From the NVIDIA edition of October 29, 2026
Eclypsium report: on a GH200 test system with IOMMU passthrough, a compromised BlueField DPU changed model weights in memory while the model file, hash and signature stayed valid
Eclypsium (research coordinated with NVIDIA) · AI infrastructure security (vendor research report) · Global (U.S.-based researcher)
- Publisher
- Eclypsium Research
- Original publication
- 2026-10-29
- Source retrieved
- 2026-10-30
What happened
Eclypsium's 15-page report describes a proof of concept on a controlled NVIDIA GH200 system with a BlueField DPU. Using DMA from the DPU, with the IOMMU in passthrough mode and permissive PCIe isolation, the researchers scanned host and GPU memory at about 3 GB/s and overwrote selected model tensors, generally in under a minute, after load-time checks had passed. The report says these are not default Linux settings and that with stronger DMA isolation and IOMMU configuration the same path was unavailable. It lists checks operators can run (IOMMU translation, PCIe ACS, ATS) and recommends inventorying BMC, DPU and GPU firmware as first-class assets.
Why it matters
State agencies, universities and research computing centers now run their own GPU servers for AI inference and research. The report shows that a valid model hash does not prove the running model is unchanged, and it gives concrete configuration checks that agency and campus infrastructure teams can verify on existing NVIDIA systems.
Evidence and measured results
Company research report describing a single laboratory demonstration with methods, configuration preconditions and mitigations; coordinated with NVIDIA; no independent replication, success rates or production incidents reported.
Limitations and uncertainty
Vendor research by a company that sells infrastructure-assurance products and partners with NVIDIA; one controlled test platform (GH200) with weakened isolation and IPMI enabled; not demonstrated on every accelerator; no production exploitation reported.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-30; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Agencies and campuses running their own GPU servers assume a verified model file means the running model is trustworthy.
- Stakeholders
- CISO
- Research computing director
- Infrastructure manager
- AI program lead
- Discovery questions
- Which GPU servers run with IOMMU passthrough or relaxed PCIe isolation?
- Who owns BMC and DPU firmware patching?
- Are management interfaces segmented and is IPMI disabled?
- Value hypothesis
- A configuration review against the report's checks can close the specific path demonstrated and improve evidence for auditors.
- Potential engagement
- Configuration and firmware-inventory assessment of existing GPU servers against the report's checks.
- Unsupported claims
- That the attack is common or has occurred in production
- That any single product prevents all runtime tampering
- That the finding applies identically to every platform
Pre-sales engineering
Role takeaway
- Fit
- Organizations operating on-premises NVIDIA GPU servers with DPUs or BMCs.
- Architecture and integration
- IOMMU translation, PCIe ACS/ATS controls and segmented management networks sit beneath the inference stack; confidential computing where supported.
- Prerequisites
- Host and device inventory
- Access to kernel boot parameters and lspci output
- Management network segmentation
- Constraints
- Demonstrated on one GH200 configuration with weakened isolation
- Some performance tuning relies on passthrough
- Not shown on other accelerators
- Security
- Keep IOMMU translation enabled, verify ACS and ATS control bits, segment BMC/DPU networks and monitor firmware drift.
- Proof of value
- Audit each GPU host's IOMMU and ACS/ATS state
- Benchmark the performance effect of strict isolation on a representative workload
Delivery
Role takeaway
- Work
- Build and apply a GPU-server hardening checklist across the hardware lifecycle.
- Dependencies
- Infrastructure operations
- Security operations
- Hardware vendor guidance
- Ownership
- Infrastructure operations, with oversight from the CISO.
- Skills and adoption
- Train server administrators on IOMMU, PCIe and BMC/DPU firmware management.
- Governance checkpoints
- Checklist applied before production
- Re-check after firmware updates and incident recovery
- Exceptions approved with expiry
- Acceptance criteria
- Proposed: all GPU hosts report IOMMU translation enabled or a documented exception
- Proposed: BMC and DPU firmware inventoried with named owners
- Risks
- Performance regressions from strict isolation
- Unpatched management firmware
- False assurance from configuration checks alone
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
IOMMU translation, PCIe ACS and ATS settings become part of the AI security boundary; DPUs and BMCs must be treated as privileged computers; confidential computing on Hopper, Blackwell and Vera Rubin reduces the components that must be trusted.
Governance
Who approves, reviews and stays accountable for outcomes?
Performance-tuning choices such as IOMMU passthrough should be documented as risk acceptances with time limits and measured benefit, as the report recommends.
Security and privacy
What data, permissions and controls need testing?
A privileged infrastructure component could also read weights, adapters, system prompts and runtime context from memory, which matters for agencies hosting models that process sensitive data.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Requires infrastructure staff who understand firmware, PCIe and IOMMU configuration, skills that many public-sector IT teams lack.
Procurement
What should contracts, pricing and exit terms secure?
Agencies buying GPU servers or AI cloud capacity can ask vendors for secure-mode configuration profiles, firmware inventories and attestation evidence for BMCs and DPUs.
Operating model
Which teams own the service once it runs?
Shifts AI assurance from a one-time model check to continuous monitoring of the hardware and firmware beneath the model.
Publication history
- 2026-10-29NVIDIA · Issue 547 resources
Stable resource ID: eclypsium-trusted-ai-infrastructure-runtime-weight-tampering-report-20261029