NVIDIA MIG Isolation: Resources, Timing, and Security

Overview

This series explains what NVIDIA MIG separates—and what it does not. It moves from dedicated SMs, L2 slices, and memory paths to cross-instance membar effects, timing-based observation, and workload-metadata leakage. Results on tested H100/H200, A30, and A100 systems support real resource isolation and a blocked tested eviction route, but not a universal guarantee against observable effects. Operators can reduce signal and must validate their exact configuration.

Learning outcomes

NVIDIA MIG provides dedicated compute and memory resources, including assigned L2 slices, for concurrent workloads.
The tested cross-instance cache-eviction route was blocked, but broad-scope membars still affected another instance’s timing.
Membar+Load can expose workload metadata—not raw data—when launch patterns are repeatable and conditions favor measurement.
Noise, longer kernels, barrier obfuscation, and newer platforms may reduce observability; none is a universal guarantee in the supplied evidence.

Keywords

MIGIsolationGPUL2MembarTimingSide-channelHopperAmpereLLM

Chapters

NVIDIA MIG Resource Isolation and Its Limits

How physical partitioning differs from effect isolation

8 min · How physical partitioning differs from effect isolation

8 min

NVIDIA MIG: From GPU Sharing to L2 Slices

How CUDA memory requests meet the partition boundary

10 min · How CUDA memory requests meet the partition boundary

10 min

NVIDIA MIG Membars as a Cross-Instance Timing Sensor

Why ordering operations can reach beyond cache storage

10 min · Why ordering operations can reach beyond cache storage

10 min

NVIDIA MIG Membar+Load for LLM Inference

How kernel-launch timing exposes workload metadata

11 min · How kernel-launch timing exposes workload metadata

11 min

NVIDIA MIG Side Channels: Workloads and GPU Generations

What transfers, what weakens, and what remains untested

12 min · What transfers, what weakens, and what remains untested

12 min

NVIDIA MIG Defenses Against Timing Leakage

Reduce the signal without claiming it is gone

10 min · Reduce the signal without claiming it is gone

10 min

NVIDIA MIG Security Guarantees: Resources Versus Effects

A configuration-specific model for defensible isolation

12 min · A configuration-specific model for defensible isolation

12 min

Preview every chapter · Unlock full text, audio, and video from chapter 4

Plans

Ch.1-3 FreeCh.4-7 Premium

FAQ

What does NVIDIA MIG actually isolate?

NVIDIA MIG isolates assigned compute and memory-system resources, including SMs, L2 slices, controllers, and DRAM channels, not necessarily every effect those resources produce.

Can one NVIDIA MIG instance still observe another instance?

Yes, under the tested conditions, another instance could observe a timing effect from broad-scope membars without reading its data. The paper did not demonstrate arbitrary memory disclosure or every configuration.

What can Membar+Load reveal about LLM inference?

Membar+Load can help infer model identity, inference phase, and approximate input or output size from timing traces when candidate patterns and batch-one conditions are known. It does not recover model weights, prompts, or generated text.

Does this NVIDIA MIG side channel work on every GPU generation?

No; the demonstrated application side channel varied by generation and workload. Kernel launches triggered the tested path on H100 and H200, while A30 and A100 retained direct timing effects but not the same launch-based demonstration.