Hacker News

Cross-request KV cache exposure in the GLM-5.3 Workers AI model (155 responses)

86 points by wondersky 5 hours ago | 23 comments

jacquesm 58 minutes ago

This doesn't really have anything to do with GLM-5.3. This is what happens when you share models between users and don't do your bookkeeping properly, the actual model doesn't matter. What it shows is that there isn't enough isolation between the user sessions and that memory can overlap when that should never be possible.

This is an SGLANG and a Cloudflare bug long before it is a Z.AI model bug, I don't see what they could have done about it. Cloudflare should own it instead of naming other (imo innocent) parties in the title.

kflansburg 47 minutes ago

At no point do we claim that it is a bug with the model. We specifically outline how it was a mis-configuration on Cloudflare's part and a bug in SGLang. We name the model in the title because our customers need to know which of our endpoints was affected. In fact, we say "the GLM-5.3 Workers AI model", not "GLM-5.3".

jacquesm 41 minutes ago

Not buying that. You explicitly mention the model name in the title the 'GLM 5.3 workers AI model' suggests it is something specific to GLM 5.3 which it is not. You mention Sglang and are all surprised that it didn't throw an error. But the issue was yours all along.

margalabargala 26 minutes ago

Yeah, their title is absolutely implying a GLM bug to anyone who doesn't read it super closely.

There's a huge amount of unnecessary extraneous details in the headline that distract from "this is a Cloudflare bug".

literallyroy 8 minutes ago

Not sure if the title was edited but as is it is very clear to me this is a bug on their side and I have no idea how a technically literate person (someone using the model via cloudflare?) who would misinterpret given the reference to the cache.

kami23 4 hours ago

I like this RCA a lot more than most. I appreciate the ownership and clear explanation of why their testing did not catch this bug.

Also impressed with the speed to address the issue unplug the model and then pretty quick remediation, the speed to remediation matters less to me, but good to see they can act quickly on their platform to kill the serving of the model.

segmondy 3 hours ago

"We deployed GLM 5.3 with a 1,048,576-token context window, but the KV cache pool on our prefill GPUs only had room for 681,280 tokens. We were aware of this mismatch before launch. "

Did they advertise it as 1,048,576 token when they only had room for 681,280 tokens?

weird-eye-issue 2 hours ago

Next sentence: "We expected the engine to return an error for any prompt it could not process, and our long-context tests returned successful responses, so we did not believe this to be an issue."

jacquesm 38 minutes ago

Which is pointing the finger at Sglang, who also weren't responsible for this.

At a minimum someone should have realized during testing that their utilization figures are off by 40%.

A much better title would be "Cloudflare configuration error leaked data between user sessions"

segmondy 43 minutes ago

Doesn't matter, they could have marketed it as 1 million token window, you would then infer, get to 600k and get an error. You won't be able to finish your work, and you won't get credit for 600k tokens.

freakynit 2 hours ago

Bro, I had to read this sentence in the context of the previous one, 3 fcking times.. and it sill does not make any sense to me.

Graziano_M 37 minutes ago

Sounds like they are saying they tested with a long prompt and just tested for a failure, but the test likely would have seen that same KV cache leakage and just interpreted it as success.

thehamkercat 4 hours ago

Other providers probably don't even know/care that this is happening

6thbit 4 hours ago

Last year it happened to me more than once that dictating something in chatgpt would become a completely different message after processing, not in a misheard type of way but just a separate conversation more easily explained by the same type of KV cache issue here.

kami23 4 hours ago

I think in the last year I've had it happen once where I seemingly got someone else's response, it was very odd. I rewound and got what I expected. It was correlated to Anthropic's roll out of new models at the time which always seems to cause instability in their apis.

Orygin 2 hours ago

I wonder if the chatgpt shirtless guy is from the same kind of issue

kolanos 4 hours ago

Other providers might have better isolated KV stores?

jmalicki 2 hours ago

I've had this happen with ChatGPT too.

totetsu 45 minutes ago

Is anyone even offering single tenant inference as a service?

8cvor6j844qw_d6 4 hours ago

Interesting. That might explain the few times I've received completely unrelated responses from a certain provider's API.

paaloeye 2 hours ago

Is that a new class of tenant isolation vulnerability?

dnautics 55 minutes ago

Seems not? Just good old gpu allocations colliding

lianbuilds 40 minutes ago

[flagged]

0xbadcafebee 4 hours ago

I kind of forgot about the shared tenancy attack model. I think I was assuming/hoping the software was magically isolating my tokens, when in reality that's impossible for shared tenants. There's whole classes of attacks on things like shared cache, before we get to the LLM-specific features and potential bugs. Enterprises with highly sensitive data should really be on non-shared hosts.

Alex13192 3 hours ago

[flagged]