Why AI Infrastructure Is Its Own Security Domain
Concentrated value at rest and in training. A frontier model's weights, a bespoke fine-tuned enterprise model, or a proprietary training-data corpus can represent hundreds of millions of euros of capital committed — concentrated in assets of modest file size. The extraction economics favour a determined adversary.
Shared-fabric side channels. GPU interconnects (NVLink, InfiniBand, PCIe, CXL), shared NICs, smart-NIC DPUs, and multi-tenant orchestration layers introduce side channels — cache, memory, fabric, and power — that mature IT isolation controls do not address by default.
Opaque hardware and firmware supply chain. GPU boards, BMCs, cable assemblies, optical transceivers, switch ASICs, and associated firmware travel through long, often opaque supply chains. Tamper, counterfeiting, and firmware-implant risk is elevated.
Regulatory convergence under AI Act and CRA. The EU AI Act imposes security and robustness obligations on high-risk AI systems; CRA imposes vulnerability handling and disclosure on products with digital elements; NIS2 covers AI-infrastructure operators as essential entities.
AI-Infrastructure Threat Modelling & Risk Assessment
- AI-specific threat modelling: model extraction, weight exfiltration, training-data poisoning, model-supply-chain compromise, inference-pipeline manipulation, prompt-injection at the infrastructure layer
- Tenant-isolation risk assessment on multi-tenant GPU clusters — side-channel, covert-channel, and direct-access vectors quantified against workload sensitivity
- Supply-chain risk modelling across GPU, interconnect, network, storage, and management-plane components — including geographic and export-control considerations
- Insider-threat and privileged-access risk for AI operators, cluster administrators, and research-access users
- EU AI Act risk classification of hosted AI systems and the security obligations that flow to the infrastructure layer
GPU Fabric & Cluster Architecture Review
- GPU fabric architecture assessment: NVLink, InfiniBand, RoCE, PCIe, CXL topology review against performance, isolation, and failure-mode requirements
- Multi-tenant fabric segmentation: partition strategies, network isolation, tenant-scoped storage, management-plane separation
- Smart-NIC and DPU architecture review: BlueField, Pensando, and equivalents as security control planes
- Management-plane architecture: BMC, iLO, iDRAC, DC-SCM, Redfish, and out-of-band access — the layer most frequently under-secured
- Storage architecture for training data, checkpoints, and model artefacts: access control, encryption, tenant-scoping, audit-trail integrity
- Orchestration and scheduler security: Kubernetes, Slurm, Run.ai, Determined AI
Tenant Isolation on Shared AI Infrastructure
- Hard-tenancy, soft-tenancy, and multi-instance-GPU (MIG) architectures evaluated against tenant trust model
- Cryptographic tenant isolation: confidential computing on GPU (NVIDIA CC, AMD SEV, Intel TDX where applicable), attestation architecture, key-management design
- Fabric-level isolation: InfiniBand partitioning, VLAN/VXLAN segmentation, NVLink partitioning, firewall enforcement between tenant domains
- Side-channel analysis: power, cache, memory, interconnect, and thermal side-channel exposure assessed against realistic adversary capability
- Sovereign-isolation and data-residency architecture for regulated and national-security-sensitive tenants
Model & Data Integrity
- Model-weight protection at rest: encryption, HSM integration, access control, tamper-evident storage
- Model-weight protection in transit: secure model-loading pipelines, cryptographic attestation, integrity verification against training provenance
- Training-data integrity: provenance tracking, poisoning-detection strategy, audit-trail architecture
- AI-BOM (AI bill-of-materials) design: documented provenance for base models, training data, fine-tuning data, and dependency chain