vGPU vs MIG vs Time-Slicing: The Three GPU Sharing Models and Their Security Tradeoffs
For executives
When an organisation decides to share expensive GPU hardware between multiple users or workloads, it has three primary options: time-slicing, vGPU, or MIG. Each makes different tradeoffs between resource efficiency, flexibility, and isolation strength. Understanding those tradeoffs is essential for making an informed security decision. This article compares the three models along the dimensions that matter for security teams.
Time-slicing: maximum flexibility, minimum isolation
Time-slicing gives each workload full exclusive access to the GPU for a time quantum, then switches to the next workload. It is the simplest sharing model: the hardware does not need to be partitioned, and any GPU can be time-sliced without special hardware support.
Security properties:
Memory isolation: none. When a workload's time slice ends, its VRAM data remains in place until the next workload overwrites it. The next workload can read residual VRAM from the previous workload.
Compute isolation: temporal, not spatial. Workloads do not run simultaneously, so there is no real-time interference. But timing side-channels exist: a workload can measure how its GPU accesses are impacted by the previous workload's cache state.
Resource guarantees: none in the default configuration. A workload that uses its full time slice continuously can starve other workloads. This is a denial-of-service vector, not an isolation failure.
Use case: appropriate for development environments where multiple developers share a GPU for testing, or for inference workloads where the model is the same for all users and isolation is not a concern. Not appropriate for multi-tenant production environments.
vGPU: flexible isolation via software mediation
vGPU provides each virtual machine with a virtualised GPU that looks like real hardware. The vGPU Manager (running on the hypervisor host) mediates all GPU operations, providing software-enforced isolation between guest VMs.
Security properties:
Memory isolation: software-enforced via the vGPU Manager. The Manager allocates separate VRAM regions to each vGPU and enforces that guest operations stay within their allocation. This isolation is as strong as the vGPU Manager's implementation — which is why vGPU Manager vulnerabilities (CVE-2024-0146, CVE-2025-23245, CVE-2025-23246) break that isolation.
Compute isolation: enforced by the vGPU Manager's scheduling. Guest VMs run GPU workloads via the Manager rather than directly, providing a mediation layer.
Performance: the vGPU Manager's mediation introduces overhead. vGPU performance is typically somewhat below bare-metal GPU performance.
IOMMU protection: vGPU can use the CPU's IOMMU (Input-Output Memory Management Unit) to provide hardware protection for DMA operations between the GPU and host memory, adding a hardware isolation layer on the PCIe path.
Live migration: unlike MIG, vGPU supports live migration of guest VMs between hosts, useful for cloud infrastructure flexibility.
Use case: appropriate for virtualised enterprise environments where guest VMs need GPU access and live migration is required. The vGPU Manager is the trust boundary and must be kept patched.
MIG: hardware-enforced isolation with fixed partitions
MIG partitions the GPU at the hardware level into fixed, isolated GPU Instances. Each instance has dedicated compute resources, memory, and cache.
Security properties:
Memory isolation: hardware-enforced at the memory controller level. Stronger than vGPU's software enforcement.
Compute isolation: hardware-enforced via dedicated SM allocation. No software mediation between workloads — the hardware prevents access to other partitions' compute resources.
Cache isolation: dedicated L2 cache slices per partition, eliminating L2 cache side-channels.
Limitations: fixed partition sizes (cannot dynamically resize while workloads are running), no live migration support, available only on A100, H100, and later server GPUs.
Use case: appropriate for multi-tenant AI cloud services and enterprise environments where strong isolation guarantees are required and the fixed partition model fits the workload profile.
The decision matrix
| Time-Slicing | vGPU | MIG | |
|---|---|---|---|
| Memory isolation | None | Software | Hardware |
| Compute isolation | None | Software | Hardware |
| Cache isolation | None | Partial | Hardware |
| Flexibility | High | High | Fixed partitions |
| Live migration | No | Yes | No |
| Performance overhead | Low | Medium | Low |
| Attack surface | Minimal (no mediation) | vGPU Manager | Driver + MIG Manager |
For production AI environments serving multiple users with sensitive data, MIG on supported hardware provides the strongest isolation. For environments where flexibility and live migration are required and the vGPU Manager attack surface is acceptable, vGPU is appropriate. Time-slicing is not appropriate for isolation-sensitive multi-tenant workloads.