Eclypium Research 显示运行时如何压缩硬件Can Alter AI模型

网络安全

Eclypium Research 显示运行时如何压缩硬件Can Alter AI模型

在 Google 上的首选来源中添加 Unite.AI

Eclypsium 已经证明，受损的计算基础设施如何改变AI模型在推论期间的行为，10月29日发表在《信任AI要求信任的基础设施》中

在NVIDIA支持的受控演示中，研究人员使用一个已失密的数据处理单元，即DPU，以及允许内存隔离来修改运行时间模型权重。 模型的答案不修改存储的模型或推论服务而改变。 发现将硬件，固件，设备配置置于AI安全边界内。

改变 AI 模型的不同路径

AI的安全讨论往往侧重于恶意的提示，有毒的训练数据，以及不安全的工具使用。 这一研究研究了下层：一个模型运行时持有和移动参数的基础设施。

重量是决定模型反应的数字参数。 磁盘上的有效文件可以装入内存，然后由一个足够特权的组件更改。 稍后对原始文件的检查仍然可以看到预期的字节，尽管一个答案是使用改变的运行时状态生成的。

极乐世界的展示明显改变了对地缘政治问题的分析产出。 更广泛的关切是，运行时间操纵可能影响其他敏感用途，包括生成的代码和自动决定。 这些可能性应与实验室显示的具体行为区分开来。

关于仍未被发现的说法也有一个界定的范围：演示中使用的存储式完整性检查没有揭示内存的变化。 这并不能证明任何形式的监测或法医检查都是隐形的。

攻击条件

测试使用了NVIDIA Grace Hopper环境。 它的直接-记忆-访问路径取决于一个受损的特权组件和配置设置，允许访问敏感的内存。 研究人员将IOMMU通过和允许PCIe隔离确定为重要条件，并明确指出这些不是默认的Linux设置。

一个IOMMU帮助控制一个外围可以到达的内存。 在研究人员测试的更强大的隔离配置中，没有同样的直接路径。 因此，结果突出表明，必须核查实际部署情况，而不是假定已安装的安全能力正在积极执行边界。

一个DPU是一个可编程的基础设施处理器，用于联网，存储和安全服务。 它高效移动数据的能力是有价值的，但如果攻击者获得对组件的控制，服务于合法基础设施功能的特权可能会变得危险。

NVIDIA的回应：验证信任边界

NVIDIA在介绍合作情况时描述了BlueField认证的靴子、基于硬件的信任、孤立、固件更新保护以及证明。 它还强调云运营商为不同的信任模式选择不同的安全配置。

公司的信息是，经营者需要这些选择的证据。 必须结合部署的威胁模式评估内存访问控制、设备隔离和管理接口。 仅凭一个特性的可用性并不能显示其配置正确。

NVIDIA和Eclypium也称这个问题超越了单一的供应商。 AI系统依赖于特权主机软件，加速器固件，管理控制器，以及数据传输机制。 具体路径因结构而异；对这些组件进行核算的必要性并不不同。

为什么Agent安全也取决于基础设施安全

当一个模型可以调用工具、获取企业数据或发起行动时，利害关系就会增加。 基础设施的篡改会破坏应用一级保障措施对实际运行的模型所作的假设。

NVIDIA的Open Agent安全平台展示了分层反应。 OpenShell提供运行时间治理，而BlueField上的NVIDIA Sentry则从主机和agent以外的硬件同化安全域运行。 该架构旨在从单独的控制点监测行为和执行政策。

这一独立立场产生了另一个安全责任：执法硬件及其软件堆必须自己保持可信。 把控制移到应用程序之外会减少一种依赖性，同时增加核查受委托控制部件的重要性。

从硬件库存到持续保证

以模型为重点的保证和基础设施完整性之间的脱节称为“AI基础设施保证差距”。 其基础设施保证平台库存组件，评估固件和配置，将设备状态与核准的基线进行比较，并监测变化。 公司认为这些能力是对现有应用和示范保障措施的补充。

对运营商来说，实际工作始于将DPU,GPU，管理控制器，及其固件作为单独管理的资产处理。 每一个进程都需要所有权、版本跟踪、脆弱性评估以及理解的更新进程。 管理-飞机接入和基础设施处理器的第三方软件属于这一审查。

检查还应通过部署、更新、事件恢复和调任跟踪硬件。 一个干净的操作系统图像本身并不能确定每个低层组件都处于核定状态。 共享的基础设施使得这种生命周期特别具有后果，因为硬件可能服务于连续的客户。

正在检查运行系统，不仅仅是艺术

模型签名仍然有用：它们回答了关于正在装载文物的重要问题。 安全启动证明运行时间隔离持续监控解答了执行系统的不同问题任何人都不应被作为所有其他人的替代品。

Eclypsium的研究的意义在于，一个模型可以通过一个完整性检查，而其执行链的另一部分却发生了变化。 对于将AI引入相应工作流程的组织，在整个业务中，基础设施核查需要伴随模型评价。

本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。

Cybersecurity

Eclypsium Research Shows How Compromised Hardware Can Alter AI Models at Runtime

Add Unite.AI to your preferred sources on Google

Eclypsium has demonstrated how compromised computing infrastructure can change an AI model’s behavior during inference while its original files remain intact. The research, published October 29 in Trusted AI Requires Trusted Infrastructure, shows why checking a model’s signature or file hash does not establish the integrity of the model executing in memory.

