GPU Container Escape
Container escape is the attack where code running inside a container crosses the isolation boundary to execute on the underlying host.
LD_PRELOAD Hijacking
LD_PRELOAD is a Linux mechanism that has existed for decades.
Driver Exploit to Node
When an attacker exploits a vulnerability in the NVIDIA GPU driver from inside a container, they are not just compromising that container.
Malicious Container Image
Every GPU container starts from a base image.
Runtime Process Injection
Most container runtime security tools work by monitoring system calls made by container processes.
Cryptomining in Containers
Cryptomining inside GPU containers is the most financially immediate GPU infrastructure attack.
CUDA Kernel Cryptomining
The previous article covered why cryptomining detection fails at the utilisation level.
Compute Hijacking (K8s)
GPU compute hijacking is the large-scale version of container-based cryptomining: stealing not just a single GPU but an organisation's entire GPU cluster capaci
Model Weight Exfiltration
AI model weights are among the most valuable intellectual property an organisation creates.
Model Theft (Inference)
Model weights are not the only way to steal an AI model.
Training Data Poisoning
Training data poisoning is the attack where malicious data is introduced into a model's training dataset to manipulate the model's behaviour.
Gradient Leakage
Federated learning was designed to enable collaborative AI training without sharing raw data.
Model Inversion
Model inversion is the attack where an adversary uses a deployed model's outputs to reconstruct approximations of the data the model was trained on or the inputs that produced specific outputs.
GPU Memory Snooping
When a GPU workload finishes, the GPU memory it used is returned to the allocator.
GPU Side-Channel Attacks
Side-channel attacks extract information from a computation not by reading memory directly but by observing indirect signals — how long a computation takes, how
Prime+Probe (L2 Cache)
Prime+Probe is a cache-based side-channel attack technique that uses contention for shared cache resources to infer what another workload is accessing in memory.
Whispering Pixels
CVE-2024-21969 (Whispering Pixels) documented a specific and patchable vulnerability in AMD GPUs: uninitialized register state readable across processes.
Bandwidth Side-Channel
AI models have proprietary architectures that represent significant research investment.
MIG Isolation Violations
NVIDIA's Multi-Instance GPU (MIG) technology partitions a single GPU into multiple isolated instances with separate compute resources, memory, and caches.
vGPU Escape Attacks
NVIDIA Virtual GPU (vGPU) technology allows a single physical GPU to be shared among multiple virtual machines, each receiving a virtualised GPU with its own allocated resources.
Multi-Tenant GPU Risk
Every vulnerability in this library was found and patched in a lab environment.
Cross-Tenant Data Leakage
When a cloud GPU workload finishes and the GPU is returned to the pool for the next customer, what happens to the data in GPU memory?
Driver Privilege Escalation
The NVIDIA GPU driver is one of the largest kernel-mode codebases in regular use.
Node to Cluster Takeover
A GPU vulnerability that achieves code execution on a single Kubernetes node is not a bounded incident.
NVLink Lateral Movement
NVLink is NVIDIA's high-bandwidth GPU interconnect, providing bandwidth up to 900 GB/s for intra-node communication.
SBOM Gaps
A Software Bill of Materials (SBOM) is supposed to tell security teams what is in a container — which libraries, which versions, which dependencies — so that kn
k8s-device-plugin Supply Chain
The NVIDIA Kubernetes Device Plugin (k8s-device-plugin) is the Kubernetes component that manages GPU resource allocation and scheduling.