Security firm Eclypsium published a critical report on Thursday detailing how threat actors can sabotage artificial intelligence models by tampering with the underlying hardware infrastructure rather than the model weights themselves. The findings challenge the prevailing assumption that securing the model file and its container is sufficient for AI integrity. By targeting the firmware, memory controllers, and management processors that power the compute, attackers can subtly bias a model’s runtime behavior while traditional security checks remain green.

The Invisible Attack Surface

The report highlights a hierarchy of vulnerabilities starting at the host machine level, which relies on operating systems, kernels, and graphics drivers susceptible to standard malware and rootkits. However, the more insidious threat lies in third-party components such as firmware update services and AI orchestration agents. Eclypsium notes that a compromise of the management plane can enable privileged paths into the workload, allowing attackers to modify isolation controls or directly control attached devices. This creates a scenario where the AI system appears healthy and verified, yet its operational state has been fundamentally altered.

Runtime Manipulation via DPUs

A key focus of the research is the role of Data Processing Units (DPUs), which offload significant portions of AI workloads. Because DPUs perform critical processing tasks, they offer a prime vector for altering a model’s operating state. Eclypsium, which partnered with Nvidia on this research, demonstrated a technique where runtime weights are changed in memory after traditional security checks have passed. The model file, container image, and signed artifacts on disk remain valid, effectively fooling the system into believing its integrity is intact while the actual inference logic is skewed. This approach bypasses standard hash verification mechanisms entirely.

Industry Implications and Vendor Response

The vulnerability extends beyond Nvidia’s ecosystem, with systems from AMD, Intel, and Arm also identified as susceptible to these hardware-level tampering techniques. Eclypsium argues that chipmakers should follow Nvidia’s lead in using DPUs to enforce security policies independently of the AI system, provided the DPUs themselves are adequately protected. The firm recommends that enterprises maintain rigorous inventories of all AI infrastructure components and integrate them into existing vulnerability management processes. Scrutinizing third-party software running on critical hardware like DPUs is no longer optional but a fundamental requirement for trusted AI deployment.

Key Takeaways

  • Model integrity cannot be guaranteed solely by verifying file hashes or container signatures.
  • Firmware and DPU compromises can bias AI outputs by altering runtime weights in memory.
  • Attackers can bypass traditional security checks by manipulating the infrastructure below the OS level.
  • Major chip vendors including Nvidia, AMD, Intel, and Arm are all exposed to these hardware-level risks.

The Bottom Line

We have been so obsessed with data poisoning and prompt injection that we ignored the metal beneath the code. If you cannot trust the silicon, you cannot trust the inference.