NVIDIA MIG Isolation Leaks Timing Data: H100 Side Channel Exposes Tenant Activity
AI Engineer · youtube · 2026-10-12
Branislav Brzak (Stealthium) demonstrates an H100 timing side channel where just 3 microseconds of extra latency can reveal activity on another tenant's GPU slice — probing only the attacker's own memory, without reading victim memory or exploiting software bugs.
- The trace goes from repeated memory reads to frequency analysis, token rates, and layer signatures, inferring model depth and decoding speed, and distinguishing workloads like code, prose, JSON, and retrieval.
- Similar decoding speeds make tempo alone a weak fingerprint; the layer signal helps separate closely related architectures. Workload inference depends on speculative decoding's acceptance patterns.
- A weaker but still informative signal persists across NVLink on an NVSwitch-connected H100 server.
- The attack observes timing, not contents — it cannot recover prompts or answers. Key takeaway: memory/compute isolation (MIG) doesn't automatically eliminate hardware-level signals; operators should consider tenant placement and monitor probing workloads.
More from Infra
- OpenAI chip head Richard Ho on Jalapeno: why Broadcom beat Nvidia and AMD as partner — richardjnieva · 2026-10-12
- Bittensor's TPN Labs ships first model TPN005, cutting base size ~40% with 32k context intact — const_reborn · 2026-10-12
- Microsoft to scale in-house Maia AI chips to multi-gigawatt inference by 2027 — The Decoder · 2026-10-12
- Microsoft plans huge deployment of its own AI chips to cut costs — pstAsiatech · 2026-10-12
- Ragged KV cuts Looped LM inference FLOPs by 25% with no retraining — DanielKhashabi · 2026-10-12
- NVIDIA's ELR removes the one-loop tax: Koi-4B scores 18 at one loop, 29 at four loops — nvidia · 2026-10-12