Your GPU Neighbor Can Hear Your Model — Branislav Brzak, Stealthium

Three microseconds of extra latency can reveal activity on another tenant's GPU slice. Branislav Brzak demonstrates an H100 timing side channel that probes only the attacker's own memory, without reading the victim's memory or exploiting a software bug. His experiments use the signal to infer model depth and decoding speed, then distinguish workload categories such as code, prose, JSON and retrieval. He explicitly separates that inference from recovering actual prompts or answers: the attack observes timing, not their contents. Memory and compute isolation do not automatically eliminate signals from hardware operations that affect the whole GPU. The walkthrough follows the trace from repeated memory reads to frequency analysis, token rates and layer signatures. Similar decoding speeds make tempo alone a weak fingerprint; the additional layer signal helps distinguish models with related architectures. Workload inference in the demonstrated setup depends on speculative decoding, whose acceptance patterns change step timing. Brzak then moves to a separate GPU on an NVSwitch connected H100 server and shows a weaker but still informative signal across NVLink. These are results from the tested configurations, rather than a claim that every shared deployment leaks equally. He closes with the operator choices that follow: consider tenant placement, understand the different isolation and communication tradeoffs, and observe the probing workload on the GPU itself. Speaker info: - https://www.linkedin.com/in/branislav-brzak/ - https://github.com/bane-stealthium Timestamps: 00:00 - What shared GPU timing can reveal 1:54 - What the attack cannot recover 3:16 - Probing the attacker's own memory 4:11 - Token rates and layer signatures 6:08 - Fitting model depth without a trained classifier 7:45 - Workload inference with speculative decoding 9:15 - Timing across NVLink 11:23 - Detecting probes and choosing isolation boundaries