Dark Silicon: Unmasking GPU Threats in the Age of AI

Dark Silicon: Unmasking GPU Threats in the Age of AI

Speakers: Sneha Rangari, Senior Cybersecurity Engineer, Visa

Conference: FIRSTCON

YouTube: https://www.youtube.com/watch?v=akWRI5TDsjI

Overview

In an era where artificial intelligence is rapidly becoming the backbone of critical operations, the security of the underlying hardware, particularly Graphics Processing Units (GPUs), remains a dangerously overlooked frontier. Sneha Rangari, a Senior Cybersecurity Engineer at Visa, delivered a compelling talk at FIRSTCON titled "Dark Silicon: Unmasking GPU Threats in the Age of AI," highlighting the critical vulnerabilities residing within the silicon layer of AI infrastructure. Her presentation served as a stark warning: while organizations invest heavily in traditional cybersecurity defenses for their networks and CPUs, the powerful GPUs driving AI models often operate in a security blind spot, creating an "illusion of security" that attackers are already exploiting.

The core message of Rangari's talk is that the very hardware accelerating AI—GPUs—is simultaneously an unmonitored attack surface ripe for exploitation. Attackers are not just targeting data or network perimeters; they are directly leveraging or subverting GPU capabilities for nefarious purposes, ranging from cryptojacking to sophisticated AI model theft. This oversight stems from a fundamental mismatch: traditional security tools are designed to monitor operating systems and network traffic, rendering them effectively blind to malicious activities occurring directly on the GPU or within its memory. The talk not only exposes these critical gaps but also empowers defenders by demonstrating how existing, often pre-installed tools can be leveraged to shed light on this "dark silicon."

Why does this matter now more than ever? As AI models become increasingly valuable and complex, their integrity and confidentiality are paramount. The financial and reputational costs of a compromised AI model—whether through intellectual property theft, biased outputs, or resource exhaustion—are immense. Rangari's session is a call to action for the cybersecurity community to extend its defensive perimeter beyond the traditional boundaries and into the silicon, ensuring that the computational engines of our AI future are as secure as the data they process.

Background

▶ Watch: Introduction: The illusion of AI security (0:00)

The premise of "Dark Silicon" is rooted in a fundamental misassumption of security in modern AI environments. As Alvin Toffler famously stated, "the illusion of security is worse than the insecurity itself," a sentiment that perfectly encapsulates the current state of GPU security. Organizations meticulously secure their network perimeters, endpoints, and CPU-driven systems with firewalls, intrusion detection systems, and antivirus software. Yet, as Rangari illustrates with a powerful analogy, this is akin to fortifying a mansion with premium cameras, laser-sensored windows, and biometric locks, while completely overlooking an unmapped air vent in the back. This "air vent" represents the silicon layer—specifically, the GPUs—which, despite being the powerhouse for AI, remain largely unmonitored by conventional security tools.

Rangari provides concrete examples to underscore this critical blind spot. In September 2023, an attacker discovered such an "open door" in an AI framework called "Shadow Ray." Instead of triggering alarms, they simply slipped through, became a "ghost in the house," and six months later, in February 2024, began stealing the mansion's electricity for cryptomining. The victim, assuming the high GPU utilization was for AI model training, remained completely unaware. It took another month, until March 2024, for someone to physically notice the servers were excessively hot – not an alarm. This scenario starkly demonstrates how traditional security tools, focused on CPU and network layers, are "completely unaware of the basement that is a silicon layer." They perceive cryptomining GPU activity as indistinguishable from legitimate AI model training.

Beyond resource theft, the talk delves into the more insidious threat of AI model theft through "distillation campaigns." In late 2024, a company named DeepSeek sought to replicate world-class AI models without directly hacking servers or stealing hard drives. Instead, they created developer accounts and launched millions of carefully crafted queries against GPT-3. This systematic "interrogation" forced the model to reveal its underlying mechanisms, much like hiring a Michelin-star chef daily not to eat, but to reverse-engineer their recipes. Microsoft eventually detected this machine-generated activity, leading to OpenAI revoking access, but the damage was done: the captured outputs were used to train DeepSeek's own AI model. Rangari points out that Anthropic later revealed similar campaigns by Moonshot and Minimax, involving 24,000 fake accounts and 16 million queries, constituting "industrial theft prompt." She emphasizes that if attackers could directly access GPU memory, they could read model weights and bypass the need for such extensive API queries, highlighting the deeper vulnerability of the silicon layer. These incidents collectively form the crucial background, establishing why GPU security is not merely an academic concern but an urgent, real-world problem.

