Skip to main content
LLM Security Database
Skip to research details
Back to research findings
LMVD-ID: a843fd94
Paper published August 26, 2026
Entry analyzed September 9, 2026
Paper-reported evidence
Confidence: Source-linked

The LMVD-ID is an internal research identifier, not an official CVE identifier.

Cross-user data isolation in shared GPU serving

A compromised serving framework can violate user-data isolation through shared GPU state. GIFT evaluates per-user information-flow enforcement in vLLM and DistServe.

Infrastructure
Data privacy
Data security
Read primary paperBibTeX citation

Paper-evaluated models(6)

Qwen 2.5 14B, Qwen 2.5 32B, Qwen 2.5 72B +3 more
  • Qwen 2.5 14B
  • Qwen 2.5 32B
  • Qwen 2.5 72B
  • OPT 13B
  • OPT 30B
  • OPT 66B

Description

A compromised serving framework can violate user-data isolation through shared GPU state. GIFT evaluates per-user information-flow enforcement in vLLM and DistServe.

Examples

See the primary study (opens in a new tab).

Impact

The authors demonstrate cross-user context exposure and analyze a protected monitor intended to block such flows. Their ordinary GIFT evaluation reports up to 5% request-rate overhead at matched latency. Security depends on monitor, kernel-rule and CPU-data-handling assumptions; side channels and denial of service are excluded.

Affected Systems

  • Evaluated vLLM/DistServe integrations; the largest models are excluded from the single-H100 confidential-computing evaluation.

Mitigation Steps

  • Patch serving software and restrict administrative access.
  • Enforce per-user GPU-data ownership across kernels and cache movement.
  • Revalidate isolation when kernels or serving paths change.

Evidence

Research context and confidence

Evidence and verification
Paper-reported; independent reproduction is not documented.
Primary source plus a dedicated evidence section.
Severity
Not rated by this catalog.
Source and publication type
arXiv · Research preprint.
Peer-review status is not provided by this source.
Author and publication status
Author metadata is not stored; see the primary paper.
Threat model and attacker access
Not explicitly classified; consult the primary paper..
Related deployment categories
No related deployment category is classified.
Taxonomy labels only; paper-specific deployment prerequisites are not inferred.
Affected systems
Evaluated vLLM/DistServe integrations; the largest models are excluded from the single-H100 confidential-computing evaluation.

Research Paper

Here is a GIFT: Enforcing User Data Isolation in LLM Serving via GPU Information Flow Tracking

Primary source: arXiv. Findings are reported by the cited research and have not been independently verified.

View Paper

Related research