2026 08:12:34 UTC (242 KB)

[Which authors of this paper are endorsers?](https://arxiv.org/auth/show-endorsers/2608.17485) | Disable MathJax ([What is MathJax?](https://info.arxiv.org/help/mathjax.html))