Close Enough to Be Wrong: An Adversarial Evaluation of a Semantic Cache

Automated excerpt

I aimed three attack families at it: cache poisoning (planted entries with wrong answers, including one planted through the service's own store-on-miss path), one-token boundary crossings (negation, number, entity and date swaps that leave a prompt almost identical but change its answer), and threshold probing (similarity ladders and a full threshold sweep), plus benign controls and a hand-written PAWS-style paraphrase slice. How small a change to a prompt still inherits the original's answer?

Selected automatically from source text; not independently written or fact-checked. Read the original for full context.