Prime+Probe on GPU L2 Cache: Cross-Workload Fingerprinting and Data Recovery
For executives
Prime+Probe is a cache-based side-channel attack technique that uses contention for shared cache resources to infer what another workload is accessing in memory. It has been demonstrated working on GPU L2 caches — meaning that on a shared GPU, an attacker's workload can observe the cache access patterns of a co-located target workload. Those patterns can be used to fingerprint which application is running, reconstruct memory access sequences, and in some cases recover partial information about the target's data.
How shared cache creates a side channel
A GPU's L2 cache has finite capacity. When it fills, the least-recently-used cache lines are evicted. When one workload accesses a memory location, it may evict a cache line that another workload had placed there. This eviction is observable: the workload whose line was evicted experiences a cache miss — a measurable latency increase.
The Prime+Probe technique
Prime: the attacker fills specific cache sets with their own data, establishing a known cache state. Wait: the target workload runs. Probe: the attacker measures the access time for each primed cache line. Slower lines were evicted — the target accessed those cache sets.
The result is a map of which cache sets the target accessed during its execution window. This reveals the target's memory access pattern at cache-set granularity.
Application to GPU L2 cache
Research (Naghibijouybari et al., 2018, "Rendered Insecure: GPU Side Channel Attacks are Practical") and subsequent work demonstrated that Prime+Probe on GPU L2 caches is practical. The attack can fingerprint which application is running on the target GPU with accuracy in the 90%+ range, and in some architectures partially reconstruct the input data based on the access pattern.
Practical attack constraints
Prime+Probe on GPU caches requires co-location on the same GPU. In environments where MIG is used and properly configured, hardware partitioning of the L2 cache between MIG instances reduces cross-instance cache visibility. In time-sliced environments, the attacker and target workload do not run simultaneously, limiting the attack to residual cache state analysis.