Eclypsium demonstrates how compromised hardware can tamper with AI models at inference time
Eclypsium demonstrated, with NVIDIA's support, that an attacker using a compromised DPU and lax memory isolation can modify runtime model weights during inference, causing the model's answers to change while the model files on disk and hash verification still appear normal. The experiment was conducted in an NVIDIA Grace Hopper environment and depended on conditions such as IOMMU passthrough and lax PCIe isolation, which the researchers explicitly noted are not Linux default settings. The report brings DPUs, GPUs, management controllers and their firmware into the AI security boundary, and notes that model signing, secure boot, runtime isolation and continuous monitoring each answer different questions.
Eclypsium demonstrated, with NVIDIA's support, that an attacker using a compromised DPU and lax memory isolation can modify runtime model weights during inference, causing the model's answers to change while the model files on disk and hash verification still appear normal. The experiment was conducted in an NVIDIA Grace Hopper environment and depended on conditions such as IOMMU passthrough and lax PCIe isolation, which the researchers explicitly noted are not Linux default settings. The report
Matched fieldsTitle
