攻擊 AI 部署

# Common inference server endpoints to probe
endpoints = [
    "/health",           # Health check - may reveal version info
    "/metrics",          # Prometheus metrics - resource usage, model info
    "/v1/models",        # Model listing - reveals loaded models
    "/v1/completions",   # Inference endpoint
    "/admin",            # Management interface (if exposed)
    "/docs",             # Auto-generated API docs
]
 
# Test for unauthenticated access to management endpoints
for endpoint in endpoints:
    response = requests.get(f"http://target:8000{endpoint}")
    print(f"{endpoint}: {response.status_code}")

# Conceptual GPU memory probe
# In a shared GPU environment, allocate memory and read uninitialized values
import torch
 
# Allocate a large tensor without initialization
probe = torch.empty(1024, 1024, device='cuda')
# probe may contain residual data from previous operations
# including other users' embeddings, activations, or KV cache

# Common locations for model weights in containerized deployments
# /models/
# /opt/ml/model/
# /root/.cache/huggingface/
# /data/models/

# Common insecure container configuration for GPU workloads
services:
  inference:
    image: vllm/vllm-openai
    # Privileged mode for GPU access - common but dangerous
    privileged: true
    # Host network - exposes internal ports
    network_mode: host
    # Volume mounts - may expose sensitive host paths
    volumes:
      - /data/models:/models
      - /var/run/docker.sock:/var/run/docker.sock

# GPU memory exhaustion
# Send requests that maximize GPU memory usage
# Long input + long output + large batch size
 
# Compute exhaustion
# Requests that maximize inference time
# Adversarial inputs that cause maximum attention computation
 
# Storage exhaustion
# If the system logs prompts/responses, generate volume
# If the system caches KV states, fill the cache