Your GPU Neighbor Can Hear Your Model#

Branislav Brzak (Stealthium, Cybersecurity Researcher)

• Why: Rare, quantified multi-tenancy security work at the hardware level — a direct hit on the intersection of GPU infrastructure, multi-tenancy, and isolation. If you operate shared GPU estates (MIG slicing, NVSwitch servers), this changes your threat model.
• What: A timing side-channel that defeats MIG partitioning. MIG isolates compute units, VRAM, bandwidth, faults, and L2 cache, but GPU-wide memory barriers still touch every L2 partition: work on one slice changes how long another slice's own memory reads take. An attacker tenant that only reads and times its own buffer recovers the victim's model architecture and depth (~97% claimed accuracy; 14 of 16 models recovered to exact layer depth in the displayed result), decode speed (~99%), busy periods and token counts, and — with speculative decoding enabled — workload class (prose/code/JSON/retrieval; 31 of 40 half-second windows correct). It does not recover prompt or output content. The signal also crosses GPUs: a probe on GPU 2 of an 8x H100 NVSwitch server, tracing a pointer into GPU 0 where the victim runs tensor-parallel, yields 79.2% model identification across five models vs a 20% baseline, losing layer detail but retaining tempo.
• How: The attacker repeatedly loads from a tiny buffer every ~5 µs and does spectral/fold-and-average analysis; the layer-count classifier is a best-fit test over candidate depths 16–48 (under 30 lines of code, no training set, works on unseen models since architecture signature carries over to fine-tunes/distillations). Detection: the probe shows one kernel relaunched ~3,000 times over the same ~40 KB with almost no data returned to the CPU — Stealthium reports their kernel-level monitoring caught it in under 600 ms. Mitigations offered: tenant placement policy (don't seat an untrusted tenant's MIG slice next to a sensitive model), knowing the tradeoff (MIG rules out peer-to-peer, so no tensor parallelism; NVLink sharding limits leaks to timing-only), and direct GPU workload observation.
• Where applicable: Any multi-tenant or shared GPU deployment on NVIDIA hardware (H100 demonstrated). The MIG primitive is credited to the "Behind Bars" researchers (USENIX Security '26); this talk extends it to model fingerprinting. Workload-classification results specifically depend on speculative decoding being enabled (an opt-in in vLLM). Note the last section is partly a product demo for Stealthium's observability, but the attack analysis stands on its own.