The problem, stated plainly. In a multi-agent system, Model A finishes analysing something and must tell Model B. Today that means: A autoregressively decodes hundreds of tokens of English → the tokens cross a wire → B tokenizes them → B runs a full prefill → B reconstructs, approximately, an understanding A already held in its cache. We serialise a representation into prose, then reverse-engineer the representation from the prose — a decode tax, a prefill tax, and a lossy compression through natural language, on every handoff.
The obvious question: A's understanding already exists as tensors. Why not ship the tensors? The answer turns out to split into one solved problem, one genuinely hard problem, and one idea that might change how agents are built.
What the cache actually is
Inside every transformer layer, the hidden state h_i of token i is projected three ways:
k_i = h_i·W_K // my address in semantic space
v_i = h_i·W_V // the content stored at that address
Attention is a soft database lookup — the new token's query is matched against every stored key, and the result is a weighted blend of the stored values:
Stored per layer as tensors shaped [batch, kv_heads, seq_len, head_dim], the cache turns generation from "recompute the whole history for every new token" into "compute one new column, append, attend." Three properties matter for everything that follows:
It is not the text. It's a processed representation of the text. It is not quite the model's "thoughts" — those are the hidden states h; the cache is the attention-facing projection of them, the part packaged for future lookup. And it is written in the model's private coordinate system — a fact that will shortly become the whole problem.
The easy case: identical twins
If two servers run the same model — same weights, same everything — the cache is portable state. Server 1 prefills a 50,000-token document once; the KV blocks move over the wire; Server 2 continues decoding as if it had read the document itself.
The reason it works is that everything the cache implicitly assumes still holds on the receiving side:
Break any one of those, and you've left the easy case.
The wall: different models
Now let Model B have different weights. Both models read the word "bank", both produce a key vector of the right shape — and the vectors mean completely different things, because W_K differs, so each model has laid out its semantic space along private axes.
| axis | Model A | Model B |
|---|---|---|
| layers | 32 | 48 |
| kv heads | 32 | 8 (GQA) |
| head dim | 128 | 256 |
| positional encoding | RoPE, θ config A | RoPE, θ config B |
| tokenizer | ["Kubernetes"] | ["Kuber","netes"] |
| coordinate frame | private | private |
The inconvenient arithmetic
Before any translation cleverness, there's a logistics problem: caches are enormous. For a standard decoder,
The research ladder, 2024 → 2026
Four rungs, each relaxing one constraint of the previous:
NSDI '26
DroidSpeak arXiv 2411.02820
Constraint: same base architecture. Fine-tunes of one foundation model reuse most cache layers; per-pair profiling picks the sensitive layer groups to recompute. Up to 2.78× prefill speedup, negligible accuracy loss.
ICLR '26
Cache-to-Cache (C2C) arXiv 2510.03215
Constraint: same context, but truly different models. A learned neural projector fuses the source cache into the target's, with per-layer gates choosing where the transfer helps. Reported ~3–5% higher accuracy than text exchange at ~2× lower latency.
Latent Space Communication via K-V Cache Alignment arXiv 2601.06123
Idea: one shared interlingua. Frozen base models; small adapters translate each model's cache into and out of a common aligned space — a high-bandwidth channel, and even learned skills like soft prompts become transferable across models.
Latent Cache Flow (LCF) arXiv 2605.22863
Constraint relaxed: different contexts. Keys and values are jointly translated and compressed through a low-dimensional latent bottleneck — adapters at ~4% of C2C's size — and the LCF-X variant transmits a summary of only the information the receiver doesn't already have.
Also on the map: KVCOMM · NeurIPS'25 — anchor-based offset correction for differing prefixes/LRAgent · ICML'26 — multi-LoRA agents share the base cache, keep low-rank deltas/LatentMAS — training-free latent collaboration via shared cache working memory/LCGuard — adversarial hardening so shared caches can't be decoded back into prompts
How translation actually works
The shared shape of the C2C / aligned-space / LCF family: encode the source cache into a communication latent, decode it into the target's coordinate frame, then fuse it with whatever the target already knows — with learned gates deciding, per layer, how much to trust the import.
Same context vs. different context
If both agents processed the same tokens, translation can map cache entries position-for-position — tractable, and where C2C lives. Real agents, though, hold different private contexts: different lengths, different positions, overlapping and disjoint knowledge. Token-aligned translation stops making sense. The newer pattern (LCF-X) is to extract only what's new to the receiver, compress it into semantic packets, and inject it as virtual memory — closer to a briefing than a memory transplant.
Where it bites
Six problems stand between the papers and your platform:
Positions
RoPE bakes position into every cached key. Move an entry from position 8,000 to 2,000 and its meaning corrupts — positions must be remapped or stripped in transit.
Layer alignment
Layer 12 of A is not layer 12 of B. Depth of processing differs, so translators learn many-to-many mappings — A's layers 8–14 might feed B's 16–24.
Tokenizers
A sees ["Kubernetes"], B sees ["Kuber","netes"]. Token-by-token correspondence is unreliable by construction.
Reuse ≠ recompute
A transplanted cache records how tokens were read under the source context. They never attended to the target's prompt — so reuse is an approximation of joint prefill, not an equivalence.
Security
A transferred cache is executable semantic state: cache poisoning, latent prompt injection, cross-tenant leakage, prompt reconstruction. A serious runtime needs provenance, tenant isolation, integrity checks, and adapter authentication — LCGuard-style adversarial hardening is the first work aimed squarely at this.
Observability
You can log text. You can't audit four billion floats. Regulated environments will likely demand a text shadow of every latent exchange — efficiency on the wire, English in the evidence log.
Two problems wearing one name
The most useful thing I can leave you with: "KV-cache sharing" is two different ambitions that happen to use the same tensors.
Avoid recomputation
"B has the same context as A — stop paying the prefill twice." An inference-systems optimisation: cheaper, faster, quality-neutral by design.
DroidSpeak · KVCOMM · LRAgent
Transmit knowledge
"A understands something B doesn't — inject the understanding itself." Not an optimisation: a machine-native communication protocol, with its own semantics, failure modes, and threat model.
the beginning of something new
Text transfers conclusions.
The cache is the representation that produced them.