Discarded malicious reasoning influences later answers through reused KV cache

R2ECAP constructs a malicious earlier reasoning trace and a later seemingly legitimate continuation whose cached token representations retain that influence. When downstream queries reuse the conditioned KV cache, the initial malicious text may have been removed from the user-visible context but can still steer generation. This moves the trust problem away from the text retained in the prompt to the lineage of a derived inference artifact.

The paper reports up to 79% success for exact-query cache reuse and 16% to 46% for cross-query reuse across three tested open-weight models. These are chosen laboratory setups; commercial cross-user caching and a real tenant isolation failure are not established. Clearing visible text alone is insufficient if derived state remains reachable; cache lineage and invalidation behavior become part of the security model.

Deleting the triggering text from the visible prompt does not necessarily remove derived KV states made from that text. In the tested cache-reuse scheme, later queries inherit a contaminated representation even without replaying the original malicious sentence. The paper distinguishes exact-cache, cross-query and retrieval modes; their success rates should not be pooled or inferred as a measured cross-tenant commercial leak.