Eclypsium spotlights AI hardware attack blind spot

Eclypsium has published research on attacks that can alter the behaviour of AI models through the hardware they run on, with support from NVIDIA.

The findings focus on risks in AI data centre infrastructure rather than in model files or application layers.

In a controlled demonstration, attackers with privileged access to underlying systems were able to manipulate a model while it was running without changing the original model files or triggering traditional integrity checks. The research described a scenario in which a compromised DPU, combined with permissive memory isolation, modified model weights directly in memory.

This could allow an attacker to influence outputs during live inference while leaving stored models unchanged. Eclypsium said this exposes a gap between checks that confirm whether a saved model has been altered and how that model behaves once it is executed on complex hardware.

Blind spot

The study adds to a wider debate over where AI security efforts are focused as companies and public bodies roll out systems at speed. Much of the current discussion around AI safety has centred on training data, model behaviour, guardrails and governance, while the servers, firmware, networking components and supply chains behind those systems have received less attention.

Eclypsium argues that this creates what it calls an "AI Infrastructure Assurance Gap", in which an organisation may trust a model because the file passes integrity checks even though the underlying infrastructure has been tampered with. In the demonstration, the manipulated model produced changed analytical output in response to a real-world geopolitical query.

Eclypsium is working with NVIDIA on infrastructure assurance through integration with the Open Agent Safety Platform. The collaboration is intended to support independent verification and continuous monitoring of the systems used to train and run AI models and agents.

The issue has commercial significance because spending on AI infrastructure is rising sharply. Goldman Sachs has forecast that global investment in AI infrastructure will exceed USD $1 trillion annually in 2026, while the World Economic Forum has cited estimates that AI could contribute USD $15.7 trillion to global GDP.

Attack path

The technical findings described an attack chain targeting a privileged part of AI compute infrastructure that enabled compromise of a model, including its weights. According to Eclypsium, the technique made it possible to alter model output during live inference without modifying the stored model or the inference service, and without visible indicators of compromise.

This matters because many existing security controls are designed to verify software artefacts, configurations or access permissions rather than the integrity of every hardware and firmware layer involved in execution. In practice, a model could appear unchanged to standard checks while producing manipulated answers.

"AI security starts with trusting the infrastructure that it runs on. Our research demonstrates how hardware-level compromises can undermine AI execution without being detected by the stored-model integrity checks used in the demonstration. Through Eclypsium's independent verification and continuous monitoring, we're helping organizations establish and maintain trust in the infrastructure powering AI," said Yuriy Bulygin, Chief Executive Officer and Co-Founder, Eclypsium.

NVIDIA described the work as part of a broader effort to improve protections around AI systems. The chipmaker has become central to the market for AI hardware, so the focus on infrastructure trust extends beyond one supplier to the wider ecosystem of accelerators, networking equipment, firmware and supporting components used in AI data centres.

"NVIDIA builds security into its platforms to help customers protect their AI infrastructure. Working with researchers and cybersecurity companies, like Eclypsium, we're continuously strengthening protections across the AI ecosystem," said Gilad Shainer, Senior Vice President of Networking, NVIDIA.

Independent checks

Outside experts quoted alongside the research said the findings point to a need for stronger independent validation of AI infrastructure. The concern is that increasingly complex systems are being used in settings where AI outputs could shape significant operational or policy decisions.

"Some of the most consequential and complex decision systems ever are being developed now. The new architectures that AI systems are running on, because of their complexity and speed, benefit from independent verification. AI infrastructure should be treated as critical infrastructure, with verifiable evidence that it is in a known-good state. Securing critical infrastructure is a team sport, and this is a successful example of how to do it: researchers demonstrated an attack scenario and worked with the manufacturer to help clarify practical protections that the whole industry can use," said Jon Rolf, Cybersecurity Consultant, Rolf Cyber.

Others said transparency practices used in software security need to extend more fully into firmware and hardware, particularly in AI environments where organisations may depend on long and opaque supply chains.

"This research reinforces the need for full-stack transparency and monitoring across AI infrastructure. Organisations can't secure what they can't see, and the same transparency standards applied to software must extend to firmware and hardware. A Bill of Materials is just the beginning. AI infrastructure needs to turn this transparency into continuous evidence so that we can discover and address security problems," said Dr Allan Friedman, Former Senior Advisor and Strategist, CISA.