Model Weight Exfiltration: Reading Proprietary Weights from GPU Memory Before Egress
For executives
AI model weights are among the most valuable intellectual property an organisation creates. An attacker who can read those weights from GPU memory can steal the model without ever accessing the organisation's model storage, file servers, or export controls — because the weights are in GPU memory while the model is running, and GPU memory is accessible to anyone who can execute code in that address space.
Where model weights live during inference
When a model is loaded for inference, its weights are transferred from storage into GPU memory — VRAM. The weights remain in VRAM for the duration of the inference session. In a production inference deployment running a large language model with hundreds of billions of parameters, that means hundreds of gigabytes of proprietary model weights are resident in VRAM continuously.
Access paths to GPU memory
Container-level access: an attacker who has gained code execution inside a container that has GPU access can use the CUDA API to read GPU memory. cudaMemcpy() copies data from device memory to host memory.
Driver-level access: an attacker who has exploited a GPU driver vulnerability and achieved kernel-level execution can read arbitrary GPU device memory directly, bypassing the CUDA API entirely.
Co-location in multi-tenant environments: in shared GPU environments without adequate isolation, a tenant's CUDA context may be able to read residual memory from other tenants' previous GPU operations.
The exfiltration path
Once an attacker has read GPU memory contents into their process's CPU memory, exfiltration is a network transfer. A 70B parameter model in fp16 is approximately 140GB — but exfiltration does not need to happen in a single burst. An attacker with persistent access can exfiltrate incrementally, blending with legitimate model syncing and telemetry traffic.
What makes GPU memory exfiltration distinct
Stealing model weights from storage requires access to the storage system, which typically has access controls and audit logging. Stealing model weights from GPU memory during inference requires access to the GPU execution context, which typically has no audit logging whatsoever.
Detection
GPU memory access patterns: tracking which processes perform large cudaMemcpy(DeviceToHost) transfers of unusual size at unusual times. A legitimate inference process does not transfer model weights back to CPU memory during normal operation.