Eclypsium demonstrates AI memory tampering while model files pass checks

Eclypsium disclosed an experiment on October 29 in which an AI model’s answers changed while its stored files remained intact. It announced hardware-and-firmware verification work with NVIDIA.

The GH200 test required privileged access to a data processing unit (DPU) and permissive memory settings. For AI operators, model-file hashes check stored bytes; inference uses parameters loaded into memory.

The researchers changed values after the model had loaded. Their configuration used IOMMU passthrough and permissive PCIe isolation. The report says these are not the Linux defaults and that stronger isolation blocked the same direct memory path.

Eclypsium’s published coding-demo description presents a developer building a security-critical banking application. The developer asks which hash function to use for signed software artifacts and firmware from untrusted suppliers, specifying a system expected to operate for more than ten years. According to the company, the unmodified model recommends SHA-3-512. After its weights are altered in memory, it recommends MD5 for all hashing needs. The example links the integrity gap to a concrete development decision: which mechanism will check externally supplied software. It describes a laboratory scenario, with no announcement that the resulting code was deployed at a bank.

CERT/CC’s December 31, 2008 notice describes MD5 as cryptographically broken: collisions can allow forged data to appear authentic.

CNN asked two independent hardware security experts to review the findings. Joe FitzPatrick considered them credible because they followed the principles of direct memory access attacks. Dominic Rizzo described a general attack path in modern infrastructure. NVIDIA told CNN that it had reviewed hypothetical scenarios already known to the industry and that strong memory protections could block the path.

The security processor needs its own boundary

NVIDIA’s existing BlueField documentation distinguishes ordinary, host-trusted DPU operation from a restricted Zero Trust mode. In ordinary DPU mode, the embedded Arm subsystem manages network resources and the data path. Infrastructure services run separately from applications on the host operating system, giving the processor its own role in managing the machine.

Zero Trust mode restricts a host administrator’s access to BlueField from the server side. The data-center administrator instead controls it through its own processor or management connection. Host firmware flashing and tracing can also be restricted. These controls define who administers the independent monitoring device.

In its October 29 account of the collaboration, NVIDIA paired built-in protections with independent assessment. BlueField provides authenticated boot, protected key management, secure firmware updates, rollback protection and device attestation. Eclypsium compares hardware, firmware and configuration with approved baselines and monitors unexpected changes.

NVIDIA describes deployment baselines, ongoing monitoring and reassessment after updates, recovery or tenant changes. Some components persist across operating-system reinstalls. Boot measurements show starting conditions, while runtime verification addresses subsequent changes. A model-file check establishes the state of the disk artifact.

Eclypsium labels its demonstration controlled research. It says its continuing collaboration with NVIDIA addresses infrastructure and supply-chain assurance, alongside a published technical report covering vulnerabilities and available mitigations.