Detecting model weight tampering in GPU memory (Rome attacks)

Rome-class attacks inject a malicious Python component that computes and overwrites a small set of model weights directly in GPU memory during inference, producing targeted changes in model behavior while leaving disk artifacts, processes, and network activity untouched. These rank-one edits run as ordinary CUDA work issued by the same python3 process that does inference: the payload traces the model, solves a small linear system (using kernels like sgemm and getrf), computes target weight corrections, then writes them back with elementwise kernels. The attack can be delivered by many Python entry points - import-time hooks, .pth startup files, unpickling, exec/eval or runtime-compiled GPU kernels - so a checksum or host EDR looking only at files and processes won’t see anything amiss.

Stealthium detects this class of tampering by tying every CUDA library load and kernel launch back to the Python call stack that initiated it, flagging kernel sequences and caller frames that differ from clean runs and surfacing kernels that only appear during an edit. Additional instrumentation records Python imports and exec/eval events so analysts can see which code path introduced the malicious behavior. Ongoing research captures framework-level in-place tensor writes and emits weight-change events that associate the mutated tensor, the exact write, and the Python stack, producing actionable alerts (for example, a model_weight_mutation event) even when the checkpoint on disk remains unchanged.