The Real Guarantee: Design MIG Around Effects, Not Just Resources
NVIDIA Multi-Instance GPU (MIG) is valuable because it makes one expensive accelerator usable by several workloads at once. The evidence examined in this series adds a necessary qualification: the resources assigned to an instance and the effects observable from that instance are not the same thing. This final synthesis connects the physical L2 partition, the cross-instance membar effect, the timing sensor, the workload demonstrations, and the mitigations into one judgment. It also gives operators and application authors a way to decide what MIG can safely guarantee in a particular deployment—and what still requires measurement.
A chain of guarantees, not a single wall
The story begins with an economic and operational problem. GPU capacity is costly, while individual jobs may leave part of a large accelerator unused. Whole-GPU time-sharing improves neither utilization nor predictability as much as simultaneous execution on assigned portions of the hardware. MIG addresses that problem through spatial partitioning. NVIDIA's A100 guide describes independent instances with their own memory, cache, and streaming multiprocessors, and the paper describes dedicated SMs, crossbar ports, L2 slices, memory controllers, and DRAM channels in the partitioned design.
Those assignments provide real isolation. They give a workload a defined share of compute and memory-system capacity and allow contexts in different instances to execute in parallel. They also remove the shared cache-set relationship required by the tested eviction-based attacks. When an attacker and victim occupy different L2 partitions, the attacker cannot use the familiar strategy of filling a cache set and checking whether the victim displaced its lines. The paper's experiments support this point: the tested user-level loads, stores, and atomic operations did not create observable cross-instance L2 evictions, and most tested driver-level activities did not do so either.
That is the first guarantee in the chain: separate resource capacity and a blocked cache-line eviction surface. It is not a small or cosmetic benefit. It addresses the ordinary ways that workloads interfere with one another and closes a well-known class of cache timing techniques across the tested partitions. A security analysis that ignores this success would be as inaccurate as one that ignores the later limitation.
The second link concerns operations rather than storage. GPU memory barriers order memory operations within a defined scope. The paper found that broad-scope barriers issued in one instance could cause L2-level effects visible in another. Direct MEMBAR.GPU and MEMBAR.SYS instructions reproduced the behavior, while the narrower MEMBAR.CTA did not produce an observable cross-instance profiler effect in the same experiments. More importantly for real workloads, kernel launches and selected CUDA memory-management and context activities generated the relevant barriers on the tested systems.
The third link is observability. An effect can exist without being useful to an attacker if no ordinary tenant can measure it. The researchers first used NVIDIA Nsight Compute to discover the extra L2 requests, but a profiler generally requires privileged access and may be disabled in sensitive environments. They then found that the execution time of a receiver's own memory operations changed when another instance generated membars. LD.STRONG.GPU produced a more stable timing separation than ordinary loads in the tested setup, allowing an unprivileged receiver with access to a GPU clock to infer activity without reading another instance's data.
The fourth link is meaning. A timing trace does not automatically disclose a secret. It becomes informative when the victim's application turns private state into a repeatable pattern of kernel launches. LLM inference can produce different traces for different models and different durations for prefill and decode. Graph processing can vary with the input graph. Object detection can vary with object counts, and mixture-of-experts routing can vary even when total token counts are equal. The observer measures the same kind of low-level signal, but the application determines what that signal can mean.
Seen as a chain, the result is neither “MIG failed” nor “MIG solved side channels.” The first link remains strong in the tested setting: the physical L2 partition blocks the tested eviction route. The later links reveal a different surface: broad memory-ordering effects can influence timing, and workload structure can translate that timing into metadata.