CloakLM: Obfuscating GPU Memory Layout to Mitigate Model Ex-filtration for Serving

• URL: http://arxiv.org/abs/2606.18400v1
• Date: Tue, 16 Jun 2026 18:47:47 GMT
• Title: CloakLM: Obfuscating GPU Memory Layout to Mitigate Model Ex-filtration for Serving
• Abstract summary: Large foundation models deployed on third-party and shared accelerator infrastructure face a practical risk of model exfiltration.<n>Co-tenant workloads can further access memory-mapped interfaces or RDMA regions without physical co-location.<n>We present CloakLM, a software-only memory-obfuscation framework that removes this regularity without changing the inference stack's logical view of memory.
• Score: 2.408411453763233
• License: http://creativecommons.org/licenses/by-sa/4.0/
• Abstract: Large foundation models deployed on third-party and shared accelerator infrastructure face a practical risk of model exfiltration that existing defenses do not fully address. In common serving deployments, model providers control the VM or bare-metal serving stack but not the surrounding hardware substrate. The host to GPU interconnect, accelerator fabric, and neighboring infrastructure components remain outside the tenant's trust boundary and have been shown to be exploitable. Hermes demonstrates lossless DNN reconstruction from passive PCIe observation, while TunnelS exfiltrates HBM contents at high throughput via driver-level access without disrupting inference. Co-tenant VMs can further access memory-mapped interfaces or misconfigured RDMA regions without physical co-location. These attacks exploit a common property of ML systems: model weights are stored in large, contiguous, and repeatedly accessed memory regions, making intercepted PCIe transfers and HBM dumps rich enough to reveal model structure and parameters. We present CloakLM, a software-only memory-obfuscation framework that removes this structural regularity without changing the inference stack's logical view of memory. CloakLM combines three mechanisms: PCIe traffic shaping, inter- and intra-layer weight shuffling, and physical HBM page remapping. Authorized execution retains a valid virtual memory layout with negligible overhead, while unauthorized observers see fragmented and semantically incoherent state. CloakLM integrates with vLLM and PyTorch, requires no hardware changes, and complements confidential computing. Evaluation on distributed inference workloads using LLaMA and Qwen models shows near-native performance while significantly increasing resistance to PCIe snooping and HBM dump attacks, making inference-time model exfiltration substantially less practical.

