GPUThor: Amplifying Rowhammer Attacks via Non-Uniform Patterns to Exploit ECC-Protected GPUs

• URL: http://arxiv.org/abs/2609.16546v1
• Date: Tue, 15 Sep 2026 02:46:02 GMT
• Title: GPUThor: Amplifying Rowhammer Attacks via Non-Uniform Patterns to Exploit ECC-Protected GPUs
• Abstract summary: GPUThor is a high-intensity Rowhammer attack on NVIDIA GPU leveraging non-uniform hammering.<n>We present GPUThor, a high-intensity Rowhammer attack on NVIDIA GPU leveraging non-uniform hammering.
• Score: 2.823228784044236
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: GDDR memory in GPUs is vulnerable to Rowhammer attacks, where rapid memory accesses induce bit flips in adjacent cells, enabling data tampering and privilege escalation. However, prior GPU Rowhammer attacks trigger only tens to hundreds of bit flips, orders of magnitude fewer than CPU attacks, severely limiting their practical impact. This gap stems from the reliance of existing GPU Rowhammer attacks on uniform hammering patterns that activate aggressor and decoy rows equally, which results in low hammering intensity for aggressor rows. We present GPUThor, a high-intensity Rowhammer attack on NVIDIA GPUs leveraging non-uniform hammering. GPUThor reverse engineers GPU memory-access coalescing behavior to enable non-uniform hammering patterns on GPUs, that activate aggressor rows more intensely than decoy rows. Additionally, by identifying refresh instances when in-DRAM mitigations are applied, it constructs longer attack patterns that escape mitigation across refresh intervals, further increasing hammering intensity. Together, these techniques yield 500X to 23,500X more bit flips than prior GPU Rowhammer attacks, across several NVIDIA GPUs (A4000, A4500, A5000, A6000), reaching bit flip rates close to state-of-the-art CPU Rowhammer attacks. GPUThor also enables the first Rowhammer exploits on ECC-protected GPUs, inducing uncorrectable double and triple bit flips, making denial-of-service and privilege-escalation attacks practical even on GPUs with ECC enabled.

Related papers

• GPUBreach: Privilege Escalation Attacks on GPUs using Rowhammer [4.757465470743026]
  Rowhammer exploits have been limited to injecting untargeted bit-flips in victim data.<n>We demonstrate that GPU Rowhammer exploits can be as potent as CPU Rowhammer attacks.
  arXiv  Detail & Related papers  (2026-05-05T14:40:06Z)
• Towards an Accurate GPU Data Race Detector [3.031706914582872]
  Data races in GPU programs pose a threat to the reliability of GPU-accelerated software stacks.<n>Prior works proposed various dynamic (runtime) and static (compile-time) techniques to detect races in GPU programs.<n>We create HGRD, a new state-of-the-art static analysis technique that performs a holistic analysis of both CPU and GPU code.
  arXiv  Detail & Related papers  (2026-04-02T14:35:49Z)
• OpenGL GPU-Based Rowhammer Attack (Work in Progress) [0.0]
  This paper presents an adaptive, many-sided Rowhammer attack utilizing GPU compute shaders.<n>Our approach employs statistical distributions to optimize row targeting and avoid current mitigations.<n> Experimental results on a Raspberry Pi 4 demonstrate that the GPU-based approach attains a high rate of bit flips compared to traditional CPU-based hammering.
  arXiv  Detail & Related papers  (2025-09-24T10:11:05Z)
• GPUHammer: Rowhammer Attacks on GPU Memories are Practical [3.3625059118072107]
  We demonstrate the first successful Rowhammer attack on a discrete GPU.<n>We show how an attacker can use these to tamper with ML models, causing significant accuracy drops (up to 80%)<n>We also show how an attacker can use these to tamper with ML models, causing significant accuracy drops (up to 80%)
  arXiv  Detail & Related papers  (2025-07-10T20:57:47Z)
• Distributed Equivariant Graph Neural Networks for Large-Scale Electronic Structure Prediction [76.62155593340763]
  Equivariant Graph Neural Networks (eGNNs) trained on density-functional theory (DFT) data can potentially perform electronic structure prediction at unprecedented scales.<n>However, the graph representations required for this task tend to be densely connected.<n>We present a distributed eGNN implementation which leverages direct GPU communication and introduce a partitioning strategy of the input graph.
  arXiv  Detail & Related papers  (2025-07-04T23:53:47Z)
• Minute-Long Videos with Dual Parallelisms [57.22737565366549]
  Diffusion Transformer (DiT)-based video diffusion models generate high-quality videos at scale but incur prohibitive processing latency and memory costs for long videos.<n>We propose a novel distributed inference strategy, termed DualParal.<n>Instead of generating an entire video on a single GPU, we parallelize both temporal frames and model layers across GPUs.
  arXiv  Detail & Related papers  (2025-05-27T11:55:22Z)
• HeadInfer: Memory-Efficient LLM Inference by Head-wise Offloading [79.38548165722229]
  HEADINFER offloads the KV cache to CPU RAM while avoiding the need to fully store the KV cache for any transformer layer on the GPU.<n>We demonstrate HEADINFER maintains computational efficiency while significantly reducing memory footprint.
  arXiv  Detail & Related papers  (2025-02-18T06:26:05Z)
• Crypto Miner Attack: GPU Remote Code Execution Attacks [0.0]
  Remote Code Execution (RCE) exploits pose a significant threat to AI and ML systems.<n>This paper focuses on RCE attacks leveraging deserialization vulnerabilities and custom layers, such as Lambda layers.<n>We demonstrate an attack that utilizes these vulnerabilities to deploy a crypto miner on a GPU.
  arXiv  Detail & Related papers  (2025-02-09T19:26:47Z)
• NeRF-XL: Scaling NeRFs with Multiple GPUs [72.75214892939411]
  We present NeRF-XL, a principled method for distributing Neural Radiance Fields (NeRFs) across multiple GPU. We show improvements in reconstruction quality with larger parameter counts and speed improvements with more GPU. We demonstrate the effectiveness of NeRF-XL on a wide variety of datasets, including the largest open-source dataset to date, MatrixCity, containing 258K images covering a 25km2 city area.
  arXiv  Detail & Related papers  (2024-04-24T21:43:15Z)
• One-bit Flip is All You Need: When Bit-flip Attack Meets Model Training [54.622474306336635]
  A new weight modification attack called bit flip attack (BFA) was proposed, which exploits memory fault inject techniques. We propose a training-assisted bit flip attack, in which the adversary is involved in the training stage to build a high-risk model to release.
  arXiv  Detail & Related papers  (2023-08-12T09:34:43Z)
• Adversarial Attack on Large Scale Graph [58.741365277995044]
  Recent studies have shown that graph neural networks (GNNs) are vulnerable against perturbations due to lack of robustness. Currently, most works on attacking GNNs are mainly using gradient information to guide the attack and achieve outstanding performance. We argue that the main reason is that they have to use the whole graph for attacks, resulting in the increasing time and space complexity as the data scale grows. We present a practical metric named Degree Assortativity Change (DAC) to measure the impacts of adversarial attacks on graph data.
  arXiv  Detail & Related papers  (2020-09-08T02:17:55Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.