Researchers at the University of Toronto flipped one bit in an NVIDIA GPU’s memory and took an AI model from 80% accuracy to 0.1%. That’s random guessing. They did it with ordinary user-level CUDA code: no physical access to the card, no admin rights. I break it down with my four-year-old daughter’s Magna-Tiles and a chapstick.
The attack is called GPUHammer. It’s Rowhammer, security researchers’ favorite party trick, pointed at the GPUs that run AI in data centers. Memory cells are packed so tightly that hammering the rows you’re allowed to touch can flip a bit in a row you’re not. On an RTX A6000 they got eight single-bit flips across four memory banks, then aimed one at the top bit of the exponent in a model’s weights.
NVIDIA’s fix is a setting you have to turn on: ECC. It costs up to 10% of your inference speed and 6.25% of the card’s memory. The H100 and RTX 5090 have ECC built into the memory chip. And every new generation packs the cells tighter, so the walls between rooms keep getting thinner. My biggest fear isn’t the outage. It’s the model that keeps running, keeps answering, and stopped knowing anything.