Eclypsium shows compromised DPU can alter AI model weights at runtime

Eclypsium demonstrated that a compromised DPU plus permissive memory isolation can change an AI model's runtime weights during inference while the stored model file stays intact. The test ran on an NVIDIA Grace Hopper environment with NVIDIA's support, and researchers note IOMMU passthrough and weak PCIe isolation are not default Linux settings.

• Runtime weight tampering changes answers without touching the stored model file
• Demonstration ran on NVIDIA Grace Hopper with NVIDIA's collaboration
• Attack required IOMMU passthrough and permissive PCIe isolation
• Stronger isolation blocked the same direct memory access path