Related papers

• LMSM: LLM Security Framework Inspired by Linux Security Modules [56.93644694627783]
  Large language models (LLMs) are increasingly deployed with layered defenses, yet malicious prompts can still bypass them.<n>We present Language Model Security Modules (LMSM), a security framework that adapts the separation behind Linux Security Modules (LSM) to LLM serving.
  arXiv  Detail & Related papers  (2026-08-26T12:13:05Z)
• Dual-Grained Agent Memory and Shapley Context Attribution for Multimodal Agentic Learner [55.80248281761638]
  multimodal large language models (MLLMs) deliver impressive perception yet still falter on scientific and mathematical reasoning.<n>We propose DG-Mem, a dual-grained agentic memory framework that augments a frozen MLLM with a non- externally stored memory built once from training-time rollouts and consulted read-only at test time.
  arXiv  Detail & Related papers  (2026-08-24T13:56:01Z)
• Isolation Failure From Shared Storage: Characterizing and Exploiting Page-Cache SCA Leakage Across Containers and VMs [30.297643848902776]
  We investigate whether unprivileged timing measurements can reveal page-cache residency across isolation boundaries.<n>Results place page-cache attacks within the broader class of OS-mediated microarchitectural timing channels.
  arXiv  Detail & Related papers  (2026-07-20T03:47:34Z)
• Memory is Reconstructed, Not Retrieved: Graph Memory for LLM Agents [51.30250860677378]
  We propose MRAgent, a framework that combines an associative memory graph with an active reconstruction mechanism.<n>Running on a Cue-Tag-Content graph, our active reconstruction mechanism integrates reasoning directly into memory access.<n>Experiments on the LoCoMo benchmark and LongMemEval benchmark demonstrate significant improvements over strong baselines.
  arXiv  Detail & Related papers  (2026-06-04T11:29:46Z)
• Pomegranate: A Lightweight Compartmentalization Architecture using Virtualization Extensions [0.0]
  Pomegranate is a framework that securely compartmentalizes an existing system with minimal to no modifications to its source code.<n>We demonstrate the efficacy of Pomegranate on a compartmentalized Linux network stack using the igc NIC driver.
  arXiv  Detail & Related papers  (2026-05-07T22:44:40Z)
• Tessera: Secure, Near-Line-Rate Weight Streaming for UMA Edge Accelerators [0.0]
  Tessera is a reference architecture for inline, cache-line weight decryption on UMA edge accelerators.<n>The design intercepts 64-byte AXI bursts, computing AES-256-CTR keystreams in sparse parallel with DRAM fetches.<n>We show that Tessera is projected to achieve 98.4% of the theoretical memory bandwidth ceiling.
  arXiv  Detail & Related papers  (2026-04-25T08:29:50Z)
• DexWorldModel: Causal Latent World Modeling towards Automated Learning of Embodied Tasks [54.32016216994156]
  We introduce the Causal Latent World Model (CLWM), which employs DINOv3 features as generative targets to disentangle interaction semantics from visual noise.<n>To overcome memory scaling, CLWM features a Dual-State Test-Time Training (TTT) Memory that guarantees a strict $mathcalO(1)$ footprint for long-horizon tasks.<n>We present EmbodiChain, an online framework that establishes the Efficiency Law by injecting an infinite flow of physics-grounded trajectories during training.
  arXiv  Detail & Related papers  (2026-04-13T03:19:36Z)
• Multi-Probe Zero Collision Hash (MPZCH): Mitigating Embedding Collisions and Enhancing Model Freshness in Large-Scale Recommenders [47.3074050788206]
  Multi-Probe Zero Collision Hash (MPZCH) is a novel indexing mechanism based on linear probing.<n>MPZCH achieves zero collisions for user embeddings and significantly improves item embedding freshness and quality.<n>The solution has been released within the open-source TorchRec library for the broader community.
  arXiv  Detail & Related papers  (2026-02-19T03:42:57Z)
• ZipMoE: Efficient On-Device MoE Serving via Lossless Compression and Cache-Affinity Scheduling [56.88966608455977]
  ZipMoE exploits the synergy between the hardware properties of edge devices and the statistical redundancy inherent to MoE parameters.<n>ZipMoE achieves up to $72.77%$ inference latency reduction and up to $6.76times$ higher throughput than the state-of-the-art systems.
  arXiv  Detail & Related papers  (2026-01-29T02:51:59Z)
• BOLT: Bandwidth-Optimized Lightning-Fast Oblivious Map powered by Secure HBM Accelerators [13.90111222973057]
  Cloud Execution Environments are vulnerable to access pattern leakages.<n>Oblivious Maps mitigate this by hiding access patterns but suffer from high overhead.<n>We present BOLT, a Bandwidth Optimized, Lightning-fast OMAP accelerator.
  arXiv  Detail & Related papers  (2025-09-01T19:49:21Z)
• GME: GPU-based Microarchitectural Extensions to Accelerate Homomorphic Encryption [33.87964584665433]
  Homomorphic Encryption (FHE) enables the processing of encrypted data without decrypting it. FHE introduces a slowdown of up to five orders of magnitude as compared to the same computation using plaintext data. We propose GME, which combines three key microarchitectural extensions along with a compile-time optimization to the current AMD CDNA GPU architecture.
  arXiv  Detail & Related papers  (2023-09-20T01:50:43Z)
• FusionAI: Decentralized Training and Deploying LLMs with Massive Consumer-Level GPUs [57.12856172329322]
  We envision a decentralized system unlocking the potential vast untapped consumer-level GPU. This system faces critical challenges, including limited CPU and GPU memory, low network bandwidth, the variability of peer and device heterogeneity.
  arXiv  Detail & Related papers  (2023-09-03T13:27:56Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.