Key Findings

▶ Watch: DeepSeek's AI model distillation campaign (3:50)

The talk "Dark Silicon: Unmasking GPU Threats in the Age of AI" unveils several critical findings that redefine the scope of cybersecurity in the age of AI.

Firstly, the most significant finding is that GPUs constitute a vast, largely unmonitored attack surface within modern AI infrastructure. Despite their pivotal role in AI training and inference, the security posture of these powerful accelerators is often neglected, creating a substantial blind spot for organizations. This oversight is particularly concerning as AI models become central to business operations and hold immense intellectual property value.

Secondly, traditional security tools are fundamentally ill-equipped to detect and mitigate threats at the silicon layer. Firewalls, EDRs, and SIEMs primarily focus on network traffic, CPU processes, and operating system logs. They struggle to differentiate between legitimate AI workload activity and malicious operations like cryptojacking or data exfiltration occurring directly on the GPU, often bypassing detection entirely. This leads to a dangerous "illusion of security."

Thirdly, AI model theft is a real and growing threat, already observed through sophisticated methods like distillation attacks. While these attacks initially manifest at the API level, Rangari warns that direct access to GPU memory could allow attackers to steal model weights and replicate proprietary AI, bypassing even these complex query-based methods. This underscores the potential for more direct, hardware-level model exfiltration.

Fourthly, a comprehensive array of GPU-specific attack vectors exists, categorized by the STRIDE threat model. These include spoofing (e.g., cryptojacking mimicking legitimate jobs), tampering (e.g., GPU rootkits altering model weights), repudiation (e.g., volatile GPU malware leaving no forensic traces), information disclosure (e.g., side-channel attacks on shared GPU instances), denial of service (e.g., GPU overload attacks), and elevation of privilege (e.g., exploiting low-level flaws for deeper access).

Finally, and perhaps most encouragingly for defenders, the talk highlights that effective tools for GPU monitoring already exist and are often built into NVIDIA hardware. Tools like NVIDIA-SMI, NVML (NVIDIA Management Library), and CUPTI (Compute Unified Device Architecture Profiling Tools Interface) can provide the necessary visibility into GPU utilization, processes, and memory activity. The challenge is not a "product gap" but a "workflow gap"—organizations simply need to integrate and actively monitor these data sources. By doing so, they can transform the "dark silicon" into a visible and defensible part of their security architecture.

Technical Deep Dive

▶ Watch: Live demo: Detecting GPU cryptojacking with NVIDIA-SMI (12:30)

To comprehensively understand the vulnerabilities inherent in GPUs, Sneha Rangari employs the classic STRIDE threat model, adapting it to the unique characteristics of the silicon layer. This framework helps categorize and analyze the various ways attackers can compromise AI systems at the hardware level.

Spoofing: This involves an attacker masquerading as a legitimate entity or process. In the GPU context, this manifests as cryptojacking. Rangari describes malicious code that looks "exactly like your regular inference job is running," or an "AI inference job." This code, such as the example "K worker," deliberately uses names that resemble legitimate Linux processes to bypass traditional security tools. The impact is significant: legitimate AI models are starved of computational resources, potentially leading to freezes or performance degradation, while the attacker illicitly mines cryptocurrency.

Tampering: Here, an attacker modifies data or processes to achieve a malicious outcome. For GPUs, this involves attacks like GPU-based rootkits and glitch attacks. These sophisticated techniques allow attackers to directly alter AI model weights. The consequence is severe: the compromised AI model can "hallucinate," produce biased decisions, or yield incorrect outputs, fundamentally eroding trust in the AI system's integrity. Such attacks are difficult to detect as the model's behavior shifts subtly.

Repudiation: This category concerns an attacker's ability to deny their actions or prevent accountability. Rangari highlights GPU snooping with no OS footprints. Malicious code can reside directly in GPU memory, which is volatile RAM. This allows it to bypass traditional operating system logging mechanisms. When the system reboots, the malware vanishes, leaving "zero logs, zero access logs, or zero footprints" for incident response teams to trace. This ephemeral nature makes forensic analysis extremely challenging.

Information Disclosure: This threat involves the unauthorized exposure of sensitive data. A common vector in cloud environments is through side-channel attacks, GPU snooping, or the GPU.zip attack. In cloud infrastructure, multiple AI workloads often share the same physical GPU instances to optimize costs. Without proper isolation and cross-workload checks, data remnants from one tenant's AI model can leak to another, allowing an attacker to "turn on the flashlight and just look into your documents through the thin cracks of the wall," as Rangari vividly puts it.

