Guillermo Rauch 复现 OpenAI 的 CPU 隐蔽通信研究，构建 cpu-chat
I built 𝚌𝚙𝚞-𝚌𝚑𝚊𝚝, a reproduction of @openai's findings of covert communication using the CPU.
Guillermo Rauch 构建了 cpu-chat，复现 OpenAI 关于利用 CPU 进行隐蔽通信的研究，在无网络的 Firecracker microVM 环境中通过 CPU 争用、缓存驱逐时序和 DRAM 带宽争用三种机制实现通信，可跨多个 CPU 运行，并绕过了 Firecracker 的生产建议（禁用 SMT、禁用 KSM、租户绑定不同核心）。他指出这与 Meltdown/Spectre 类侧信道攻击不同，后者可窃取信息，而这类“低语”技术在真实环境中更难实施，也更容易通过采样硬件计数器和大规模统计数据监测。他还提到 OpenAI 和 Anthropic 的模型拒绝参与这项工作，最终由开放权重模型完成。
推荐理由
AI 评分 55
作者复现了 OpenAI 关于 CPU 隐蔽通信的研究，并说明它与侧信道攻击的区别及检测思路。
主题
正文
I built 𝚌𝚙𝚞-𝚌𝚑𝚊𝚝, a reproduction of @openai's findings of covert communication using the CPU.
It runs on a generic host with 2+ Firecracker microVMs with no internet access. Works on x86 and even my M5 chip.
I was able to chat via 3 separate mechanisms: ① CPU contention ② Cache eviction timing ③ DRAM bandwidth contention
… across multiple CPUs, defeating all Firecracker's production recommendations (no SMT, no KSM, tenants pinned to different cores.)
Essentially, if shared hardware is involved, there's a good chance your agents can communicate covertly. And with really decent latency.
The good news: this is decidedly different from a *side-channel attack* where the agents could steal information (Meltdown/Spectre), a category of attack that providers like Vercel Sandbox mitigate. Further, in our real-world environment, these 'whispering' techniques are much harder to pull off and easier for us to monitor and detect (sampling hardware counters + lots of at-scale statistical data.)
Noteworthy: ironically, OpenAI and Anthropic's models refused to do this work. Open weight models got the job done. I'm worried the labs' stance might backfire and get in the way of helping developers build correct and secure systems. e.g: building a secure sandbox requires having this kind of analysis, and without it, we'll have a less secure world.