Your GPU Neighbor Can Hear Your Model — Branislav Brzak, Stealthium
Co-tenants on shared H100 GPUs can fingerprint your LLM model and usage with ~97% accuracy via timing side-channels
“We can determine the model, architecture, and depth with 97% accuracy. We can determine the decoding speed with an accuracy of 99.3%.”
Cybersecurity researcher Branislav Brzak demonstrates that NVIDIA's Multi-Instance GPU isolation is insufficient to prevent timing-based side-channel leakage between cloud tenants. Without any special permissions or exploits, a co-tenant can identify the model architecture, decoding speed, token counts, and workload patterns of a neighboring LLM running on the same H100. While prompt content remains private, the metadata exposure is significant for enterprises concerned about revealing what models they run and how they use them.