DMA Attack

DMA attacks exploit the direct hardware pathway that allows peripherals to access system memory without CPU involvement. This bypasses all OS-level access controls, memory management unit protections, and software security policies. Attackers leverage external devices connected via Thunderbolt, PCI Express, FireWire, or ExpressCard interfaces to initiate unauthorized memory transactions. Because the CPU is not mediating the transfer, kernel-level anti-malware and endpoint detection tools remain completely blind to the exfiltration of model weights or the injection of adversarial payloads into active inference buffers.

The primary objective of a DMA attack against AI infrastructure is the theft of proprietary model weights. An attacker with physical or Thunderbolt access can map the physical memory addresses where a Large Language Model's parameters reside and stream gigabytes of floating-point tensors to an external device in seconds. This is particularly devastating for foundation models trained at enormous cost. Unlike network-based exfiltration, DMA reads leave no log entries in the operating system, making post-breach forensic analysis extremely difficult. The attacker obtains a bit-for-bit copy of the intellectual property.

Beyond passive reading, DMA attacks enable active memory tampering. An attacker can overwrite the model's weights in RAM to degrade performance, inject a backdoor trigger, or modify the inference logic to produce specific incorrect outputs on command. More critically, they can manipulate the control flow of the inference server process by overwriting function pointers or return addresses. This allows the attacker to hijack execution, disable safety guardrails, or establish a persistent software implant without ever modifying files on disk, evading integrity checks.

The primary defense against DMA attacks is the IOMMU, which virtualizes device memory access and enforces per-device page tables. However, misconfigurations and firmware vulnerabilities frequently leave IOMMU protections disabled or incomplete. Many high-performance AI servers prioritize throughput over security and boot with iommu=pt (passthrough mode) to avoid translation overhead. Attackers actively probe for ACPI DMAR table weaknesses and use techniques like Thunderclap to exploit vulnerabilities in the IOMMU subsystem itself, effectively neutralizing the hardware defense.

A related class of DMA threats exploits data remanence in DRAM. When an AI inference server is rebooted without a proper memory wipe, residual model weights and intermediate activations persist in physical memory for seconds to minutes. An attacker can boot a malicious lightweight OS via DMA-capable external media and scan the physical address space for recognizable tensor structures. This technique is effective against systems where full-disk encryption is deployed, as the decryption keys and plaintext model data remain in memory after a warm reboot.

Modern platforms implement Kernel DMA Protection using VT-d (Intel) or SMMU (ARM) to restrict untrusted devices to a quarantined memory region. Effective mitigation requires: enabling IOMMU in strict mode, disabling PCIe ACS bypass, enforcing Thunderbolt Security Levels (SL3/SL4 requiring user authorization), and deploying DMA remapping policies. For AI training clusters, physical port blocking and epoxy-filled Thunderbolt connectors provide a defense-in-depth layer. Virtualization-based security can further isolate model weights into encrypted VM memory regions inaccessible to DMA.

The primary hardware defense against DMA attacks. An IOMMU maps device-visible virtual addresses to host physical addresses, creating an isolated memory context for each peripheral. Without an IOMMU, a malicious device can read or write any physical memory location. With it, the device is restricted to explicitly mapped buffers, preventing access to model weights or training data in adjacent memory regions. Intel markets this as VT-d and AMD as AMD-Vi.

Thunderbolt 3 and 4 ports expose the PCI Express bus externally, making them a prime vector for DMA attacks. The specification defines three security levels:

• None: Legacy mode, no protection.
• User Authorization: Requires manual approval for new devices.
• Secure Connect: Enforces IOMMU mapping for all devices.
• DisplayPort Only: Blocks all PCIe tunneling, allowing only video output. Enterprise AI workstations should enforce Secure Connect or DisplayPort Only to protect model memory.

ACS is a PCIe capability that enforces peer-to-peer routing policies between devices on the same bus. Without ACS, a compromised endpoint can initiate a DMA transaction directly to another endpoint's memory space, bypassing the root complex. ACS enforces:

• Direct Translated P2P: Forces all peer traffic through the IOMMU.
• ACS Violation Blocking: Prevents unauthorized request rerouting.
• ACS Source Validation: Verifies the origin of every transaction layer packet. This is critical in multi-GPU AI servers where accelerators share a PCIe fabric.

A physical attack that exploits DRAM remanence—the tendency of RAM to retain data for seconds to minutes after power loss. An attacker physically cools memory modules (using compressed air or liquid nitrogen), cuts power to a running AI server, and quickly boots a malicious OS via USB to dump the residual memory contents. This can extract unencrypted model weights, API keys, and training data from memory. Mitigation requires full memory encryption like AMD SME or Intel TME.

A TEE is a secure area within a main processor that guarantees code and data confidentiality even against a compromised OS or hypervisor. For AI workloads, technologies like Intel SGX and AMD SEV encrypt model weights in memory so that a successful DMA attack yields only ciphertext. The encryption keys are held within the CPU die and are never exposed to external buses. Confidential computing extends this to protect data in use across the entire AI inference pipeline.

Beyond DMA, attackers can use JTAG (Joint Test Action Group) debug interfaces or logic analyzers to sniff memory bus traffic directly. JTAG ports provide low-level access to a processor's scan chain, allowing an attacker to halt execution, dump registers, and read memory. On embedded AI accelerators or edge devices, these debug headers must be physically disabled or fused after manufacturing. Bus probing on unencrypted DDR interfaces can capture model weights in transit between CPU and accelerator.