Denial of Service (DoS): DoS attacks aim to make resources unavailable to legitimate users. The GPU.zip attack is a prime example in this context. Attackers deliberately send "chunks of malicious code or request" to the GPU. This overloads the hardware, causing the AI model or the entire GPU to freeze and become unresponsive. The immediate impacts include a complete cessation of AI services and the generation of "huge compute bills" due to excessive, unproductive resource consumption.

Elevation of Privilege: This involves an attacker gaining higher-level access than they are authorized for. Rangari connects this to AI model threat through distillation attacks, which exploit "flaws in the low-level access." While distillation campaigns typically operate at the API level, the underlying principle of finding an "air vent" (a low-level flaw, like in the "Shadow Ray" framework) to gain unauthorized access and steal compute resources or model insights is analogous. By exploiting such vulnerabilities, attackers can elevate their privileges to effectively gain control over valuable AI assets or the computational power they consume.

These STRIDE-categorized threats illustrate that the GPU is not just a computational engine but a complex, vulnerable component that requires dedicated security attention, extending beyond the traditional scope of cybersecurity.

Demo / Proof of Concept

▶ Watch: Essential tools for GPU security: SMI, NVML, CUPTI (18:00)

Sneha Rangari reinforced her theoretical exposition with two compelling demonstrations, showcasing how GPU-specific attacks manifest and how they can be detected using readily available tools.

Demo 1: Cryptojacking Simulation (Spoofing)

The first demonstration illustrated a cryptojacking attack masquerading as a legitimate AI workload.

• Normal State: The simulation began by showing an AI server under normal operation. The GPU utilization was at a healthy 63%, with memory usage well within expected baselines. The security status, as reported by traditional tools, appeared "very clean," indicating no immediate threats. One legitimate "AI inference server" job was running.
• Attack Initiation: An attacker, having found an exposed AI server, injects malicious code. This code launches a new process named "K worker." The name is deliberately chosen to mimic a legitimate Linux process, designed to bypass traditional security checks.
• Attack in Progress: With the "K worker" running, the GPU utilization dramatically spikes from 63% to 94%. Despite this significant change, the EDR (Endpoint Detection and Response) alerts and SIEM (Security Information and Event Management) events show "nothing." Traditional tools are completely blind, perceiving the "K worker" as a normal process and the high GPU usage as legitimate AI training. Meanwhile, the actual, legitimate AI inference job is starved of resources.
• Detection: To detect this, Rangari demonstrated using NVIDIA-SMI, a command-line utility that comes pre-installed with NVIDIA GPUs. By running NVIDIA-SMI in a continuous loop (simulated as "loop one, loop two, loop three, loop four"), the system could establish a baseline. The tool then identified anomalies: GPU utilization was far above the expected 63% (reaching 94%), two processes were running instead of one, and memory usage was "way too much above the baseline." These deviations triggered an alert for the security team, proving that NVIDIA-SMI, when actively monitored, can effectively unmask cryptojacking.

Demo 2: Side-Channel Attack Simulation (Information Disclosure)

The second demonstration highlighted a side-channel attack exploiting shared GPU resources for information disclosure.

• Scenario: In cloud environments, to reduce costs, multiple AI workloads often share the same physical GPU instance. The demo depicted a victim's workload (blue) and an attacker's workload (purple) running adjacently on the same GPU. Rangari explained that data compression techniques can leave "data remnants," and without proper isolation or "cross-border checks," these remnants can leak.
• Attack Initiation: The attacker strategically places their workload adjacent to the victim's memory. Crucially, this attack requires "no malware, they don't need to crack any door, they don't even need to hack anything." It's purely a matter of "proximity and the time," exploiting the inherent design of shared hardware.
• Detection: For this type of sophisticated, kernel-level threat, Rangari introduced CUPTI (Compute Unified Device Architecture Profiling Tools Interface). CUPTI is another default NVIDIA tool that can monitor GPU activity at a deeper level. The demo showed CUPTI detecting "this kind of a violation," specifically "cross-border memory exchange" or situations where "isolation is not well detected [or] not well defined." This triggers an alert, indicating potential data leakage between co-located workloads.

These demonstrations effectively bridge the gap between theoretical vulnerabilities and practical detection, emphasizing that the tools to secure "dark silicon" are already at hand, requiring only activation and vigilant monitoring.

Defensive Implications

▶ Watch: Q&A: Real-world incidents of GPU model tampering (25:00)

The insights gleaned from "Dark Silicon: Unmasking GPU Threats in the Age of AI" offer clear, actionable defensive implications for organizations leveraging AI. The core message is that the problem is not a "product gap" but a "workflow gap"—the tools exist, but they are not being adequately utilized.

