What Per-Tenant Rotation Leaks: Red-Teaming a Rotated Attention Cache, and a Confined Byte Layer That Closes the Gap

Per-tenant orthogonal rotation of the attention cache lets many tenants share one serving engine and one GPU while a read under the wrong key returns nothing usable. A companion paper (Paper A) measures the density this buys in a production engine. This paper is the red team. We attacked the scheme as built, in a production serving engine on two model families, under pre-registered predictions, and we report what failed.

Rotation preserves norms and inner products. At the first layer of the network, a stored cache row depends only on its token, so the row’s norms identify the token. With the public weights and no key, a dictionary attack reads the stored tokens at top-1 accuracy 1.000 on Moonlight (latent attention) and 0.984 to 1.00 on Qwen2.5 (key path). A co-tenant can also read another tenant’s activity and prompt length from scheduling delay, with rotation on or off. Known plaintext recovers a rotation key at about the effective dimension of the cached rows.

We then built a defence: a keyed byte layer over the stored rows, keyed per tenant, per layer, per row and per request, confined to marked spans and to the first layers, and undone by a staged copy so the stock attention kernel runs unchanged. It is bit-exact against rotation alone. A wrong key reads at chance from a memory dump, and a constant nonce reopens the attack. It costs +1.0% to +1.6% of a decode step at the marked tier, and +8.1% to +21.4% with every block in every layer, depending on the model and on scratch sizing.

The result is a clear division of labour. Rotation is a tenancy boundary and a density mechanism. Confidentiality of stored forms needs a cipher. Protection against a reader of live GPU memory needs confidential computing.

Companion paper: “Many Tenants, One Cache” (doi:10.5281/zenodo.23452278).