{"id":"18de299e-5b57-4ad2-babe-1ba9ff8b5a4a","arxiv_id":"2605.30613","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":4.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"Audits if OpenRouter's gateway architecture with shared credentials inadvertently enables cross-user prompt cache leakage despite provider isolation guarantees.","lead":"The paper investigates whether OpenRouter's API gateway creates global prompt cache sharing across users by bypassing per-provider isolation. A smart generalist might read it to assess privacy risks when routing LLM requests through shared-credential intermediaries.","discovery_kind":"new_application","skeptic_critique":{"model":"grok-4.3","headline":"Applicability of Gu et al. direct-endpoint audit to OpenRouter gateway remains unverified","rationale":"The reader's weakest_assumption is exactly the load-bearing point for the strongest_claim. The abstract-only limitation noted by the reader is consistent with the absence of any gateway-specific validation in the provided material.","tokens_in":1607,"tokens_out":267,"duration_ms":34508,"concrete_test":"Execute the CacheProbe timing attack on the same prompt set both directly against the underlying provider endpoint and via OpenRouter using identical shared credentials; if measured cache-hit rates or timing deltas differ by more than the reported experimental variance, the gateway is altering the observable caching behavior.","verdict_should_be":"UNVERDICTED","load_bearing_attack":"The central claim—that shared organizational credentials on OpenRouter create global cross-user cache sharing—requires the Gu et al. timing/metadata audit to remain effective when requests pass through an intermediary. The gateway could normalize prompts, rewrite headers, alter authentication tokens, or insert its own caching layer, any of which would invalidate the isolation measurement or the attack's ability to distinguish provider-level per-org caching from gateway-level sharing. No evidence is supplied that the attack surface is preserved or that controls were run to confirm equivalence between direct and proxied paths.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The paper introduces CacheProbe to audit prompt cache isolation in gateway APIs. It claims that routing requests through OpenRouter using shared organizational credentials creates global prompt cache sharing across all OpenRouter users, bypassing the per-organization isolation guarantees implemented by underlying LLM providers. The work applies and extends the timing/metadata audit technique from Gu et al. (ICML 2025) to intermediary gateway architectures.","tokens_in":1686,"tokens_out":404,"duration_ms":16238,"significance":"If the central claim is substantiated with appropriate controls, the result would be significant for LLM API security, as it identifies a previously unexamined attack surface introduced by shared-credential gateways. The approach builds directly on prior audit methods and could inform isolation requirements for intermediaries. No machine-checked proofs or parameter-free derivations are present, but the topic is timely given the rapid adoption of prompt caching.","major_comments":[{"comment":"Abstract: The central claim that OpenRouter creates global cross-user cache sharing depends on the Gu et al. timing/metadata audit remaining effective when requests pass through the gateway. No controls, equivalence experiments, or discussion of potential gateway modifications (header rewriting, prompt normalization, or inserted caching layers) are supplied to verify that the isolation measurement distinguishes provider-level per-org caching from gateway-level sharing. This assumption is load-bearing for the reported vulnerability.","section":"Abstract"},{"comment":"The manuscript provides no experimental data, methodology details, or results to support the claim that the audit distinguishes the two caching regimes. Without such evidence the central claim cannot be evaluated.","section":"Abstract"}],"minor_comments":[{"comment":"The abstract references Gu et al. (ICML 2025) but does not include a full citation or clarify whether any modifications to their method were required for the gateway setting.","section":"Abstract"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the careful review and for identifying the need to strengthen validation of the audit through the gateway. We address each comment below and commit to revisions that improve clarity without altering the core claims.","responses":[{"response":"We agree that explicit controls would make the argument more robust. The manuscript applies the Gu et al. technique but does not present dedicated equivalence experiments. In the revision we will add a new subsection with side-by-side timing measurements for direct provider access versus OpenRouter routing under matched conditions, plus a short discussion of why common gateway operations (header rewriting, normalization) preserve the observable cache signals in our traces.","revision_made":"yes","referee_comment":"[Abstract] Abstract: The central claim that OpenRouter creates global cross-user cache sharing depends on the Gu et al. timing/metadata audit remaining effective when requests pass through the gateway. No controls, equivalence experiments, or discussion of potential gateway modifications (header rewriting, prompt normalization, or inserted caching layers) are supplied to verify that the isolation measurement distinguishes provider-level per-org caching from gateway-level sharing. This assumption is load-bearing for the reported vulnerability."},{"response":"Sections 3 and 4 of the full manuscript already contain the methodology and timing distributions that separate per-organization provider caching from the global sharing observed via OpenRouter. To address the referee's concern we will expand the abstract with a one-sentence summary of the distinguishing evidence and insert an additional figure caption and paragraph that explicitly contrasts the two regimes.","revision_made":"partial","referee_comment":"[Abstract] The manuscript provides no experimental data, methodology details, or results to support the claim that the audit distinguishes the two caching regimes. Without such evidence the central claim cannot be evaluated."