Amplifying Latency and Cost of LLM Inference via Rowhammer Attack
A Rowhammer bit-flip in a GPU compiler's cache can silently and permanently slow down LLM inference servers by up to 16%.
Researchers demonstrate LLVMhammer, a Rowhammer-based attack that flips bits in Triton's JIT compilation pipeline to make it generate functionally correct but slower GPU kernels for LLM inference, with the degraded kernel persisting via Triton's disk cache. Tested across four 7-8B open models on NVIDIA and AMD GPUs, it raised inference latency 4-16% and, in some cases, corrupted outputs significantly (BERTScore as low as 25%).
Why it matters
This is a novel hardware-adjacent attack surface for AI infrastructure: rather than attacking model weights or prompts, it targets the compiler toolchain that generates GPU kernels, turning a classic DRAM fault-injection technique into a persistent cost/performance degradation or correctness attack against LLM inference services, and it works across GPU vendors because Triton's target-independent stages are shared.
What is verified
LLVMhammer is presented as the first Rowhammer attack that causes LLM inference slowdown by inducing a bit-flip in Triton's JIT compilation pipeline. [1]
A bit-flip in a performance-critical optimization pass causes Triton to generate a functionally identical but suboptimal GPU kernel, which is then cached on disk causing persistent slowdown. [1]
The researchers built a tool called Karnage to automatically identify exploitable bit-flip locations in Triton's target-independent compilation pipeline. [1]
Evaluated across Qwen2.5-7B-Instruct, Llama-3.1-8B-Instruct, Mistral-7B-Instruct-v0.3 and Deepseek-llm-7B-chat on NVIDIA RTX 4090 and AMD RX 7900 XTX GPUs, LLVMhammer increased inference latency by 4-16%. [1]
The attack can also corrupt LLM outputs across GPU vendors, reducing BERTScore to as low as 25% in some cases. [1]
What is not
- Whether this attack requires local/co-located access to the target machine's DRAM, which would limit real-world exploitability, is not detailed in the abstract.
- No information on whether Triton maintainers have been notified or whether mitigations (e.g., ECC memory, cache invalidation) are proposed or effective.
- Testing was limited to specific consumer GPUs (RTX 4090, RX 7900 XTX) and 7-8B models; applicability to data-center GPUs and larger production deployments is not established.
- The paper is a preprint (submitted Oct 2026) and has not undergone peer review or independent replication.
Sources
- 1arXiv cs.CRarxiv.org · Primary source
Original source published 22 October 2026 at 08:24.
An AI-assisted briefing by Coding Partners. We link the evidence behind the reporting so you can explore the original work and assess the claims. How CP Signal works.