Understand this story
Eclypsium demonstrated how compromised computing infrastructure can alter AI model behavior during inference. The experiment was completed in an NVIDIA Grace Hopper environment with NVIDIA's support; attackers used a compromised DPU and lax memory isolation to modify runtime model weights during inference, changing the model's answers while the model files on disk and hash verification still appeared normal. The experiment relied on conditions such as IOMMU passthrough and lax PCIe isolation, which the researchers explicitly noted are not Linux default settings. The report brings the DPU, GPU, management controller and their firmware into the AI security boundary, and notes that model signing, secure boot, runtime isolation and continuous monitoring each answer different questions. There are currently no further developments.
AI-generated from public reports
Latest development · Report
Eclypsium demonstrates how compromised hardware can tamper with AI models at inference timeDevelopments
1 confirmed developments
Reports and discussion timeline
Browse reports and discussion by time. Their evidence levels remain distinct.
Oct 30
Unite.AI
Eclypsium demonstrates how compromised hardware can tamper with AI models at inference time
Eclypsium demonstrated, with NVIDIA's support, that an attacker using a compromised DPU and lax memory isolation can modify runtime model weights during inference, causing the model's answers to change while the model files on disk and hash verification still appear normal. The experiment was conducted in an NVIDIA Grace Hopper environment and depended on conditions such as IOMMU passthrough and lax PCIe isolation, which the researchers explicitly noted are not Linux default settings. The report brings DPUs, GPUs, management controllers and their firmware into the AI security boundary, and notes that model signing, secure boot, runtime isolation and continuous monitoring each answer different questions.