Researchers describe a GPU vulnerability that allows attackers to exfiltrate data from local memory on some devices with Apple, Qualcomm, AMD, and other chips
Patching every device affected by the LeftoverLocals vulnerability—which includes some iPhones, iPads, and Macs—may prove difficult.
Affected device and chip vendors must assess whether their GPU implementations can expose local memory and determine which software or firmware mitigations are available.
Owners of some iPhones, iPads, Macs, and other impacted devices face a potentially inconsistent remediation path rather than a single universal fix.
Second-order effects
Difficult patch coverage raises the value of mitigations in GPU drivers, operating systems, and applications, shifting more of the near-term response from silicon design to the software stack.
Vendors competing on GPU performance and broad device deployment will face added pressure to demonstrate memory isolation and to communicate which generations remain exposed.
Third-order effects
If GPU-local-memory flaws continue to recur, hardware security assurance will increasingly need to cover accelerators alongside CPUs, not treat GPUs as peripheral compute components.
The pattern could favor designs and platform policies that make isolation failures easier to contain or update, though the extent depends on whether vendors can deliver effective mitigations for deployed hardware.
The trend: LeftoverLocals is one data point in the widening security perimeter of heterogeneous computing, where GPU and accelerator memory isolation is becoming as consequential as CPU-side protection.
it feels like the entire computation industry has been having a leaded paint, leaded gasoline, arsenic, or black mold moment every month for the last decade [embedded post]
Uh oh! A flaw in millions of Apple AMD and Qualcomm GPUs might expose AI data. Patching up the LeftoverLocals vulnerability in affected devices, including iPhones, iPads, and Macs, could be quite the challenge. Time for some serious digital housekeeping,... https://www.wired.com/…
We're finally revealing a significant co-resident GPU vulnerability impacting AMD, Apple, Qualcomm, and Imagination GPUs that allows an attacker to listen into another user's LLM (e.g., llama.cpp) session across process and container boundaries!
LeftoverLocals impacts the security posture of GPU applications, especially LLMs and ML models that run on impacted GPU platforms. It highlights that many parts of the ML development stack, specifically GPUs, have unknown security risks. Read more: http://www.leftoverlocals.com/ …
In pursuit of speed, many GPU frameworks do not clear GPU local memory after running a kernel. Attackers can recover LLM Q&A by running a kernel on the same GPU. https://twitter.com/...
Our PoC can listen to another user's llama.cpp session across process or container boundaries. LeftoverLocals can leak ~5.5 MB per GPU invocation on an AMD Radeon RX 7900 XT running a 7B model on llama.cpp, adding up to ~181 MB for each LLM query. https://www.youtube.com/... [vid…
This vulnerability was found by the talented @Tyler_UCSC and highlights the unknown security posture of the ML stack (i.e., GPUs) and the increased attack surfaces faced when deploying LLMs and ML models. Read the feature from Wired here: https://www.wired.com/...
Thinking about using “local LLMs” as a way to protect sensitive data? Hold that thought... “we were able to build a PoC where an attacker can listen into another user's interactive LLM session (e.g., llama.cpp) across process or container boundaries” https://blog.trailofbits.com/…
Today, we are disclosing LeftoverLocals, a vulnerability that allows listening to LLM responses through leaked GPU local memory created by another process on Apple, Qualcomm, AMD, and Imagination GPUs (CVE-2023-4969) https://blog.trailofbits.com/ ... [image]
Patching every device affected by the LeftoverLocals vulnerability—which includes some iPhones, iPads, and Macs—may prove difficult. https://www.wired.com/...
We surveyed the main GPUs available today, but there's a rush of new startups vying for marketshare. How are we assessing the safety of new developments? [image]
It was really fun doing this work over the summer at ToB! A huge thanks for all of their support and everyone who engaged with us over the last few months. It's an exciting time for GPUs, and I hope that security and privacy can start to be a bigger focus!