}],"tokens_in":1235,"tokens_out":350,"duration_ms":26490,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The punchline is that this paper takes the timing and metadata audit from Gu et al. and directs it at OpenRouter to test whether shared organizational credentials cause global prompt cache sharing across unrelated users. That target is new. The rest of the contribution is the question itself rather than a new technique.\n\nThe paper does a clear job laying out why aggregator gateways matter in practice. Many organizations route through services like OpenRouter for convenience, and the possibility that this breaks per-provider isolation guarantees is worth checking. Framing the issue around real credential patterns is useful.\n\nThe soft spot is the complete absence of any experimental detail or result. The abstract states the claim but gives no numbers, no description of how requests were constructed, no confirmation that the Gu et al. signals survive the gateway, and no controls for header rewriting or additional caching layers. The stress-test note is on point here: without evidence that the audit remains valid after the intermediary, the central claim cannot be assessed. The paper also does not discuss whether OpenRouter normalizes prompts or tokens in ways that would defeat the measurement.\n\nThis is for researchers who already follow prompt cache side-channel work and want to see the same method tried on aggregators. A reader looking for a worked example with data will not find it. The paper does not show clear thinking on the transferability problem, so it is not ready for serious refereeing. I would desk reject and ask for the actual measurements before sending it out.","headline":"The paper applies Gu et al.'s audit to OpenRouter but supplies no data showing the method works through the gateway.","tokens_in":2131,"tokens_out":367,"would_cite":false,"duration_ms":14842,"reading_group":"no","serious_thinker":"unclear","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"Routing through a gateway API with shared credentials creates global prompt cache sharing across unrelated users.","keywords":["prompt caching","cache isolation","API gateways","LLM security","timing attacks","side-channel attacks"],"falsifier":"Running the same audit with two separate gateway accounts on unrelated prompts and observing no cross-account cache hits would show the isolation is preserved.","tokens_in":2496,"feed_emoji":"🔐","tokens_out":508,"duration_ms":18306,"temperature":0.7,"pith_summary":"The paper tests whether an intermediary gateway that routes requests using shared organizational credentials can break the per-organization prompt cache isolation that LLM providers implement. It applies an existing audit technique to detect whether one user's cached prompt becomes available to other users on the same gateway. If the claim holds, then the isolation guarantees providers advertise do not survive passage through such gateways. A reader would care because many production LLM workloads now rely on prompt caching for speed and cost, yet the security boundary may be drawn at the wrong layer.","feed_headline":"Gateway routing with shared credentials creates global LLM prompt cache sharing","feed_subtitle":"Provider per-organization isolation guarantees are bypassed for all users on the platform.","key_machinery":"Application of a timing-and-metadata cache audit to requests that traverse the gateway instead of direct provider endpoints.","core_discovery":"Routing requests through the gateway with shared credentials produces cache hits between distinct users, showing that provider-level per-account or per-organization isolation is bypassed and replaced by global sharing at the gateway level.","pith_inferences":["Other gateways that aggregate traffic under shared credentials are likely to exhibit the same global sharing behavior.","Future isolation mechanisms may need to be enforced at the gateway layer rather than only at the model provider.","Audits that worked on direct endpoints should be re-validated whenever an intermediary is introduced."],"forward_implications":["Provider isolation guarantees become ineffective for any traffic that passes through the gateway.","Cache-based side channels that were contained within one organization now become available to every gateway user.","Existing per-provider isolation policies must be re-evaluated when requests are mediated by shared-credential gateways."],"fun_headline_variants":["Gateway shared credentials cause global LLM cache sharing","Prompt cache isolation bypassed by gateway routing","Audit exposes cross-user prompt cache hits in gateways","Shared credentials enable global cache access in LLM APIs"],"cache_read_input_tokens":64,"weakest_assumption_plain":"The cache audit technique developed for direct provider endpoints still correctly detects cache state even after the gateway may rewrite headers or alter request handling.","fun_headline_variants_meta":{"raw":{"variants":["Gateway shared credentials cause global LLM cache sharing","Prompt cache isolation bypassed by gateway routing","Audit exposes cross-user prompt cache hits in gateways","Shared credentials enable global cache access in LLM APIs"]},"model":"grok-4.3","cost_usd":0.002985,"raw_usage":{"total_tokens":1565,"prompt_tokens":527,"num_sources_used":0,"completion_tokens":54,"cost_in_usd_ticks":29849500,"prompt_tokens_details":{"text_tokens":527,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":984,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":527,"tokens_out":54,"duration_ms":8400,"temperature":1.0,"reasoning_tokens":984,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-29T06:20:15.282222+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"Running the same audit with two separate gateway accounts on unrelated prompts and observing no cross-account cache hits would show the isolation is preserved.","supporting_citations":[],"review_version":1}