LLM08: add authorization-scoped semantic-cache controls

[LiorVakninCy]

Summary

This Draft PR updates only 2026/working/LLM08_VectorAndEmbeddingWeaknesses.md.

LLM08 already covers semantic-cache poisoning and embedding-based key collisions. This change adds a related authorization failure: a semantic cache can return a response generated under one tenant, user, or role to a requester operating under a different authorization scope.

This can occur even when retrieval authorization is implemented correctly. A cache hit can bypass retrieval and generation, preventing those controls from executing.

No files under 2026/final/ are changed.

Why This Belongs in LLM08

The failure depends on embedding similarity being used as fuzzy cache identity. A requester does not necessarily need an exact cache key: a semantically equivalent request from a different authorization scope can exceed the cache-hit threshold and receive an existing response.

This is distinct from:

• LLM02 Sensitive Information Disclosure, which describes the resulting confidentiality impact.
• LLM08 Risk README: update Slack channel to #team-genai-top-10-llm #1, which covers inference through scores, counts, timing, or other shared-index behavior.
• Prompt injection, because neither request needs to contain malicious instructions.
• Ordinary exact-key cache leakage, because the authorization failure occurs within similarity-based matching.

Changes

• Expands Risk Adding new entry proposal as Supply Chain Trust Failure #6 from semantic-cache poisoning to include cross-scope cache collisions.
• Clarifies that adding identity or namespace text before embedding is not an authorization control.
• Requires exact, server-derived tenant and authorization-scope predicates.
• Requires cache-hit authorization validation and security-context invalidation.
• Adds cache-specific security telemetry.
• Adds one reproduced cross-user attack scenario.
• Adds references to the reproduced vLLM failure and Microsoft implementation guidance.
• Adds CWE-524, Use of Cache Containing Sensitive Information.

Evidence

vLLM Semantic Router PR #2135 documents a reproduced cross-user cache leak:

• Alice populated the semantic cache.
• Bob submitted the same long request under a different resolved user scope.
• Bob's request matched Alice's entry with similarity 0.9085, exceeding the configured 0.8 threshold.
• Bob received Alice's byte-identical cached response.
• The merged fix introduced a hard scope gate independent of embedding similarity.

Microsoft's semantic-cache policy documentation directs implementations to control cross-user cache access using specific user or user-group identifiers.

Existing LLM08 references #16 and #17 establish the broader semantic-cache poisoning and key-collision attack surface.

Review Status

This change has not yet been reviewed by the LLM08 sub-team. Requesting scope and technical review from @S3DFX-CYBER and @arshi016.

Cross-Entry Impact

LLM02 Sensitive Information Disclosure is conceptually related because successful exploitation results in unauthorized disclosure. No LLM02 change is proposed. The root cause remains in LLM08: similarity-based cache lookup is allowed to override authorization separation.

Open Question

This Draft PR intentionally targets 2026/working/LLM08_VectorAndEmbeddingWeaknesses.md, with no 2026/final/ change. Please confirm whether the working entry still accepts substantive Track B upgrades or whether an equivalent follow-up should target the canonical final entry.

Validation

• Changes one file only.
• Makes no changes under 2026/final/.
• Preserves the existing entry structure and heading levels.
• Keeps references sequential from README: update Slack channel to #team-genai-top-10-llm #1 through CI: add entry conformance check + commit existing markdown-lint workflow #22.
• Defines HMAC on first use.
• Uses a reproduced implementation failure, vendor implementation guidance, and a directly applicable CWE.
• Passes git diff --check.
• Contains no executable code or offensive proof-of-concept payload.

[rocklambros]

Thanks for the detailed writeup and for grounding it in the reproduced vLLM Semantic Router case, @LiorVakninCy.

Closing this one. The 2026 entries are locked ahead of release, so we are not taking further substantive content changes into LLM08 for this cycle. That also answers the open question you raised at the end of the description: neither the working entry nor the final entry is accepting Track B upgrades right now.

The gap you identified is real. A cache hit short-circuiting retrieval and generation means document-level authorization never runs, and the point about an embedded namespace prefix not being an authorization boundary is well made. Please bring this back for the next cycle and we will route it to the LLM08 leads for scope and technical review then. The branch and the evidence stay useful as-is.

[S3DFX-CYBER]

Agreeable over @rocklambros point, these changes can be added in the next cycle
Thanks for your efforts @LiorVakninCy