AxiomLimit · AI inference
The least bookkeeping a shared AI cache needs, in a model
A machine-checked proof that a shared AI cache which never leaks between customers and always reuses what it may must remember at least one bit for every pairing of a customer with a cached item, where any item can be shared with any group of customers (the lab’s “dense rights model”).
Who did this. The lab’s AI agents did the research and engineering. Nick Harris, founder. CTO of VivaMed BioPharma; co-founder of MedSim.ai, FastRead.io and Formulai. The lab’s track record.
What we showed
The permission bookkeeping is the record of who may use each cached item. The floor is at least one bit of it for every pairing of a customer with a cache block, proved for any number of customers and blocks, but only in the case where any block may be shared with any group of customers.
- Limit.
- If each block belongs to a single customer, a counting argument outside the Lean proof gives an exponentially smaller floor. The counting is the classical pigeonhole principle, which is not new.
The problem
A provider that serves many customers from one shared model cache must never hand one customer’s cached work to another, yet wants to reuse it whenever that is allowed. The question is how much permission bookkeeping that takes.
What it means for a buyer
If you build confidential AI serving on one shared model cache: this sets the least state (memory) that a leak-free, full-reuse cache must spend on remembering who may use each cached item: within the lab’s dense-rights model no design can go below it, and nothing checks that a real cache matches that model. It applies only if your cache lets a block be shared with any group of customers.
Who we expect would buy
Teams we expect would care (no customer or pilot yet): confidential-AI product teams at cloud providers that serve many customers from one shared model cache.
Why now
Published work on shared caches in AI serving: SafeKV (arXiv 2508.08438, 2025) shares cached work between customers selectively to avoid timing leaks, and a 2026 paper (Addagada, arXiv 2608.09225) describes how a cache shared across customers lets one customer reconstruct another’s private prompt by probing how fast cache hits return.
Why you can trust the check
The Lean proof checker, a tool the lab did not write, confirms that the proof follows from the lab’s model of the cache. Nothing checks that the model matches a real cache’s permission rules.
No outside firm has audited it. How this result’s check works, step by step.
What this does not show yet
- The floor holds only in the dense rights model, where any block may be shared with any group of customers. If each block belongs to a single customer, a counting argument outside the Lean proof gives an exponentially smaller floor. This page does not say which case real systems are in.
- What the Lean checker confirms is how the pieces fit together, from the counting argument to the bit count, in the lab’s statement of the cache model. The counting itself is the classical pigeonhole principle, and the lab’s statement is assumed to model a real cache’s permission rule; nothing checks that.
- It says nothing about timing or content channels.
Prior work
Named in the lab’s prior-art search for this result, and credited here.
- Selective KV-Cache Sharing to Mitigate Timing Side-Channels in LLM Inference (SafeKV), Kexin Chu, Zecheng Lin, Dawei Xiang, Zixu Shen, Jianchang Su, Cheng Chu, Yiwei Yang, Wenhui Zhang, Wenfei Wu, Wei Zhang, arXiv 2508.08438, 2025
- Governing the KV Cache: Preventing Timing Side-Channel Leakage in Multi-Tenant LLM Inference, Tejasvi C. Addagada, arXiv 2608.09225, 2026
- Succinct Posets, J. Ian Munro, Patrick K. Nicholson, arXiv 1204.1957, 2012
- Succinct data structure, Wikipedia, 2026
The exact wording, for a technical reader
The lab’s own sentences and figures for this result, word for word, its limits in plain words where the lab’s text cannot be reprinted and its formal statement: The least bookkeeping a shared AI cache needs, in a model, exact wording. The formal statements of all the results are on one page.
Check it yourself
- This result’s file: every sentence and figure on this page that is the lab’s own, copied from its current record at the commit the file names.
- The lab’s result file, copied from its codebase at the commit it names.
- The file this result’s statement is checked against (a proof, a certificate or a measurement record; the formal statements page says which).
- The formal statement, set as a formula.
- AxiomLimit, the company that carries this result.
Related results across the group
- Fixed-size memory for reordering AI network data (AxiomLimit, ai-cluster networking)
- Where deletion receipts can be fooled (AxiomLimit, ai inference)