In This Story
As AI systems become more powerful, the technology making this possible is also becoming more complex. According to George Mason University researcher Yicheng Zhang, that complexity may be creating security vulnerabilities that could put sensitive information at risk.
Zhang, an assistant professor in the Department of Electrical and Computer Engineering, received a two-year, $150,000 research grant from EA Funds to investigate how information can inadvertently leak through the hardware connecting the thousands of graphics processing units (GPUs) used to train and operate advanced AI systems.
The project builds on Zhang's recently published research demonstrating that the high-speed connections between GPUs can reveal information about the applications running on them, potentially allowing attackers to learn about activities they should not be able to observe.
"Our goal is to understand how this sensitive information might be leaked through these shared hardware resources," Zhang said. The next step, he said, is developing practical ways to detect and reduce those risks.
GPUs are specialized processors capable of performing many calculations simultaneously, making them essential to modern AI. Training a large language model can require thousands of GPUs working together, exchanging enormous amounts of information through high-speed connections.
One such technology is NVIDIA's NVLink, which enables GPUs to communicate rapidly. But Zhang and his collaborators discovered that the same connections that make AI computing more efficient can also expose information about what other users or applications are doing.
Their paper, "NVBleed: Covert and Side-Channel Attacks on NVIDIA Multi-GPU Interconnect," was accepted for presentation at the 2026 ACM SIGSAC Conference on Computer and Communications Security, one of the leading international conferences in cybersecurity. Zhang will present the findings in November in the Netherlands.
In the paper, researchers examined how information can escape through what cybersecurity experts call a side channel. Rather than directly accessing protected files or breaking encryption, an attacker observes indirect signals, such as variations in the time required to complete operations or patterns of communication between processors. These signals can reveal surprising amounts of information.
In controlled experiments, Zhang and his collaborators demonstrated they could identify which of 18 computing applications was running on another GPU, achieving 97 percent accuracy. They also demonstrated that communication patterns could reveal which 3D character another user was rendering in Blender, a popular graphics application.
In addition, the researchers found that certain information could leak between separate virtual machines on Google Cloud Platform. Virtual machines allow multiple customers to use the same physical computing infrastructure while keeping their workloads logically isolated. The findings suggest that, under certain conditions, those boundaries may not completely prevent information from being inferred through shared hardware.
The researchers examined several generations of NVIDIA's NVLink technology and additional GPU configurations, demonstrating that some of the underlying vulnerabilities extend across different hardware platforms. For companies investing billions of dollars to develop proprietary AI models, this carries substantial implications.
The new grant will allow Zhang to expand this research beyond identifying vulnerabilities to developing potential defenses. Working with two doctoral students supported through the grant, Zhang will investigate additional sources of information leakage in multi-GPU systems and develop methods for detecting suspicious activity and limiting the information attackers can obtain. The research will also aim to produce practical recommendations for AI developers and organizations operating large computing systems.
As increasingly sophisticated AI models become embedded in business, research and everyday applications, he believes protecting the underlying computing infrastructure will be essential to maintaining confidence in the technology.
"You want to make sure that they not only just care about the performance and how powerful the model is," Zhang said. "You want to make sure that the system is more secure."