GPU Side-Channel Attacks: Timing, Power, and Cache-Based Information Leakage Across the Accelerator Stack
For executives
Side-channel attacks extract information from a computation not by reading memory directly but by observing indirect signals — how long a computation takes, how much power it draws, what memory access patterns it produces. GPUs have their own side-channel attack surface, and the growing use of GPUs for AI inference, cryptography, and sensitive computation makes it increasingly relevant. A co-located workload on a shared GPU can observe timing and cache access patterns of a target workload and use those observations to extract information the target was supposed to keep private.
The three main GPU side-channel channels
Timing channels exploit the fact that different computations take different amounts of time. A computation that accesses cached data runs faster than one that accesses uncached data. An attacker who can measure how long a target computation takes can infer something about what data it was accessing. For GPU inference: the time taken to process a user's query depends on the query's length and on how much the KV cache hits vs misses.
Cache-based channels use contention for shared cache resources. If an attacker's workload and a target workload both use the same GPU L2 cache, the attacker can observe which cache lines were evicted and infer which memory the target was accessing. Prime+Probe is the classic technique: the attacker fills the L2 cache (prime), waits for the target to run, then measures which of their cache lines have been evicted (probe).
Power analysis measures the power consumption of the GPU during computation. Different operations draw different amounts of power. In data centres where per-GPU power telemetry is available, power side-channels can reveal computational patterns without any software co-location.
Why AI inference is a high-value target
An attacker who can identify which model is running, the approximate length or structure of the input, and which layers are most active gains information that directly supports model extraction, targeted adversarial example generation, or input reconstruction.