In a controlled demonstration supported by NVIDIA, researchers used a compromised data processing unit, or DPU, together with permissive memory isolation to modify runtime model weights. The model’s answers changed without modifying the stored model or inference service. The finding places hardware, firmware, and device configuration inside the AI security boundary.

A Different Route to Changing an AI Model

AI security discussions often focus on malicious prompts, poisoned training data, and unsafe tool use. This research examines a lower layer: the infrastructure that holds and moves a model’s parameters while it runs.

Weights are the numerical parameters that shape a model’s responses. A valid file on disk can be loaded into memory and subsequently changed by a sufficiently privileged component. A later check of the original file still sees the expected bytes, even though an answer was generated using altered runtime state.

Eclypsium’s demonstration visibly changed analytical output on a geopolitical question. The broader concern is that runtime manipulation could affect other sensitive uses, including generated code and automated decisions. Those possibilities should be distinguished from the specific behavior shown in the laboratory.

The claim of remaining undetected also has a defined scope: the stored-model integrity checks used in the demonstration did not reveal the memory changes. That does not establish invisibility to every form of monitoring or forensic examination.

The Attack Conditions Matter

The test used a NVIDIA Grace Hopper environment. Its direct-memory-access path depended on a compromised privileged component and configuration settings that allowed access to sensitive memory. The researchers identify IOMMU passthrough and permissive PCIe isolation as important conditions, explicitly noting that these were not the default Linux settings.

An IOMMU helps control which memory a peripheral can reach. In the stronger isolation configuration tested by the researchers, the same direct path was unavailable. The result therefore underscores the importance of verifying actual deployment settings, rather than assuming that an installed security capability is actively enforcing a boundary.

A DPU is a programmable infrastructure processor used for networking, storage, and security services. Its ability to move data efficiently is valuable, but privileges that serve legitimate infrastructure functions can become dangerous if an attacker gains control of the component.

NVIDIA’s Response: Verify the Trust Boundaries

In its account of the collaboration, NVIDIA describes BlueField’s authenticated boot, hardware-rooted trust, isolation, firmware-update protections, and attestation. It also emphasizes that cloud operators choose different security configurations for different trust models.

The companies’ message is that operators need evidence about those choices. Memory-access controls, device isolation, and management interfaces must be assessed in the context of a deployment’s threat model. A feature’s availability alone does not show that it is correctly configured.

NVIDIA and Eclypsium also describe the issue as extending beyond a single vendor. AI systems depend on privileged host software, accelerator firmware, management controllers, and data-transfer mechanisms. The exact paths differ by architecture; the need to account for those components does not.

Why Agent Security Also Depends on Infrastructure Security

The stakes grow when a model can call tools, access enterprise data, or initiate actions. Infrastructure tampering can undermine assumptions made by application-level safeguards about which model is actually running.

NVIDIA’s Open Agent Safety Platform illustrates the layered response. OpenShell provides runtime governance, while NVIDIA Sentry on BlueField operates from a hardware-isolated security domain outside the host and agent. The architecture aims to monitor behavior and enforce policy from a separate control point.

That independent position creates another security responsibility: the enforcement hardware and its software stack must themselves remain trustworthy. Moving a control outside the application reduces one dependency while increasing the importance of verifying the component entrusted with that control.

From Hardware Inventory to Continuous Assurance

Eclypsium calls the disconnect between model-focused assurance and infrastructure integrity the “AI Infrastructure Assurance Gap.” Its infrastructure assurance platform inventories components, assesses firmware and configuration, compares device state with approved baselines, and monitors changes. The company positions those capabilities as complementary to existing application and model safeguards.

For operators, the practical work begins with treating DPUs, GPUs, management controllers, and their firmware as individually managed assets. Each needs ownership, version tracking, vulnerability assessment, and an understood update process. Management-plane access and third-party software on infrastructure processors belong in that review.

Checks should also follow the hardware through deployment, updates, incident recovery, and reassignment. A clean operating-system image does not by itself establish that every lower-level component is in an approved state. Shared infrastructure makes that lifecycle especially consequential because hardware may serve successive customers.

Checking the Running System, Not Just the Artifact

Model signatures remain useful: they answer an important question about the artifact being loaded. Secure boot, attestation, runtime isolation, and continuous monitoring answer different questions about the system that executes it. None should be treated as a substitute for all the others.

The significance of Eclypsium’s research is that a model can pass one integrity check while another part of its execution chain has changed. For organizations deploying AI into consequential workflows, infrastructure verification needs to accompany model evaluation throughout operation.

Auto-fetched and translated by AI Atlas. All rights belong to the original author.