GPU Side-channels and Leakage Testing

The project explores the overlooked risk of GPU side-channel attacks—ways that mechanical, electrical, and radio signals from GPUs might leak information such as model weights, conversation contents, architectures, or activity patterns. The project will experimentally test the difficulty of measuring and interpreting these signals. The key contribution is a proof-of-concept demonstration showing that it’s possible to fingerprint which experts (modular neural network components common in today’s LLMs) are active in an open-source model using simple sensors like smartphone microphones or electromagnetic probes. Once experts are fingerprinted, prior work has already established the connection between expert selections and token outputs. This work is novel because no practical physical GPU side-channel attacks have yet been shown for LLM workloads, despite GPUs being central to modern AI infrastructure. Evidence will come from controlled experiments measuring signal traces, applying hypothesis testing and classifiers to quantify information leakage, and assessing the statistical confidence of the results.

This problem is worthwhile because GPUs are the backbone of modern AI systems, yet their physical security has received almost no scrutiny compared to CPUs or hardware security modules. As models grow more valuable and are increasingly deployed in shared data centers, even partial leakage of model weights, architectures, or outputs could have serious safety and national-security implications. Demonstrating that GPU side-channel attacks also apply in the LLM domain would fill a major blind spot in AI security and motivate industry-level mitigations.

It is tractable because prior research on related hardware demonstrates that side-channel leakage is both measurable and exploitable when properly scoped. Foundational work such as those listed below show that physical emissions can reliably reveal internal computations and that coarse model internals reveal token outputs.

Securing model weights against theft is important for safety because irresponsible actors with model access could remove or ignore safeguards. Project 1 would advance the science of securing model weights against extraction via side-channel, enabling safer deployments on semi-trusted and untrusted infrastructure.

Covert communication is important for AI control because information sanitation requires humans to be able to monitor all communication by AI systems. Project 2 would characterize a threat model that must be addressed in AI control schemes, to better understand the conditions under which covert communication can be learned.

Co-author on published scientific paper. I'm looking for help with coding (probably just PyTorch and NumPy), methods & execution (ML theory, linear algebra, statistics, signal processing), and with portions of writing (literature review at least). Mentees would get exposure to the whole research process.

Must have: Trained or fine-tuned a transformer language model in PyTorch (toy models and following guides is fine). Familiar with basic electronics concepts (voltage, current, transistors). Has experience writing research papers, even as a class assignment.

Nice to have: Familiarity with LaTeX, PyTorch internals, CUDA/OpenCL, GPU architecture, chip design, oscilloscopes, signal processing, electrical engineering.

Minimum 10, prefer 20.

Preference for work hours overlap with Washington, DC. Mentees can participate remotely, but could have a more hands-on experience if also located near Washington.