Eclypsium shows how compromised hardware can change AI answers without altering model files

An AI model can pass checks on its stored files while delivering answers altered by an attacker. In research disclosed October 29, Eclypsium demonstrated how compromised computing infrastructure could change a running model’s behavior. Nvidia, which partnered on the demonstration, confirmed that the model file, its digital fingerprint and its signature remained valid.

The attack is conditional, not a demonstrated way for any chatbot user to rewrite a model. It generally requires network access to a data processing unit, or DPU, or a baseboard management controller—a small computer used to manage servers remotely. Certain security settings must also be disabled. Nvidia says strong memory-access protections can block the attack path.

The stored model stays intact; the running copy changes

Eclypsium demonstrated the attack on an Nvidia computing platform. Its route into the model was the infrastructure underneath it, rather than a change to the stored model file. With DPU access, an attacker can read and modify code and data in memory, changing the model’s behavior as it runs.

DPUs handle infrastructure work such as networking, storage and security. Nvidia’s BlueField units have their own processor cores, operating system, firmware and management controller. They also move data directly into host and graphics-processor memory during normal operation. That access makes them useful independent security controls, but also places them inside the system’s security boundary.

The demonstration changed selected model weights in memory after ordinary security checks, according to Eclypsium’s report, described by Cybersecurity Dive. The stored file and signed artifacts could remain valid. Nvidia draws a distinction between these checks: verifying a model file confirms the copy on disk, not the copy executing in memory.

The altered answers were consequential. CNN reported that one demonstration increased the probability a model assigned to a Chinese invasion of Taiwan. In another, a chatbot advised someone asking about chest pain to stay home rather than go to a hospital. Researchers told CNN the attack took less than a minute and was not apparent to the user.

A familiar attack path, applied beneath AI

Nvidia did not characterize the work as revealing an unfamiliar class of attack. A spokesperson told CNN that its review of the hypothetical scenarios found nothing the industry had not previously known. Eclypsium’s response emphasized deployment: whether security controls stop these attacks depends on how operators configure and use them.

Two hardware-security specialists who reviewed the findings for CNN considered them credible. Researcher Joe FitzPatrick described the attacks as fundamentally the same as other direct-memory-access attacks. Dominic Rizzo, a senior fellow at the Institute for Security and Technology, called it a general attack path on modern infrastructure, with defenses needed deeper in the computing stack.

The demonstrated platform does not define the full potential scope. Nvidia says systems built around graphics processors, alternative accelerators and custom chips all depend on privileged components that can reach model memory. Those include host processors, firmware, management controllers and networking devices. This is an architectural exposure, not evidence that every such deployment is exploitable.

Defenses depend on settings—and checks after startup

Nvidia points to host controls including IOMMU translation, PCIe access-control services and address-translation services as important memory-access protections. It also says operators can separate workloads from infrastructure services and lock BlueField configurations into cryptographically verifiable security profiles. The appropriate boundaries vary with the deployment, including whether a cloud serves multiple customers or a cluster serves one enterprise.

Startup checks have a separate limit: they establish how a system began, not how it is behaving now. Nvidia recommends continuous verification during operation, using independent views of hardware settings, device connections, firmware and change history. Comparing those views makes it harder for an attacker to hide changes consistently across the system.

The operational work extends beyond the model

• Inventory DPUs, graphics processors and management controllers, including firmware versions, configurations and accountable owners. Include them in vulnerability management alongside the host operating system.
• Scrutinize third-party software on critical hardware. Eclypsium’s recommendations specifically include software running on DPUs, not just the applications serving the model.
• Reassess hardware after incident response and before assigning it to another customer. Nvidia notes that these infrastructure components persist across operating-system reinstalls.