Scheduled KV Injection in LLM Systems

• Scheduled KV Injection is a mechanism that explicitly schedules when and which key–value state is made available, ensuring efficient cache reuse and controlled data transfer.
• It enables techniques such as zero-copy reuse, cross-device handoff, and quantized transfers to reduce prefill cost and latency during decoding.
• The approach also addresses security and multi-agent orchestration challenges by regulating state exposure and strengthening defenses against adversarial attacks.

Searching arXiv for the cited papers and related usage of “scheduled KV injection.” arxiv_search(query="Scheduled KV Injection RedVisor (Liu et al., 2 Feb 2026)", max_results=5) Scheduled KV Injection denotes a family of mechanisms in which key–value state is introduced, retained, moved, or written according to an explicit schedule rather than being recomputed or exposed only through default sequential execution. Across recent work, the term is used in several related but non-identical senses: zero-copy reuse of attention KV pages across defense phases in LLM serving, scheduler-controlled writes into another agent’s persistent memory store, per-step materialization of logical KV histories beneath static-graph decoders, page-aware decode scheduling on commodity GPUs, cloud-to-edge injection of streamed KV chunks during prefill, quantized KV handoff across agents, per-layer control-memory injection in text-to-motion, graph-governed cross-segment attention, and timed adversarial continuation from a compromised KV cache (Liu et al., 2 Feb 2026).

1. Terminology and semantic range

The literature does not use “Scheduled KV Injection” in a single narrow sense. Instead, it names a recurrent design pattern: a scheduler decides when, which, and where KV state becomes visible to a downstream computation or persistent read path. In some papers the object being injected is an attention cache page; in others it is a persistent key–value record in an agent datastore; in still others it is an auxiliary memory appended to self-attention.

Setting	Injected object	Scheduling axis
LLM serving and runtime systems	Backbone KV pages, page descriptors, staged DMA trains, streamed or quantized KV chunks	Phase boundary, decode step, row–KV-head–split task, hop boundary (Liu et al., 2 Feb 2026)
Multi-agent orchestration	Persistent key–value memory items in another agent’s datastore	Cron-dispatched execution context (Liu, 3 Jun 2026)
Attention-side control and structure	Control-conditioned K/V pseudo-tokens or source-segment KV caches	Layer, frame, graph edge, refinement step (Sun et al., 4 Jun 2026)
Privacy attacks	Crafted continuation tokens that exploit cached K/V	Chosen injection timestep after interception (Luo et al., 13 Aug 2025)

This suggests a common abstraction: scheduled KV injection governs exposure of latent state that already exists or can be prepared ahead of use. The substantive differences lie in whether the state is transient or persistent, whether the schedule is defensive or adversarial, and whether injection is realized as cache reuse, page-table edits, datastore writes, or appended attention memory.

2. Zero-copy reuse and serving-engine scheduling

In RedVisor, scheduled KV injection is functionally equivalent to zero-copy KV cache reuse across a two-phase prompt-injection defense pipeline. Phase 1 constructs $x_1 = [I_{\text{sys}}, I_{\text{user}}, C]$, activates a removable top-layer adapter, prefills the frozen backbone, and decodes a reasoning trace $R$ that localizes the injection and encodes reject conditioning. The phase transition then appends a transition instruction $I_{\text{trans}}$, mutes the adapter by setting $\alpha \leftarrow 0$, and continues decoding with the existing backbone KV for $x_1 \oplus R$ rather than issuing a second prefill. The paper states that the “injection” is therefore a scheduling decision: carry forward the Phase-1 KV blocks as the Phase-2 prefix and switch only the adapter’s gate, not the memory (Liu et al., 2 Feb 2026).

The architectural precondition for that reuse is strict invariance of the backbone KV. RedVisor places the adapter only at the top layer, in parallel to the frozen backbone residual, with fused output

$$h_{\text{out}} = h_{\text{in}} + M \odot f_A(h_{\text{in}}).$$

In Phase 2, $M = 0$, so the top-layer forward reduces to the original backbone path. The paper therefore argues that benign backbone utility is mathematically preserved, with output changes arising only from the additional context tokens $R$ and $I_{\text{trans}}$. The same design also keeps backbone K/V at all preceding layers unchanged, which is what makes Phase-1 caches reusable during Phase-2 decoding.

