Your GPU Neighbor Can Identify Your Model from Timing Alone

The attack surface. A shared GPU is never fully isolated. Even with Nvidia's MIG partitioning, timing channels leak information. An attacker on the same physical GPU can determine which model you run, its layer count with 97% accuracy, decoding speed with 99.3%, and even whether the model generates prose, code, JSON, or performs retrieval. This works without root privileges, without exploiting any vulnerability, and without touching the victim's memory.

How timing betrays models. Memory barriers in Nvidia GPUs flush the entire L2 cache across all MIG slices. When the victim runs inference, the attacker's memory loads take an extra 3 microseconds on average. That is enough to detect every token the victim generates. By averaging timing traces across multiple tokens, the attacker reconstructs the model's layer count as an integer. The approach is under 30 lines of code.

Beyond model identification. The attacker also determines decoding speed, which narrows the candidate set. With speculative decoding enabled, the attacker classifies content type with 77.5% accuracy at half-second intervals. This works because draft acceptance rate varies with text predictability. The attack extends across NVLink to other GPUs in the same server, though layer counts are lost. Token timing still identifies models with 79.2% accuracy.

Detection is possible. The speaker's company Stealthium builds GPU monitoring that catches this attack in real time. A single kernel repeated 3,000 times accessing the same memory region stands out. Stealthium detected it before half the victim's response was generated, under 600ms. Operators can control placement: avoid co-locating sensitive models with untrusted tenants on MIG slices. The tradeoff is that MIG prevents tensor parallelism, so teams may accept NVLink-based partitioning, which leaks only timing, not layer counts.

What teams should do. Audit whether any production models run on shared GPU instances with untrusted tenants. Cloud services offering GPU partitioning may appear safe but are not. Evaluate monitoring tools that detect anomalous kernel behavior. Consider dedicated GPU allocation for sensitive models. The cost increase may be justified by the risk of model theft or workload profiling. Most organizations lack visibility into GPU kernel behavior, leaving them blind to these attacks.

The bottom line. This is not a vulnerability Nvidia will patch. It is a fundamental property of shared hardware with shared caches. The defense is operational: placement, monitoring, and policy. Engineering leaders should treat GPU side channels as a first-class security concern, just as they do CPU side channels like Spectre. The talk is a timely reminder that cloud GPU sharing has security implications few teams have addressed.