side channels

The CPU does work it later throws away, but the cache remembers. The strong answer explains that one sentence precisely, then turns it into isolation decisions for shared infrastructure.

The algorithm is correct and the key never leaves the chip. The attacker reads it anyway from how long, how loud or how hot the computation is, or breaks it by making the chip skip one instruction.

Encryption hides content, not length. The scored answer shows how compression turns length into a leak when secrets and attacker text share a message, and where that bites today.

GPUs were built for throughput, not mutual distrust. Each sharing mode makes a different promise about memory, and some make none.

Caches are shared state, and shared state crosses tenants. The scored answer separates response caches from prompt prefix caches and keys each so one user can never read or detect another's data.

Similarity scores, result counts, snippets and ranking all say something about what is in the index. If authorization is applied after search, the search itself is the leak.