Ari Azarafrooz, founder of Intrinsec AI, proposes using an inference engine’s KV cache—the stored state it reuses across tokens—as a security signal.
Look inside the inference path
- Prompt and output checks see what enters and leaves a model. Azarafrooz proposes comparing the cache pages produced during processing with a learned baseline for ordinary traffic.
- Flag unusual pages, locate them within a request, then optionally classify the anomaly. A flagged page is a lead for inspection, not proof of an attack.
- Engine-level analysis could alert before a subsequent tool call; analysis of stored pages in a cache layer would be more useful for retrospective discovery.
What his examples show
- In a small voice-agent demonstration, hidden spoken instructions produced anomalous cache pages against a baseline of 72 ordinary clips across four voices. The selected example does not establish a general detection rate.
- In a text-agent experiment, he says roughly seven or eight of the ten highest-ranked alerts were useful anomalies on his chosen traffic. Precision among top alerts is not recall across all attacks or a production false-positive rate.
- Model upgrades and routing across different models change the cache’s representation; a detector may need per-model baselines or a shared mapping.
Where the boundary moves
- KV pages can be large and expensive to move for real-time inspection. Sampling, compression and placement within the inference stack become engineering choices.
- The cache may encode sensitive information even when plaintext prompts are not sent to a separate judge. Azarafrooz’s own example classifies personal and location data from cached features; local analysis still needs access controls and retention rules.
- Caveat: these are selected creator-presented experiments, not a reproduced attack-prevention benchmark or a reason to remove existing tool permissions and input/output checks.
“The model turns every input into a computation before it acts.” — Ari Azarafrooz