Training Data Poisoning via the GPU Pipeline: Injecting Manipulation at the Hardware Layer
For executives
Training data poisoning is the attack where malicious data is introduced into a model's training dataset to manipulate the model's behaviour. Less discussed is the GPU pipeline layer: where training data passes through GPU memory during training, and where an attacker who controls the training infrastructure or has code execution in the training environment can inject manipulated data at the hardware level, bypassing dataset-level validation entirely.
Poisoning at the data layer vs the pipeline layer
Dataset-level poisoning targets training data before it reaches the training pipeline and is visible to dataset auditing and quality control processes.
Pipeline-level poisoning operates inside the training infrastructure. The attacker modifies data as it flows through the training pipeline — after it has passed any dataset validation, during the preprocessing, batching, or GPU transfer stages. The training data that reaches the model is different from what was in the dataset.
This attack requires access to the training environment. The Megatron-LM, NVFLARE, and Resiliency Extension vulnerabilities in this library document multiple ways to gain code execution in training infrastructure.
The GPU memory access point
Data poisoning at the GPU pipeline layer is possible at the moment when training batches are transferred from CPU memory to GPU memory — a cudaMemcpy(HostToDevice) call. An attacker with code execution in the training process can intercept this transfer, modify the batch data in CPU memory before it is copied to the GPU, and allow the modified batch to proceed. The training kernel receives poisoned data. The model updates its weights based on poisoned gradients.
Subtle poisoning: backdoor attacks
The most effective training data poisoning implants a hidden backdoor. The model learns to behave normally on clean inputs and to produce attacker-chosen outputs when specific trigger patterns are present. At the GPU pipeline level, backdoor injection can modify a small fraction of training batches — adding a specific pixel pattern to images, appending a specific token sequence to text samples — while leaving the majority of training data unmodified.
Detection
Detecting GPU pipeline poisoning requires monitoring the data pipeline at the point of GPU transfer. Checksums of training batches computed before and after the CPU-to-GPU transfer detect modification in transit.