GPUHammer attack can degrade AI model accuracy on GDDR6 GPUs from 80% to near-zero through memory manipulation.

Researchers at the University of Toronto have demonstrated how RowHammer attacks can degrade GPU accuracy on high-end graphics processors. By inducing bit flips in GPU DRAM banks, specifically targeting GDDR6 VRAM, the researchers developed what they call GPUHammer, which can bring GPU accuracy to less than 1% on affected systems. The RowHammer vulnerability, which exploits the ability to alter data inside memory cells, proves similarly effective when applied to GPU memory as to traditional system RAM.

In controlled tests on NVIDIA's RTX A6000, the researchers induced bit flips across DRAM banks and measured the impact on AI model performance. Even with hardware-level defenses like DRAM-target refresh rate (TRR) enabled, a single bit flip in an FP16 value caused DNN prediction accuracy to plummet from 80% to just 0.1% across major ImageNet models. The attack required approximately 12,000 activations per flip to trigger bit flips across the four DRAM banks.

The GPUHammer attack operates through three stages: Reverse-Engineering DRAM Bank Mappings, Maximizing Hammering Efficiency, and Synchronization with DRAM Refresh Cycles. Notably, the vulnerability does not affect all GPUs uniformly. Similar cards like the RTX 3080 and high-end processors such as the RTX 5090 showed no susceptibility to the attack. Data center GPUs including the A100 and H100, which use HBM (High Bandwidth Memory) rather than GDDR6, remained unaffected. These differences stem from NVIDIA's use of memory chips from different vendors including Samsung, SK Hynix, and Micron.

The vulnerability can be mitigated by enabling ECC (Error-Correcting Code), which detects and corrects single-bit flips. However, this mitigation carries a performance cost: ML inference workloads see up to 10% slowdown, and usable VRAM capacity decreases by up to 6.25%. NVIDIA has issued a security notice advising SYSTEM-LEVEL ECC be enabled on affected GPUs. Fortunately, modern architectures such as Hopper and Blackwell have ECC enabled by default, protecting users of next-generation hardware from this particular threat.