MAPID / contribution 2 / security-aware kv cache

What the cache forgets first

Generic cache compression treats every token as equally disposable, so the oldest thing goes first, and the oldest thing is the system prompt. SAKV makes trust role the eviction signal instead. The settings below are the actual deployed hyperparameters; move them and watch the policy change its mind.

The simulator

Twenty-five invocations under pressure

Each bar is the cache after one inter-agent invocation, stacked by trust role. Red marks show eviction events. The canary lives in the system prompt, so whether the gold band survives is the whole experiment.

Policy
eviction begins above thisdeployed 1024
below this, nothing is evicteddeployed 64
probe checkpoints at 5, 10, 2525 total
system prompt, carries the canary agent-derived trusted user-direct externally retrieved agent-derived untrusted

A policy simulation at the settings above, not a replay of the measured run. The recorded evaluation evicted 1,871 tokens by checkpoint 25 and held the cache near 1,450 tokens, against 100 sessions per configuration.

The signal

Eviction order is a trust ladder

Admission tags every token with a compositional trust role. An agent-generated token counts as protected only if nothing in its derivation chain was externally retrieved or user-submitted, which is what closes the laundering channel. Classification is a deterministic rule engine rather than a learned model, so the decisions are auditable.

1st
AGENT_DERIVED_UNTRUSTED
Output derived from content that was retrieved or user-submitted. First to go.
2nd
EXTERNAL_RETRIEVED
Documents, tool outputs, web pages.
3rd
USER_DIRECT
The user turn itself.
4th
AGENT_DERIVED_TRUSTED
Agent output with a clean derivation chain. Last resort.
never
SYSTEM_PROMPT
Never a candidate. Ambiguous tokens are treated as protected by default, because mis-classifying a defensive token as evictable is a safety failure while the reverse is only an efficiency cost.
Measured

Recall at the three checkpoints

Policycp 5 canarycp 10 canarycp 25 canarycp 25 sentencecp 25 decision
no-eviction1.0001.0001.0001.0001.000
FIFO1.0000.0000.0001.0001.000
SAKV1.0001.0001.0001.0000.667

The FIFO pathology has two halves. It evicts exactly once. The oldest segment is the system prompt, roughly 129 tokens carrying the canary, and once dropped it cannot be recovered. Then the protected-floor check on the next call observes that no system-trust tokens remain and refuses to evict anything further, so the cache is locked into unbounded growth. The naive policy loses the defensive context and then loses the ability to compress at all.

The 0.667 is one probe, not a trend. The dip is isolated to a single decision prompt asking for a plot summary, whose correct answer is a substantive multi-sentence response. The refusal probe and the single-fact probe both hold at 1.000 at every checkpoint. With a fixed token budget, protecting system context means evicting user and agent context, and some answers depend on the latter. SAKV protects security-relevant context; it does not protect response style.

Sentence recall is 1.000 everywhere, including under FIFO, which is worth pre-empting. The three defensive sentences are generic enough that the model regenerates them from training priors even after they were evicted. That is exactly why the canary is the load-bearing metric: it is a deterministic sixteen-word code the model cannot reconstruct from anything but the cache.

Cost and limits

The policy is not what costs you

PolicyP50 generation latencyAgainst no-eviction
SAKV3.40 s-7%
FIFO3.58 s-2%
no-eviction3.65 sreference

SAKV is the fastest of the three because its per-call prefill processes a smaller cache. The comparison does not establish that the pipeline is fast, since no configuration approaches the 500 ms target on this hardware. What it establishes is that priority-aware eviction logic costs nothing measurable against a model forward pass.

These numbers come from a prompt-layer simulation

The cache-layer integration overriding the HuggingFace cache passes its 50-test unit suite in isolation but fails end to end against the live backend with a reshape error under INT4 weights. The simulation maintains the conversation as trust-tagged segments and applies the same eviction priority at prompt assembly. The recall result transfers directly, because eviction is a segment-level decision. The latency profile does not.

One target, one traffic profile

Single model at INT4, and a synthetic filler pool of short benign questions at 30 to 60 tokens each. A real deployment with long tool outputs would exercise the policy at very different cache-size ratios per turn, which is where the threshold and floor settings would actually need tuning.