Prefix reuse needs identical state, explicit ownership, and a trust boundary

KV values depend on the causal prefix and model state, not just the tokens inside the current block. Identical local tokens after different earlier text can produce different keys and values. Use an effective identity covering the model revision or isolated model namespace, adapter configuration, token IDs, positions and attention semantics, and any nontext inputs that affect embeddings. Two images can share placeholder token IDs while containing different image features. Tokenizer and prompt-template changes can also alter the effective sequence even when a user sees similar text.

The vLLM 0.9.1 V1 design chains each full block's identity through a parent hash and includes block tokens and extra identities such as adapters, multimodal inputs, and isolation salts. Its documented prefix cache stores full blocks, so a shared prefix ending partway through a block does not automatically yield reuse of that partial block. A digest has collision assumptions; a stronger hash reduces practical collision risk rather than logically proving equality for all possible inputs. Pin the implementation and namespace policy rather than presenting one hash tuple as a universal sufficient key for every architecture.

Each request holds a logical list of physical blocks. A block shared by four active requests consumes one physical allocation while its active request-reference count is four. Finishing one request drops that count to three, not zero. Zero references can make a completed full block eligible for an idle cache, where it remains reusable until its storage is reclaimed. Thus active, cached but evictable, and physically unused are different categories. A preallocated pool may keep the same device-byte footprint while occupancy moves among all three states.

Reference counts must change consistently with allocation, cache lookup, cancellation, and completion. Protect pending kernels and transfers separately where their lifetime extends beyond a request's logical state transition; a numerical zero in a request counter alone does not prove that no device operation can read the bytes. In the cited V1 design, cache hits are touched before allocating replacement blocks so useful zero-reference hits are removed from the free queue before they could be evicted. Correct sharing requires both state equivalence and a safe ownership protocol.

Cache-hit latency can reveal whether a prefix was previously processed. Reuse within a trust group may be useful while reuse across unrelated tenants is inappropriate. The cited vLLM V1 design supports a request salt propagated through the chained key; salts must be assigned and checked consistently with the service's intended trust boundaries. Letting an untrusted caller choose another tenant's isolation value defeats that policy. Isolation reduces the relevant reuse channel but does not establish complete privacy across scheduling, network timing, logs, or every other possible side channel.

The cache lab isolates identity reuse, without ownership or security. Reset, explicitly set BOTH capacity C=4 and stride s=4, predict twelve hits at the initial sixteen requests, then Play or Step. Reset and re-set BOTH C=4 and s=2; predict zero hits because eight cyclic identities exceed capacity four. N=min(4096,16+floor(2t)); edits retain t and recompute from empty. A hit here does not verify model compatibility, a tenant boundary, a live reference, or any saved prefill computation. The experiment only shows how repeated identity and capacity jointly affect a bounded lookup.