LLVMhammer：通过 Rowhammer 位翻转让 LLM 推理变慢 4-16%
Amplifying Latency and Cost of LLM Inference via Rowhammer Attack
有人用 Rowhammer 硬件攻击搞坏了 Triton 编译，四个主流模型实测慢 4-16%，搞 GPU 推理的都该看看这篇。
研究者提出 LLVMhammer，这是首个利用 Rowhammer 位翻转攻击拖慢 LLM 推理的方法，攻击目标是 Triton JIT 编译管线的优化 pass。位翻转让 Triton 生成功能相同但性能更差的 GPU kernel，且由于 Triton 会把编译好的 kernel 缓存到磁盘，一次攻击就能造成持久性变慢。实验在 NVIDIA RTX 4090 和 AMD RX 7900 XTX 上测试了 Qwen2.5-7B-Instruct、Llama-3.1-8B-Instruct、Mistral-7B-Instruct-v0.3、Deepseek-llm-7B-chat 四个模型，单 GPU 推理延迟增加 4-16%。位翻转还能破坏输出质量，BERTScore 最低降到 25%。
Amplifying Latency and Cost of LLM Inference via Rowhammer Attack
Large language models (LLMs) achieve high inference efficiency using optimized GPU kernels generated by just-in-time (JIT) compilation frameworks such as Triton. Triton compiles GPU kernels through an MLIR/LLVM-based pipeline. We investigate whether a Rowhammer-induced bit-flip in the CPU's DRAM can degrade GPU-based LLM inference performance while preserving output correctness. We present LLVMhammer, the first Rowhammer attack that causes LLM inference slowdown by inducing a bit-flip in Triton's compilation pipeline. A bit-flip in a performance-critical optimization pass causes Triton to generate a functionally identical but suboptimal GPU kernel. Since Triton caches the generated kernel on disk, a single successful bit-flip causes persistent slowdown across subsequent inference executions. Triton's target-independent stages are shared across GPU vendors, which makes our attack GPU vendor-agnostic. To identify exploitable bit-flip locations without manual inspection, we build Karnage, a tool that isolates useful bit-flip locations in Triton's target-independent compilation pipeline. We evaluate LLVMHammer across a diverse set of LLMs, including Qwen2.5-7B-Instruct, Llama-3.1-8B-Instruct, Mistral-7B-Instruct-v0.3, and Deepseek-llm-7B-chat, across NVIDIA RTX 4090 and AMD RX 7900 XTX GPUs. LLVMhammer increases inference latency of an LLM inference server running on a single GPU by 4-16\%, which, in turn, can translate into additional annual operating costs at the scale of multi-GPU deployments. We further show that LLVMhammer can also corrupt LLM outputs across different GPU vendors, reducing BERTScore to as low as 25\%, illustrating the broader security implications of bit-flips in Triton's compilation pipeline.
