Beneath the Prompt: The Hidden Risks Powering GenAI

### Overview In this presentation, Alex from Eclypsium explores the foundational hardware layers powering modern generative AI, shifting focus away from widely discussed topics like prompt injection to data center infrastructure risks. He highlights how the massive demand for AI performance has driven a hardware renaissance—featuring architectures from companies such as NVIDIA, Groq, SambaNova, and Cerebras—while introducing novel complexities, attack surfaces, and persistent threat vectors.

### Key Topics - **Evolution of Compute Architecture:** General-purpose compute (x86, ARM) dedicates 35–40% or more of chip die area to management and incorporates complex features such as out-of-order and speculative execution. Specialized GPUs dedicate less die space to management, while dedicated AI accelerators (such as Groq) dedicate as little as ~3% to management, stripping away caching, speculative execution, and out-of-order execution in favor of parallel, software-controlled execution. - **Inherited and Persistent Vulnerabilities:** Despite architectural advances, modern AI systems inherit classic vulnerabilities. Notably, Rowhammer bit-flipping attacks remain relevant in GPU memory, cybercriminal groups have leveraged GPUs to conceal malware, and vendor advisories (e.g., NVIDIA) consistently reveal traditional UEFI and BMC vulnerabilities. - **Attack Surfaces in High-Performance Accelerators:** Because accelerators like Groq rely on ultra-simplified instruction sets (~25 instructions) and direct memory mapping without traditional hardware protection rings, software controls the hardware directly. Once software is compromised, an attacker can jump directly to the accelerator, manipulate memory, or introduce persistent malicious loops or leftover code affecting future workloads.

### Technical Details - **NVIDIA GB200 Architecture:** Examined as state-of-the-art AI infrastructure (pairing two GPUs to one ARM-based CPU), introducing four distinct networking paradigms that each expand the attack surface: backend networking between racks, frontend networking, NVLink for high-speed intra-rack communication, and Baseboard Management Controller (BMC) networks. - **SmartNIC and DPU Attack Surface (BlueField-3):** NVIDIA’s BlueField-3 operates essentially as a standalone server embedded on a network card. It runs multiple firmware images (including ARM DPU firmware, data path accelerator firmware, adapter ROMs) and hosts its own BMC running OpenBMC or Ubuntu with IPMI, Redfish, and SSH access. Alex emphasizes the necessity of isolating BMCs on dedicated VLANs to prevent lateral movement, noting historical incidents where a single compromised BMC impacted 200,000 BMCs across a single geographic location. - **Cloud and Multi-Tenancy Realities:** Addressing audience questions on cloud environments, Alex explains that high-performance AI workloads frequently bypass deep virtualization in favor of bare-metal rentals or shallow sandboxing. This model introduces risks of sandbox escapes and malicious leftover code persisting across sequential tenant workloads.

### Takeaways Securing AI cannot stop at the application or model layer. As data centers deploy deeply interconnected GPUs, SmartNICs, and ASICs, defenders must evaluate the entire physical and firmware supply chain—auditing BMC segmentation, secure boot configurations, firmware patch status, and multi-tenant isolation.