OptiLeak: Efficient Prompt Reconstruction via Reinforcement Learning in Multi-tenant LLM Services

2026-02-24

AI Summary

This work addresses the privacy risks posed by shared key-value caching in multi-tenant large language model services, where prompt-side channel leakage enables adversarial reconstruction of user inputs. Existing attack methods suffer from low efficiency and insufficient accuracy in risk assessment. To overcome these limitations, the authors propose OptiLeak, a novel framework that integrates reinforcement learning with Direct Preference Optimization (DPO) to reconstruct prompts through a two-stage strategy. First, it automatically identifies sensitive “hard tokens” via likelihood ranking; then, it constructs preference pairs for DPO training, eliminating the need for manual annotation and avoiding overfitting associated with supervised fine-tuning. Experiments across three benchmarks in healthcare and finance demonstrate that OptiLeak reduces the average number of queries per token by up to 12.48× compared to baselines and achieves consistent performance gains across models ranging from 3B to 14B parameters.

Technology Category

• Search and Optimization: Learning to Search
• Machine Learning: Large Multimodal Models (LMMs)
• Natural Language Processing: Safety and Robustness

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Security and Privacy: Large-scale security measurements
• Search and Retrieval-Augmented AI: Search Tool Learning with LLM: Teaching LLMs to invoke search and make use of retrieved information

Abstract

Multi-tenant LLM serving frameworks widely adopt shared Key-Value caches to enhance efficiency. However, this creates side-channel vulnerabilities enabling prompt leakage attacks. Prior studies identified these attack surfaces yet focused on expanding attack vectors rather than optimizing attack performance, reporting impractically high attack costs that underestimate the true privacy risk. We propose OptiLeak, a reinforcement learning-enhanced framework that maximizes prompt reconstruction efficiency through two-stage fine-tuning. Our key insight is that domain-specific ``hard tokens''-- terms difficult to predict yet carrying sensitive information -- can be automatically identified via likelihood ranking and used to construct preference pairs for Direct Preference Optimization, eliminating manual annotation. This enables effective preference alignment while avoiding the overfitting issues of extended supervised fine-tuning. Evaluated on three benchmarks spanning medical and financial domains, OptiLeak achieves up to $12.48\times$ reduction in average requests per token compared to baseline approaches, with consistent improvements across model scales from 3B to 14B parameters. Our findings demonstrate that cache-based prompt leakage poses a more severe threat than previously reported, underscoring the need for robust cache isolation in production deployments.

Problem

• prompt leakage
• side-channel vulnerability
• multi-tenant LLM
• Key-Value cache
• privacy risk

Innovation

• prompt leakage
• reinforcement learning
• Key-Value cache
• Direct Preference Optimization
• multi-tenant LLM