- On NVIDIA H100s, MIG slices separate memory and compute, but some GPU-wide operations still let a neighbour watch timing.
- Building on earlier research, Brzak used the signal to infer model depth, speed and workload type, though not prompts or answers. Buyers should read isolation claims as partial.
Branislav Brzak, a security researcher at Stealthium, argued on the AI Engineer show that a MIG slice of an NVIDIA H100 GPU is not private against timing. A tenant on the same card can learn about your model by timing its own memory reads. Cloud buyers, in his view, should treat isolation claims as partial.
What was said
NVIDIA's Multi-Instance GPU feature (MIG) splits one card into slices. Each slice gets its own compute units and dedicated memory. Brzak said the cache is split per slice too. But some memory barriers, which are GPU-wide operations, still reach every cache partition on the card.
His summary: "Timing is the one thing that isn't isolated." When one tenant is busy, a neighbour's reads get slightly slower.
The attacker only times reads of its own small buffer, repeating every 5 microseconds. It needs no special permissions and no software exploit. The gap is tiny: the median delay rises by just 3 microseconds, which he said is invisible by eye but enough for the attacker.
He said the basic timing method and the MIG barrier leak were not his discovery, and he credited other researchers. His work extends them. On real H100s serving real language models, he reported 97% accuracy in identifying a model's architecture and depth. He also recovered decoding speed and told code, prose, JSON and retrieval apart. He could not recover what users asked or what the model replied.
Why it matters
Our reading: a provider's isolation claim probably describes compute and memory, and this talk shows that what stays shared still counts. A buyer can ask which parts of the card remain shared between slices. A buyer can also ask whether an untrusted tenant may sit on a neighbouring slice.
Brzak's own advice was to keep slices of untrusted tenants away from a sensitive model. For teams whose model design or usage pattern is commercially sensitive, that is a placement question for contracts and procurement, not only for engineers.
The other side
The leak is narrower than it sounds. Brzak stressed that it reveals timing, not content. Speed alone could not separate two similar 8-billion-parameter models, whose decode rates differed by only 1.6%. He needed layer counts for that.
The excerpts come from a researcher's demonstration on H100s. They do not cover how well the method works amid noisy real-world neighbours, or what fixes providers offer. Brzak argued that a noisier signal is not a safe one. Whether the leaked facts matter will depend on each business.
Written by the WebPulse Newsroom with AI assistance, and checked by our editorial review: every quotation was verified against the recording's transcript. How we use AI.
The conversation this talking point comes from
- AI Engineer: Your GPU Neighbor Can Hear Your Model — Branislav Brzak, Stealthium (2026-10-12)
