Detecting model weight tampering in GPU memory (Rome attacks)
Security researchers explain 'ROME' attacks, where malicious code modifies AI model weights directly in GPU memory to bypass traditional security tools. The article proposes new runtime monitoring techniques to detect these stealthy manipulations.
Why it matters
As AI integration grows, securing the integrity of model weights against in-memory tampering is becoming a critical frontier for cybersecurity.
This article introduces Rank-One Model Editing (ROME) attacks, where a malicious Python module rewrites a model's weights in GPU memory to corrupt its answers, and explains why CPU-focused security tooling misses this class of attack. We then run a ROME attack in our lab and show how Stealthium detects model tampering via our runtime sensor, which ties every CUDA kernel launch back to the Python code that issued it, and new on-going research that detects the weight changes together with the call stack that caused it.
Models can be corrupted about a specific topic without a single byte on disk changing. There is nothing to scan, no process to catch, no signature to hunt and match. For everything and everyone watching the machine, it’s a model doing model things.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in