Skip to main content
LLM Security Database
Skip to research details
Back to research findings

Cross-user data isolation in shared GPU serving

A compromised serving framework can violate user-data isolation through shared GPU state. GIFT evaluates per-user information-flow enforcement in vLLM and DistServe.

Published
Analyzed
Paper-reported evidence
Primary source linked
Read primary paper
Cite & share
Source BibTeX

Citation metadata is maintained by the primary source and may reflect a later revision.

Paper-evaluated models(6)

Qwen 2.5 14B, Qwen 2.5 32B, Qwen 2.5 72B +3 more
  • Qwen 2.5 14B
  • Qwen 2.5 32B
  • Qwen 2.5 72B
  • OPT 13B
  • OPT 30B
  • OPT 66B
On this page

Description

A compromised serving framework can violate user-data isolation through shared GPU state. GIFT evaluates per-user information-flow enforcement in vLLM and DistServe.

Examples

See the primary study (opens in a new tab).

Impact

The authors demonstrate cross-user context exposure and analyze a protected monitor intended to block such flows. Their ordinary GIFT evaluation reports up to 5% request-rate overhead at matched latency. Security depends on monitor, kernel-rule and CPU-data-handling assumptions; side channels and denial of service are excluded.

Affected Systems

  • Evaluated vLLM/DistServe integrations; the largest models are excluded from the single-H100 confidential-computing evaluation.

Mitigation Steps

  • Patch serving software and restrict administrative access.
  • Enforce per-user GPU-data ownership across kernels and cache movement.
  • Revalidate isolation when kernels or serving paths change.

Evidence

Research context and provenance

Research topics
Infrastructure
Data privacy
Data security
Catalog identifier
LMVD-a843fd94
Internal research identifier, not an official CVE identifier.
Evidence and verification
Paper-reported; independent reproduction is not documented.
Primary source plus a dedicated evidence section.
Severity
Not rated by this catalog.
Source and publication type
arXiv · Research preprint.
Peer-review status is not provided by this source.
Author and publication status
Author metadata is not stored; see the primary paper.
Threat model and attacker access
Not explicitly classified; consult the primary paper.
Related deployment categories
No related deployment category is classified.
Taxonomy labels only; paper-specific deployment prerequisites are not inferred.
Affected systems
Evaluated vLLM/DistServe integrations; the largest models are excluded from the single-H100 confidential-computing evaluation.

Research Paper

Here is a GIFT: Enforcing User Data Isolation in LLM Serving via GPU Information Flow Tracking

Primary source: arXiv. Findings are reported by the cited research and have not been independently verified.

View Paper

Related research