CVE-2026-1104: NPU timing side-channels let co-tenants steal model weights in shared AI clusters. Attack timeline, code anatomy and hardening. Read now.
What an NPU timing side-channel actually exposes
Neural processing units accelerate matrix work that sits at the center of inference and fine-tuning. That work is not free of observable timing: how long a kernel runs, when memory bursts land, and how queues drain can all leak through shared hardware counters, cache hierarchies, and interconnect contention. In a multi-tenant AI cluster, co-tenants do not need to read another job’s memory directly. If they can schedule work on the same NPU package or share a memory path, they can sample timing under controlled inputs and treat the victim’s model as a black-box oracle.
Model weights are large, but they are also structured. Layer shapes, activation patterns, and quantized layouts create repeatable latency fingerprints. A careful attacker correlates those fingerprints with known architectures and weight distributions, then refines guesses over many trials. The core risk in CVE-2026-1104 is not a single crash or privilege bug—it is silent extraction of proprietary parameters while the victim job still looks healthy.
Attack timeline: from co-location to weight recovery
A practical attack usually unfolds in stages. First, the adversary gains co-tenancy: the same host, same NPU pool, or a tightly coupled accelerator partition. Next comes calibration—running probe kernels that measure baseline latency under idle and contended conditions so later samples can be normalized. Then the attacker drives a sequence of victim-touching operations: forcing the shared NPU to execute layers whose timing depends on secret weights, while recording high-resolution timing from their own side of the partition.
Recovery is iterative. Early samples narrow architecture class and layer dimensions. Later samples target sensitive blocks—attention projections, embedding tables, or quantized scale factors—where small weight differences produce measurable timing deltas. Operators often miss the campaign because CPU logs stay clean, GPU/NPU utilization looks normal, and no obvious exploit payload appears in network traffic. The signal lives in microarchitectural timing and shared resource contention, not in a classic remote code path.
Code anatomy of the leak surface
On the victim side, the risky pattern is simple: load confidential weights into NPU-visible memory, run kernels whose duration depends on those values, and do so without isolation strong enough to hide timing. Common enablers include dense packed GEMMs without constant-time variants, dynamic kernel selection based on tensor content, and batching policies that change schedule length when weights or activations take different numeric ranges. Logging and metrics hooks that expose per-kernel durations to other tenants amplify the problem.
On the attacker side, the anatomy is a tight loop: place work, wait for the shared unit, sample timestamps or performance counters available to the tenant, and store traces. Analysis code then clusters traces, subtracts noise, and maps residual timing back to candidate weight fragments. The vulnerability is less about one broken API call and more about the assumption that NPU execution is opaque across tenants when the hardware still shares clocks, caches, or memory bandwidth.
Hardening shared AI clusters
- Prefer hard isolation for high-value models: dedicated NPU devices or partitions that do not share memory controllers or performance-counter namespaces with untrusted jobs.
- Disable or scope tenant-visible high-resolution timing and accelerator performance counters unless they are required for first-party debugging.
- Schedule confidential inference on non-multiplexed queues; avoid packing untrusted workloads onto the same NPU context as proprietary models.
- Where multiplexing is unavoidable, use padding and fixed-batch / fixed-kernel schedules so layer duration does not track secret-dependent paths.
- Treat weight theft like data exfiltration in threat models: monitor anomalous co-tenant placement, sustained probe patterns, and cross-job contention spikes.
CVE-2026-1104 is a reminder that accelerators inherit the same multi-tenant side-channel lessons CPUs learned years earlier. If model weights are crown jewels, isolation and constant-ish execution schedules matter as much as encryption at rest. Design the cluster so co-tenants cannot turn shared NPU timing into a weight-extraction channel—and verify that assumption with adversarial scheduling tests before production share-out.