University of Toronto researchers discover GPU vulnerability enabling AI model attacks
University of Toronto researchers discovered that Rowhammer attacks, previously known to target CPUs, can also compromise GPUs with GDDR memory used in AI systems. A successful attack could reduce AI model accuracy from 80 percent to 0.1 percent, potentially affecting critical applications like medical imaging and fraud detection, particularly in cloud computing environments where multiple users share GPUs.
What happened
Researchers at the University of Toronto discovered that a Rowhammer attack, previously known to affect CPU memory, is also effective against GPUs equipped with graphics double data rate (GDDR) memory.
The team developed a proof-of-concept GPUHammer attack targeting GDDR6 memory in an NVIDIA RTX A6000 GPU. They found that a single bit flip to alter the exponent of an AI model's weight could cause massive reduction in model accuracy.
Reported impact
A successful attack on GPUs running AI models could result in model accuracy plummeting from 80 percent to just 0.1 percent, described as "catastrophic brain damage" to the model.
Such degradation could have serious consequences for AI applications including medical imaging analysis in hospitals and fraud detection systems in banks. GPU users most at risk are those managing cloud computing environments where multiple users may access the same GPU simultaneously.
Index analysis
The attack works by manipulating memory cells into flipping bits through rapidly accessing adjacent rows, causing electrical interference in memory regions the attacker has not directly accessed, potentially allowing them to bypass security or take control of a system.
Researchers noted that GPUs are more difficult to target than CPUs due to their faster memory refresh rates and slower memory latency, but the vulnerability remains effective.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.