Firstly, a critical step is to Audit Your Visibility. Organizations must assess their current monitoring capabilities for GPUs. This means asking engineers: "Is NVIDIA-SMI being used?" and, "Where are the data logs going?" If GPU logs are not being fed into centralized security information and event management (SIEM) or security operations center (SOC) systems, a significant visibility gap exists. Traditional security teams often only have visibility into CPU and OS logs, leaving GPU activity completely unobserved. Bridging this gap is paramount to detecting silicon-layer threats.

Secondly, Patching Your GPU Drivers must become a standard, automated security practice. Just as operating systems and applications receive regular security patches, GPU drivers, firmware, and associated software components must be included in the patching pipeline. Organizations should actively monitor for NVIDIA hardware CVEs and integrate them directly into their vulnerability management and patching processes. A robust, automated pipeline for GPU-specific patches is essential to mitigate known vulnerabilities before they can be exploited.

Thirdly, Isolate Critical AI Workloads. Given that multiple AI workloads frequently share the same physical GPU instances in cloud and on-premise environments, clear boundaries and strong isolation mechanisms are crucial. Organizations should not rely on default settings, which are often permissive for performance but detrimental to security. Instead, they must proactively define and enforce strict isolation policies to prevent side-channel attacks and information disclosure between co-located workloads. This includes configuring virtual GPU (vGPU) technologies and ensuring proper memory partitioning.

Finally, organizations must actively Leverage Existing Tools that are often already present within their NVIDIA hardware ecosystem:

• NVIDIA-SMI: Envisioned as a "security guard's dashboard," this utility provides real-time insights into individual GPU instance activity, including utilization, running processes, and memory usage. It's the first line of defense for monitoring anomalous behavior like cryptojacking.
• NVML (NVIDIA Management Library): For organizations with hundreds or thousands of GPU instances, NVML acts as a "CCTV room server." It's a free Python API that allows for centralized collection of GPU telemetry data across numerous devices. This data can then be ingested into a SIEM or SOC, enabling broad monitoring for spikes, peaks, and deviations from baselines across the entire GPU fleet.
• CUPTI (Compute Unified Device Architecture Profiling Tools Interface): For detecting more sophisticated, kernel-level attacks that might bypass NVIDIA-SMI or NVML, CUPTI is indispensable. It sits at the kernel level, providing deep visibility into GPU memory and low-level operations, capable of flagging malicious code or unauthorized access that targets the silicon directly.

By implementing these audit, patch, and isolation strategies, and by actively utilizing NVIDIA's native monitoring tools, organizations can move beyond the "illusion of security" and establish a robust defense for their critical AI infrastructure at the silicon layer.

Key Takeaways

• GPUs are a major, unmonitored attack surface: The silicon layer, particularly GPUs, is a significant blind spot for traditional cybersecurity tools, making it a prime target for attackers exploiting AI infrastructure.
• AI model theft is a real and proven threat: Methods like distillation attacks have demonstrated the vulnerability of valuable AI models to intellectual property theft, with potential for even more direct attacks via GPU memory access.
• Traditional security tools are blind to GPU threats: EDRs, SIEMs, and firewalls often cannot differentiate between legitimate AI workloads and malicious GPU activity like cryptojacking, leading to undetected compromises.
• Existing NVIDIA tools provide crucial visibility: Utilities like NVIDIA-SMI, NVML (NVIDIA Management Library), and CUPTI (Compute Unified Device Architecture Profiling Tools Interface) are readily available and can provide the necessary monitoring capabilities if properly configured and integrated into security workflows.
• Defenders must Audit, Patch, and Isolate: Organizations need to audit their GPU visibility (send logs to SIEM/SOC), patch GPU drivers for known CVEs, and implement strong isolation for critical AI workloads on shared physical GPU instances.
• The problem is a workflow gap, not a product gap: The tools to secure GPUs exist; the challenge lies in integrating them into existing security operations and establishing proactive monitoring and response protocols for the silicon layer.

About the Speaker(s)

Sneha Rangari is a distinguished Senior Cybersecurity Engineer at Visa, bringing extensive expertise to the forefront of emerging cyber threats. With seven years of dedicated experience, she specializes in detecting next-generation attacks, including critical areas such as deepfake detection, GPU threat modeling, and blockchain resiliency. Rangari holds a Master's degree from UNC Charlotte and is a recognized leader in her field, evidenced by her certifications as a CISSP and Sans GCHQ holder. Beyond her technical contributions, she is an active mentor and a frequent speaker at various global cybersecurity conferences, sharing her knowledge and insights to advance the collective security posture of the industry.