Metraipolis › archive › dc_c8efc2fc61ce

PAGE404: Breaking GPU Isolation Through Hardware-assisted Page Migration — arXiv:2610.20962

Source: arXiv (en)
Original: https://arxiv.org/abs/2610.20962
License (as archived): CC0-1.0
Archived: 2026-10-16T10:11:58.051Z
SHA-256 of the archived text: 3f14578dc3ce03908eabf2037daec595e56c7f5c1d37562172c709f790dc8e84
Stable URL of this page: https://metraipolis.com/documento/dc_c8efc2fc61ce

How to cite

PAGE404: Breaking GPU Isolation Through Hardware-assisted Page Migration — arXiv:2610.20962 — arXiv (en), https://arxiv.org/abs/2610.20962 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_c8efc2fc61ce (Metraipolis archive dc_c8efc2fc61ce, sha256 3f14578dc3ce03908eabf2037daec595e56c7f5c1d37562172c709f790dc8e84)

BibTeX

@misc{dcc8efc2fc61ce,
  title = {PAGE404: Breaking GPU Isolation Through Hardware-assisted Page Migration — arXiv:2610.20962},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2610.20962},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_c8efc2fc61ce; sha256 3f14578dc3ce03908eabf2037daec595e56c7f5c1d37562172c709f790dc8e84},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2610.20962. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

NVIDIA's Grace Hopper (GH200) superchip represents a new generation of heterogeneous computing, tightly integrating a 72-core Arm-based CPU with a Hopper GPU on a single module via a high-bandwidth, cache-coherent interconnect. By eliminating the conventional PCIe bottleneck for CPU-GPU data movement, this design establishes a unified memory domain that scales to the capacities demanded by generative AI and high-performance computing (HPC) workloads. The architecture also introduces hardware-assisted page migration: driven by access counters, the system dynamically promotes frequently accessed pages from host CPU memory to GPU DRAM to improve memory locality. We study the security of this emerging architecture against new side- and covert-channel attacks targeting its page migration support. We analyze counter-driven migration across both the hardware mechanisms and the UVM driver's interrupt-handling pipeline, and identify two side-channel vulnerabilities: one rooted in the shared structure of access counters, and the other in the driver's response to migration interrupts. We further show that both channels are exploitable across Multi-Instance GPU (MIG) partitions, a feature intended to provide strong, hardware-enforced isolation between co-located tenants. Using proof-of-concept attacks, we build covert channels that reach roughly 8,500 bits per second through eviction-based signaling and 8,100 bits per second through migration-delay-based signaling across MIG instances. The interrupt-based channel also fingerprints inference workloads across distinct large language models (LLMs) and CPU SPEC2017 benchmarks, and estimates the prompt length processed during LLM inference with high accuracy. These results expose a security gap in hardware-managed heterogeneous memory systems and call into question the isolation guarantees of current MIG-enabled multi-tenant GPU deployments.

Tema degli esploratori: calcolo e infrastrutture (elenco arXiv cs.AR, nuovi lavori del giorno).
Categorie arXiv: Cryptography and Security (cs.CR) ; Hardware Architecture (cs.AR).
Pagina del lavoro: https://arxiv.org/abs/2610.20962 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-16T08:45:17.654Z dalla pagina https://arxiv.org/list/cs.AR/new (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).