The systems realization is tightly coupled to the serving engine. RedVisor integrates with vLLM’s PagedAttention, pins KV page lists across the phase boundary, fuses both phases into a single atomic request, uses vectorized masking to preserve CUDA-graph topology, and detects the transition trigger by a tail-anchored on-GPU token-pattern search over the last $N$ tokens. In the complexity model, the decoupled baseline is

$R$0

whereas RedVisor uses

$R$1

The reported consequence is that prefill cost is halved, inter-device communication is eliminated, and TTFT for response generation is typically halved. On NQ-simplified with 1,000 RAG queries, RedVisor processes more than $R$2 faster than its decoupled variant, while the adapter adds about 70M parameters atop a 7–8B backbone and the total memory footprint remains $R$3 rather than $R$4 (Liu et al., 2 Feb 2026).

KV-RM uses the term differently but within the same systems lineage. There, scheduled KV injection is the per-step mechanism that turns a dynamic logical KV history into the exact KV bytes “injected” into a fixed-shape static attention kernel. KV-RM decouples logical history from physical storage, uses pager verbs RESERVE, ALIAS, TRIM, and FRAME, and commits all mapping edits for step $R$5 via a single descriptor swap. The committed descriptor is then converted into a small number of burst-friendly DMA trains before the fixed-shape kernel consumes them. This constrains runtime variability to mapping edits and transport, not kernel shape. On a 2-GPU NVIDIA A100 node, KV-RM reports 1200 tok/s and 24.5 ms p99 versus a static-graph baseline at 960 tok/s and 35.0 ms p99, reduces reserved KV memory from 36.9 GiB to 27.0, 23.8, and 21.0 GiB across workload families, and removes severe burst-time latency spikes under production-trace replay (Zhong et al., 10 May 2026).

3. Page-aware, cross-device, and quantized injection paths

PersistentKV extends scheduled KV injection into page-aware decode scheduling for grouped-query attention. It frames decode as an IO-dominated, page-scheduled workload in which injecting, cloning, or migrating KV pages should be treated as page-aware tasks interleaved with decode attention. The engine stores K and V as page-major tensors with page size 16, uses $R$6, $R$7, $R$8, and $R$9, and assigns CTAs over $I_{\text{trans}}$0. A compact workqueue emits only non-empty row–KV-head–split tasks, and a merge kernel combines exact online-softmax states across splits. The adaptive policy is calibrated on one trace seed and held out on another: for $I_{\text{trans}}$1, PersistentKV length bucket with sequence splitting (split = 32); for $I_{\text{trans}}$2 and $I_{\text{trans}}$3K, PersistentKV workqueue with trace-family-specific split counts; otherwise FlashInfer native-paged decode. On an RTX 3060 with FP16, the held-out seed improves synchronized wall throughput by 1.063–1.265$I_{\text{trans}}$4 on B8 bimodal, uniform, and Zipf-like workloads, and by 1.399$I_{\text{trans}}$5 on a B1 bucketed trace; on the B4 bimodal boundary case, the policy explicitly routes back to FlashInfer to avoid the PersistentKV regression (Ahmed, 25 Jun 2026).

