Nvidia’s GH200 Grace Hopper Superchip, the platform Eclypsium used for its test, in an Nvidia press image (illustrative). Image: Nvidia
Hackers who get into the hardware beneath an AI model can quietly rewrite how it answers in under a minute, without changing the model file anyone checks, security firm Eclypsium says in a 15-page research report published on Thursday.
The Portland-based company, which sells hardware and firmware security tools, ran the attack on an Nvidia GH200 Grace Hopper test system fitted with a BlueField data processing unit (DPU). In examples it shared with CNN, a tampered model told a user asking about chest pain to stay at home instead of going to hospital, and another gave a far higher probability to a Chinese invasion of Taiwan. Those two results are not in the public report, which does not name the model it tested.
How the attack works #
A DPU is a small computer on a server’s network card, with its own processor and operating system. Every big cloud uses them, and they can read and write the server’s memory directly, a feature called direct memory access (DMA).
Eclypsium got in through IPMI, an old remote-management protocol with known password weaknesses, then used DMA from the DPU to reach the server’s and the GPU’s memory. There it rewrote the model’s weights, the numbers that decide its answers, after the model had loaded and passed its integrity checks.
The researchers trained a small add-on called a LoRA adapter to change the model’s behaviour and swapped its values into the running model, then repeated the trick on the model’s own weights. The scan ran at about 3 GB a second and the edits “were generally completed in less than a minute”, the report says. The file on disk, its hash and its signatures stay valid throughout, and the original values can be put back afterwards, leaving no trace in the usual checks.
“We can’t trust the model” #
Eclypsium’s chief executive put the problem plainly to CNN:
We can’t trust the [AI] model if we can’t trust the infrastructure it’s running on.
Yuriy Bulygin, CEO, Eclypsium, to CNN
The report’s own demo targets a coding assistant, where a small change could make it weaken a login check, switch off certificate validation or pull in an unsafe library. A planted bug “can be difficult to distinguish from a hallucination”, it says.
Who could pull it off #
This is not a hack for amateurs. An attacker needs network access to the DPU or the server’s baseboard management controller (BMC), and the server must be set up loosely: the attack relied on the IOMMU, the chip that limits what devices can touch in memory, running in “passthrough” mode, plus permissive PCIe settings. “These are not the default Linux settings,” the report says, though some operators choose them for speed. With stronger isolation, “the same direct memory path was not available.”
Eclypsium told CNN that state actors such as China, Russia or the US could do it, and that it has briefed the NSA and CISA. It argues the risk is not unique to Nvidia and applies to AMD, Intel, Arm and custom chips too, though it admits it has “not demonstrated the same implementation on every accelerator architecture”. Two independent experts who reviewed the work for CNN called it credible:
The attacks are fundamentally the same as any other [direct memory access] attacks and I don’t see any reason to doubt their findings or results.
Joe FitzPatrick, hardware security researcher, to CNN
What Nvidia says, and the fix #
“We reviewed the hypothetical scenarios and did not identify anything the industry wasn’t previously aware of,” an Nvidia spokesperson told CNN, adding that strong memory access protections block the attack path. In a joint blog post on Thursday, the two firms stressed that operators choose how BlueField’s security is configured.
The fix is mostly configuration: keep IOMMU translation switched on rather than in passthrough, turn on PCIe access controls on the DPU’s port, and block a feature called ATS that lets a device skip the memory checks. The report says BlueField-4, with those protections enforced, blocks the unrestricted path it used. Nvidia is also putting BlueField-4 at the centre of its watchdog chip for AI agents, which makes the DPU’s own security matter more.
The report doubles as a sales pitch: Eclypsium sells software that, it says, checks a running model’s weights in memory. It comes a week after Symantec described a hacking agent that hijacks exposed AI models, another attack on the machinery around AI rather than the model.
Why it matters #
AI safety checks today mostly test the model file, not the server running it, so a model that passed every check can still give a doctored answer. The attack needs access and a weak setup, but it shows that whoever controls the hardware can, in principle, control what a chatbot says.
Sources: Eclypsium, Trusted AI Requires Trusted Infrastructure (PDF); Eclypsium and Nvidia blog post; Eclypsium press release; CNN (interviews and Nvidia statement).