这篇论文揭示了LLM API中继路径中的缓存隔离漏洞，测试了五个开源网关，提出了防御契约。
KeyPooling是一种测量方法，可追踪客户身份通过缓存查找和写入的路径。研究测试了五个连接OpenAI和Anthropic的开源网关，发现默认情况下没有将客户绑定到上游凭据。在共享凭据下，所有五个网关都暴露了跨客户的缓存读取，覆盖了OpenRouter框架中33.7%的令牌量。研究确定了控制身份转换的关键因素，包括主体分割、命名空间关联和适配器对比。
KeyPooling: Measuring Where LLM API Relay Paths Collapse Prompt Cache Isolation
Large language model (LLM) API relays authenticate customers separately but often forward requests through shared provider credentials. Providers scope prompt caches to upstream principals and namespaces, so relay customers mapped to one cache identity can observe each other's cache state. Prior work showed cache sharing at selected endpoints but did not identify which credential, pool, adapter, or nested hop controls the finalidentity. We present KeyPooling, a measurement method that traces customer identity through cache lookup and write, verifies runtime transformations, and tests one predicted identity component at a time. Across five open-source gateways connected to OpenAI and Anthropic, none bound customers to upstream credentials by default; under a shared credential, all five exposed cross-customer cache reads for both providers. Principal and namespace splits, pool associations, and adapter and nested-relay contrasts localized the controlling transformations. In an outcome-independent weekly OpenRouter frame, tests covered 80.5% of eligible token volume and found cross-account reads for 12 of 28 labels carrying 33.7% of volume. On one production route, a controlled procedure recovered eight consecutive target positions without target access. Broader tests identify cache granularity, routing, rate limits, attribution, and budget as conditions for token-by-token recovery, not security controls. We derive a defense contract: every customer must enter a provider-enforced domain, or a namespace derived from authenticated identity must survive every final cache lookup and write. Placing this split after reusable public prefixes preserved most modeled reuse at a 1.7-2.5% cost increase.