SparKV treats scheduled KV injection as on-device placement of precomputed K and V tensors streamed from the cloud directly into the edge device’s KV cache during the prefill window, overlapped with local recomputation of chunks that are cheaper to compute than to stream. The system partitions reusable context into 1024-token chunks $I_{\text{trans}}$6, maintains a streaming queue $I_{\text{trans}}$7 and a compute-ready queue $I_{\text{trans}}$8, estimates per-chunk streaming latency as

$I_{\text{trans}}$9

estimates compute latency with a hybrid predictor over features $\alpha \leftarrow 0$0, and minimizes a stage-wise makespan objective in which streaming and local computation overlap within each stage. Runtime refinement then migrates chunks between the streaming and compute plans when bandwidth or GPU headroom deviates from profile. Across diverse datasets, LLMs, and edge devices, SparKV reports TTFT reductions of 1.3$\alpha \leftarrow 0$1–5.1$\alpha \leftarrow 0$2 with negligible impact on response quality and per-request energy reductions of 1.5$\alpha \leftarrow 0$3 to 3.3$\alpha \leftarrow 0$4 (Liu et al., 23 Apr 2026).

QKVShare relocates scheduled KV injection to multi-agent on-device handoff. Its injection path reconstructs FP16 past_key_values from a self-contained CacheCard carrying quantized groups, metadata, and token-level bit widths $\alpha \leftarrow 0$5. The controller scores each token with

$\alpha \leftarrow 0$6

then allocates mixed precision under a bit budget. On the receiver, dequantized groups are assembled into HuggingFace-compatible past_key_values and generation resumes without re-prefill. Median TTFT is reported as 130.7 ms versus 150.2 ms at nominal 1K context, 152.5 ms versus 565.3 ms at 4K, and 397.1 ms versus 1029.7 ms at 8K for QKVShare uniform Q4 handoff versus FP16 re-prefill. Stage timing shows that post-injection generation dominates the latency path: create-card / inject / generate medians are 4.4 / 13.8 / 112.4 ms at 1K, 21.0 / 17.8 / 113.7 ms at 4K, and 71.3 / 92.8 / 232.9 ms at 8K. Under repeated handoff on 150 GSM8K problems, adaptive quantization shows its clearest gains against uniform quantization in deeper-hop, higher-budget settings, with topology-aware Q8 reaching 82.67% at 5 hops versus 71.33% for uniform Q8 (Honavar et al., 5 May 2026).

Taken together, these systems papers shift the meaning of injection from “append tokens to a prefix” toward “make the right KV bytes visible at the right boundary.” The scheduling boundary may be a phase transition, a decode step, a row–head–split task, a networked prefill stage, or a multi-agent handoff.

4. Security, safety, and adversarial scheduling

Scheduled KV injection has both defensive and offensive meanings in security work. In RedVisor, the injected state is a reasoning trace $\alpha \leftarrow 0$7 produced in Phase 1 and then reused as context in Phase 2, where it acts as a natural-language guardrail while the adapter is muted. The reported safety effect is that on Alpaca-Farm and NQ, Attack Success Rate drops near zero for standard and adaptive (GCG) attacks, detection localization metrics such as ROUGE-L and ES are high, and AlpacaEval 2.0 shows near-baseline win rates for benign tasks. Ablations indicate that removing the FFN degrades detection on complex attacks and raises ASR, while removing the gate reduces training stability; KV reuse remains a fixed benefit across ablations so long as the adapter stays top-layer and muted in Phase 2 (Liu et al., 2 Feb 2026).

In the privacy literature, “scheduled” denotes a timed adversarial continuation from an intercepted KV state. “Shadow in the Cache” studies three attacks against plaintext KV caches: a direct inversion attack, a collision attack, and an injection attack. The injection attack appends a crafted instruction token, computes a new query against the compromised cache, and uses the model’s own semantics to echo or summarize sensitive content. The paper notes that it does not explicitly use the word “scheduled,” but the attack naturally extends to choosing specific timesteps $\alpha \leftarrow 0$8 at which to append instruction tokens such as “Repeat the previous content.” or “Summarize the previous content.” The reported injection fidelity is lower than collision but operationally cheap: average BERTScore is about 0.58 and ROUGE-L about 0.42, with a single forward decoding step rather than iterative search (Luo et al., 13 Aug 2025).

