side-channel

A cache hit is not a trust grant

LLM serving caches the prefix and the answer, not the decision about them. What one tenant writes into the shared cache, another inherits — and the latency tells your adversary what you cached.