Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LeftoverLocals: Listening to LLM responses through leaked GPU local memory

blog.trailofbits.com

Post reply on HN
Print view View original

11–20 of 42 posts

Re: LeftoverLocals: Listening to LLM responses through leaked GPU local memory

#11

Post by ks6g10 »

dist-epoch wrote: post #10
Veserv wrote: post #3

tl;dr GPU drivers made by various vendors do not sanitize compute unit hardware scratch memory between uses, so you can just freely read whatever the last user left laying around when they stopped. Literally too incompetent to follow even basic security 101 practices. A time shared device must be sanitized between users to prevent state leakage. There is no reason to believe that a security culture that clueless when…

It's not so simple. For example Windows takes over GPU memory control, it virtualizes it, and allocates it to various applications, zeros it, etc...

This is specific to local/scratch memory which is not exposed for allocation in the same way dram is.

Re: LeftoverLocals: Listening to LLM responses through leaked GPU local memory

#12

Post by ks6g10 »

vlovich123 wrote: post #4
Veserv wrote: post #3

tl;dr GPU drivers made by various vendors do not sanitize compute unit hardware scratch memory between uses, so you can just freely read whatever the last user left laying around when they stopped. Literally too incompetent to follow even basic security 101 practices. A time shared device must be sanitized between users to prevent state leakage. There is no reason to believe that a security culture that clueless when…

And Imagination. Notably Intel and Nvidia were not impacted. I wonder if the security hardening that Google worked on with Nvidia for Stadia helped prevent this

Could probably be that the shared memory (at least in the past) also was used for cache, so the same mechanism that probably sanitizer the cache is/was in play here.

Re: LeftoverLocals: Listening to LLM responses through leaked GPU local memory

#14

Post by ComputerGuru »

At this point, I assume this is the default and don’t expect data recovery to not be provide on the same physical machine (even across virtualization barriers).

If your data is that sensitive, run it on dedicated hardware. Papering over this with mitigation over mitigation is a fool’s errand: both a genuine waste of compute resources and guaranteed to be a game of cat and mouse.

Re: LeftoverLocals: Listening to LLM responses through leaked GPU local memory

#16

Post by jmgao »

vlovich123 wrote: post #4
Veserv wrote: post #3

tl;dr GPU drivers made by various vendors do not sanitize compute unit hardware scratch memory between uses, so you can just freely read whatever the last user left laying around when they stopped. Literally too incompetent to follow even basic security 101 practices. A time shared device must be sanitized between users to prevent state leakage. There is no reason to believe that a security culture that clueless when…

And Imagination. Notably Intel and Nvidia were not impacted. I wonder if the security hardening that Google worked on with Nvidia for Stadia helped prevent this

Google used AMD GPUs for Stadia, not NVIDIA.

Re: LeftoverLocals: Listening to LLM responses through leaked GPU local memory

#17

Post by vlovich123 »

Veserv wrote: post #7
vlovich123 wrote: post #4

Earlier quoted context omitted.

And Imagination. Notably Intel and Nvidia were not impacted. I wonder if the security hardening that Google worked on with Nvidia for Stadia helped prevent this

Jeez, I hope it did not require “security hardening” for Nvidia to do something this basic. If these other vendors missed some tiny corner resulting in state leakage, that would be understandable. But, forgetting to clear local memory is just inexcusable. Imagine a OS forgetting to replace your general purpose registers across context switches. Only a rank incompetent and useless security process would let something…

Vendors have consistently ignored multi tenant issues when coding because gaming doesn’t need it and cloud traditionally hasn’t used GPUs all that much.

You’d be surprised by how many security issues exist in GPU drivers

Re: LeftoverLocals: Listening to LLM responses through leaked GPU local memory

#18

Post by jeroenhd »

declaredapple wrote: post #15

GPU memory isolation is generally really bad, from between processes and entire virtual machines. Does anyone know if nvidia's virtual gpus improve the isolation at all?

This is one of my main concerns with technologies like WebGPU. Luckily, WebGPU seems to sacrifice some performance to keep attacks like these from working: https://github.com/trailofbits/LeftoverLocalsRelease/tree/ma...

Re: LeftoverLocals: Listening to LLM responses through leaked GPU local memory

#19

Post by ngneer »

dmvdoug wrote: post #13

Is this the Golden Age of hardware vulnerabilities?

Kind of. However, I would venture most real world attack scenarios do not leverage HW vulnerabilities. But wait, how do we know what is happening invisibly? And what about state actors? The answer is we do not know, but the economics do not change based on whether an attack is made visible or not. Attacks tend to follow and reveal the path of least impedance. If software attacks are working fine for most, why would anyone spend more on weaponizing a HW exploit?
Post reply on HN