The same paper proposes KV-Cloak as a defense. Its fused obfuscation writes

$\alpha \leftarrow 0$9

with analogous handling for $x_1 \oplus R$0, where one-time permutation, additive positional masking, and reversible matrix transforms preserve attention semantics while rendering cached state unintelligible to the attacker. Empirically, KV-Cloak reduces attack outputs to random noise, with BERTScore about 0.03–0.11 and ROUGE-L about 0.00–0.04 across models and layers; collision distributions collapse to 0% per-token success. Accuracy is reported as virtually lossless on benchmark tasks, for example LLaMA-3.1-8B MMLU 0.668 $x_1 \oplus R$1 0.668 and SQuAD 0.708 $x_1 \oplus R$2 0.709, while latency overhead on MMLU is about 2.9%–10.16%, averaging about 5% (Luo et al., 13 Aug 2025).

A plausible implication is that scheduled KV injection is security-relevant whenever a system externalizes or reuses latent state across phases, agents, or devices. The same scheduling machinery that removes redundant prefill or enables handoff can enlarge the attack surface unless cache exposure, authorization, and continuation paths are explicitly constrained.

5. Scheduled writes to persistent agent memory

Outside attention kernels, scheduled KV injection denotes scheduler-controlled writes into another agent’s persistent store. “Channel Fracture” studies this in a production Hermes Agent deployment with five specialized profiles—Primary/admin, laiven-assistant, dev-pony, marketing-pony, and kehu-chenggong—using the task of injecting a daily report format specification from the admin profile into laiven-assistant’s persistent memory. The paper evaluates three channels: direct SQLite writes, target-agent self-writes via memory tools, and cron-delegated writes. Channel A succeeds with six facts inserted and verified row counts of facts = 6, entities = 4, fact_entities = 8, and facts_fts = 6. Channel B also succeeds, conditional on correct holographic-memory configuration, gateway restart, and enabled_toolsets including "memory". Channel C, the cron-delegated path, fails completely: memory tools are unavailable, fact_store is absent, and log excerpts show memory(action='add') → UNAVAILABLE: memory tool disabled (cron job) and fact_store → UNAVAILABLE: Tool does not exist in my tool list (Liu, 3 Jun 2026).

The root cause is architectural rather than incidental. The scheduler instantiates cron agent sessions with skip_memory=True and platform="cron", which prevents memory subsystem initialization. Because _memory_manager is not constructed, the conditional registration of memory tools in agent_init.py never fires; in addition, approvals.cron_mode: deny reinforces isolation. The paper names the resulting failure mode channel fracture: the sender’s path appears valid and the job dispatches, but the receiver’s execution context does not possess the architectural capability required to perform the write.

To prevent false-positive delivery assurance, the paper introduces CADVP v1.1, a 13-dimension verification framework. Its veto-level check, CC-0 (Channel Confirmation), verifies that the target execution context supports required memory tools, memory subsystem initialization is active, no hardcoded guards such as skip_memory block the channel, tool registration will succeed, and profile permissions allow the operation. The paper’s formal success predicate is

$x_1 \oplus R$3

with

$x_1 \oplus R$4

It also articulates two design principles: the inverse verification principle, which requires delivery to be verified from the receiver’s read chain rather than the writer’s write chain, and the channel matching principle, which forbids workflow design on channels unavailable at the target end (Liu, 3 Jun 2026).

Framework-level remediation is correspondingly concrete: permit explicit memory writes in cron while still blocking contamination from system prompts, initialize _memory_manager in cron when the job requires memory, set approvals.cron_mode to allow or conditional_allow for whitelisted jobs, and gate every write through CC-0. Operational workarounds include target-agent self-write, a service-mediated memory injection API, message-bus delegation to a non-cron worker, or direct SQLite writes with transactions, WAL mode, busy_timeout, and manual maintenance of facts, entities, fact_entities, and facts_fts consistency.

