Ari Azarafrooz showed agent builders how to spot remote attacks in inference memory. His target is text and voice agents hit by prompt injection, jailbreaks and poisoned tool calls, in a talk hosted by AI Engineer.
The data is already there.
KV cache is the record of keys and values a model computes per token and reuses to avoid recomputation. Azarafrooz calls the idea KV-first security signals and pitches it as a complement to edge guardrails, not a replacement. You learn what normal pages look like for your workload, flag rare pages against that baseline, then classify them for triage. That check can run live inside the inference engine or offline against stored pages in systems like LMCache, with alerts riding alongside tool calls.
His voice test baselined 72 ordinary recordings across four voices at 16-token pages, Azarafrooz said. The detector caught a hidden spoken instruction and flagged the suspect page without reading text. On text agents, seven to eight of the top 10 alerts marked real failures, he said. That benchmark mixed benign traces with eight failure modes from injected tool text to misinformation, he said.
The hard part is production. Each model writes pages in its own coordinates, so teams must relearn baselines per model or map them into one shared space. Moving a 256-token chunk for a 1.34-billion-parameter model costs about 40 megabytes, which makes real-time streaming and compression critical, Azarafrooz said.
Intrinsec says it joined the first wave of European partners in Project QuiltWorks, the CrowdStrike-led coalition formed in April 2026 for frontier-model risk. Watch whether teams treat that memory layer as a security sensor, not just a speed trick.
