vLLM request-slot reuse carried one client’s token restriction into another request

The serving engine tracks token restrictions in shared request batches. If a departing request leaves its mask row behind during compaction, the next user may inherit a restriction it did not request. In Chainguard’s controlled demonstration, a benign victim question produced an attacker-controlled repeated word as a successful response. This is a cross-request integrity violation, not evidence that an attacker obtained another user’s prompt or private images. The model can be correct on its own yet return unsafe results because of stale harness state.

The trust violation is across request identities inside serving state, not between user prompts. Even a harmless-looking output change shows why slot compaction must clear request-specific masks before another client’s decode uses the same storage.