Shared-GPU timing leaks land on operators, and neither fix is free

Sharing a GPU between customers can reveal what a neighbour runs and how fast it works. Branislav Brzak of Stealthium argued on the AI Engineer show that the cost of the fix falls on the operators who run the hardware. Both of their options give something up.

What was said

Brzak demonstrated a timing side channel on Nvidia H100 GPUs. The attacker probes only its own memory. It reads nothing of the victim's and exploits no software bug. He stressed that the attack sees timing, not prompts or answers. He opened by saying the isolation on shared GPUs "may not prove to be sufficient."

His explanation: isolation splits up memory and compute, but some hardware operations affect the whole GPU. In his words, "Timing is the one thing that isn't isolated." The attacker times its own memory accesses over and over, and the victim's activity shows up as delay. In the sliced-GPU case, the median delay was only 3 microseconds.

A second setup used an eight-GPU H100 server linked by NVSwitch. The victim ran one model split across GPUs 0 and 1, a method called tensor parallelism. The attacker sat on GPU 2 and timed each hop of a memory chase over NVLink. An idle hop took about 890 nanoseconds. Once the victim worked, it climbed to about 300 microseconds. Across five models on identical serving setups, the method identified the model 79.2% of the time, against a 20% baseline.

Why it matters

Our reading: the person who must choose is the operator, not the tenant. A tenant cannot decide where a neighbour sits or how a cluster is carved up. Brzak's first takeaway was that operators control placement, so an untrusted tenant's MIG slice should not sit beside a sensitive model. His second was the trade-off. MIG rules out peer-to-peer links, so it rules out tensor parallelism. Sharding over NVLink limits the leak to timing alone, but it still leaves a fingerprint. Buyers of shared GPU capacity could reasonably ask providers which compromise they made.

The other side

Brzak did not put a number on the performance cost of avoiding tensor parallelism. The talk showed model and workload fingerprints, not stolen prompts. The accuracy figure comes from a five-model test, and the method blurred two similar-sized models together. Brzak also sells GPU monitoring, and he said his company's product caught the probe. His claim that most organizations lack such visibility is his own view, not something the talk measured. The talk also did not say how often these attacks happen in real deployments.