6. Structural and control-conditioned attention

A separate line of work uses scheduled KV injection to alter which memory sites attention may retrieve, rather than to move pages or write persistent records. Graph-KV breaks serialized sequence processing by encoding text segments independently into per-layer KV caches and then scheduling cross-segment attention according to a directed graph $x_1 \oplus R$5. For each target segment $x_1 \oplus R$6, only the KV caches of designated source segments $x_1 \oplus R$7 are concatenated:

$x_1 \oplus R$8

and a graph-structured block mask sets disallowed segments to $x_1 \oplus R$9. The paper further assigns shared positional bands—sources in $$h_{\text{out}} = h_{\text{in}} + M \odot f_A(h_{\text{in}}).$$0, targets in $$h_{\text{out}} = h_{\text{in}} + M \odot f_A(h_{\text{in}}).$$1, and queries beyond $$h_{\text{out}} = h_{\text{in}} + M \odot f_A(h_{\text{in}}).$$2—to reduce order-dependent positional bias and preserve effective context length. One injection round suffices for the evaluated tasks. Empirically, Graph-KV-Full reports average gains of +2.14 points on MultiHop-RAG, +7.52 points on MorehopQA, and +4.9 points on LongBench-V2 single-document QA over the best sequential baselines, while remaining robust on Arxiv-QA when sequential encoding collapses under distractor placement and context-window pressure (Wang et al., 9 Jun 2025).

KV-Control uses the term at the granularity of self-attention layers in a frozen text-to-motion transformer. The backbone is a 20-layer post-norm Transformer over T-Concat tokens with $$h_{\text{out}} = h_{\text{in}} + M \odot f_A(h_{\text{in}}).$$3 anatomy-aligned codebooks, $$h_{\text{out}} = h_{\text{in}} + M \odot f_A(h_{\text{in}}).$$4, $$h_{\text{out}} = h_{\text{in}} + M \odot f_A(h_{\text{in}}).$$5, $$h_{\text{out}} = h_{\text{in}} + M \odot f_A(h_{\text{in}}).$$6, and $$h_{\text{out}} = h_{\text{in}} + M \odot f_A(h_{\text{in}}).$$7. At each sampling step, a shared 1D-conv trajectory encoder converts the residual-and-target control signal

$$h_{\text{out}} = h_{\text{in}} + M \odot f_A(h_{\text{in}}).$$8

into frame-aligned features $$h_{\text{out}} = h_{\text{in}} + M \odot f_A(h_{\text{in}}).$$9. Every self-attention layer then applies a zero-initialized low-rank down-projection and two up-projections to produce control-conditioned $M = 0$0 and $M = 0$1, concatenates them to the motion K/V inputs, and adds a scalar attention bias $M = 0$2 initialized to $M = 0$3 on the control-token columns. Query projections are unchanged, so the pretrained query stream and text cross-attention anchors are preserved (Sun et al., 4 Jun 2026).

The scheduling structure is explicit. Injection occurs at every self-attention layer; there is one pseudo-token per frame; part selectivity is delegated to T-Concat’s frame–part tokenization and the joint–frame mask $M = 0$4; and at inference the control memory is recomputed at every sampling step because it depends on the current predicted trajectory. Refinement adds two-stage schedules that do not alter KV-Control parameters: Stage 1 uses either a static 100 iterations per sampling step (M2) or a dynamic schedule $M = 0$5 (M1, M3), and Stage 2 uses 600 iterations. The mechanism itself has 1,474,560 K/V parameters and 10.5M total control-side trainable parameters atop a frozen 118M backbone. Reported results include 0.40 cm average position error for single-joint pelvis tracking with M3 and 0.71 cm for multi-joint tracking, while preserving text-conditioned motion quality at FID about 0.054–0.065 and Top-3 about 0.799–0.802. Ablations show that T-Concat with KV-Control substantially outperforms C-Concat under matched backbones, and that a duplicated ControlNet-style branch with 39.3M mechanism parameters does not match the 0.51 cm performance reached by the 1.5M K/V mechanism at matched compute (Sun et al., 4 Jun 2026).

These two papers make the same scheduling idea visible at different abstraction levels. Graph-KV schedules which segment-level caches a target may read; KV-Control schedules which external control memories every attention layer may read. In both cases, injection is not a prompt-format trick but an explicit redefinition of the memory interface seen by self-attention.