Zhifan Luo (罗志凡)

I am currently a final-year Master’s student in Cyberspace Security at Zhejiang University, advised by Prof. Zhan Qin. I am also a member of the State Key Laboratory of Blockchain and Data Security. Previously, I received my B.S. degree in College of Computer Science and Technology, Zhejiang University in 2023.

My research interests lie at the intersection of Large Language Model (LLM) Security and Machine Learning Systems (MLsys). I am particularly interested in identifying and mitigating privacy risks in modern inference systems, with a specific focus on KV-Cache privacy, side-channel analysis, and endogenous security mechanisms.

Please feel free to reach out via email at luozf0105[AT]gmail[DOT]com if you are interested in my research.

News

Nov 29, 2025	Our paper “Shadow in the Cache: Unveiling and Mitigating Privacy Risks of KV-cache in LLM Inference” has been accepted to NDSS 2026! 🎉

Selected Publications

NDSS 2026

Shadow in the cache: Unveiling and mitigating privacy risks of kv-cache in llm inference

Zhifan Luo, Shuo Shao, Su Zhang, Lijing Zhou, Yuke Hu, Chenxu Zhao, Zhihao Liu, and Zhan Qin

The Network and Distributed System Security (NDSS) Symposium, 2026

The Key-Value (KV) cache, which stores intermediate attention computations (Key and Value pairs) to avoid redundant calculations, is a fundamental mechanism for accelerating Large Language Model (LLM) inference. However, this efficiency optimization introduces significant yet underexplored privacy risks. This paper provides the first comprehensive analysis of these vulnerabilities, demonstrating that an attacker can reconstruct sensitive user inputs directly from the KV-cache. We design and implement three distinct attack vectors: a direct Inversion Attack, a more broadly applicable and potent Collision Attack, and a semantic-based Injection Attack. These methods demonstrate the practicality and severity of KV-cache privacy leakage issues. To mitigate this, we propose KV-Cloak, a novel, lightweight, and efficient defense mechanism. KV-Cloak uses a reversible matrix-based obfuscation scheme, combined with operator fusion, to secure the KV-cache. Our extensive experiments show that KV-Cloak effectively thwarts all proposed attacks, reducing reconstruction quality to random noise. Crucially, it achieves this robust security with virtually no degradation in model accuracy and minimal performance overhead, offering a practical solution for trustworthy LLM deployment.