💻 computer science

Unprivileged Topology Certificates for Cloud GPU Attestation

This paper introduces a software-only attestation primitive that enables unprivileged cloud GPU tenants to verify hardware identity, topology, and coarse location by generating certificates from SM-level latency fingerprints, cache-bypassing memory sweeps, and public network landmarks.

Original authors: Faruk Alpay, Taylan Alpay

Published 2026-06-25

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Faruk Alpay, Taylan Alpay

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you rent a high-performance computer (a GPU) in the cloud to do heavy math or train AI. You pay for a specific model, like a "Blackwell B200," and you are told it's located in a specific data center in Bulgaria.

The problem? You can't see inside the machine. The landlord (the cloud provider) could be sneaky. They might swap your powerful B200 for an older, weaker model, move your job to a different country, or even pretend the machine is somewhere it isn't. Usually, you have to trust the landlord's word or a special "trusted chip" inside the computer, but many rented computers don't have those special chips.

This paper introduces a clever, software-only way to check if the computer you rented is actually what they say it is, without needing any special hardware or secret keys. Think of it as a digital fingerprinting and location verification kit.

Here is how it works, broken down into three simple checks:

1. The "Physical Fingerprint" (Is it the right machine?)

Every physical computer chip has tiny, unique imperfections in its internal wiring, just like every human has a unique fingerprint. Even if two chips are the same model, their internal "roads" (called SMs) have slightly different travel times for data.

The Analogy: Imagine a city with 170 intersections. If you send a messenger from every intersection to a specific destination and time how long it takes, you get a unique map of travel times.
The Test: The researchers send a tiny program (a probe) to measure how long it takes for data to travel between every internal intersection and memory on the chip.
The Result: This creates a "latency map." Even if the machine is working hard (sweating and hot), this map stays incredibly stable. If the landlord tries to swap your B200 for a different one, the map changes completely. The researchers showed they could distinguish between two different Blackwell chips with 100% accuracy just by looking at this map.

2. The "Hardware Class Check" (Is it the right type of machine?)

Sometimes a landlord might swap a high-end chip for a lower-end one of the same brand. This check ensures the machine has the right internal architecture.

The Analogy: Think of memory as a library.
- An old chip (Volta) has one big, open library room.
- A mid-range chip (Hopper) has the library split into two separate rooms with a door between them.
- A high-end chip (Blackwell B200) is actually two separate library buildings connected by a bridge.
The Test: The probe sends data to different parts of the memory. If the data has to cross a "bridge" between two buildings, it takes a specific, measurable amount of extra time (a penalty).
The Result: The researchers measured this "crossing time." They found that the B200 has a specific 30-cycle delay when data crosses between its two internal dies. This proves the machine is physically built like a B200, not a cheaper model with a unified memory system.

3. The "Location Alibi" (Is it in the right place?)

The landlord might say the machine is in Sofia, Bulgaria, but it could actually be in New York or Tokyo.

The Analogy: You can't trust the landlord's address, but you can't lie about how long it takes for a letter to travel. Light has a speed limit.
The Test: The researchers send "pings" (short messages) to hundreds of known locations around the world (like RIPE Atlas probes). They measure the round-trip time.
The Result: If the machine says it's in Sofia, but a ping from New York takes 10 milliseconds (which is too fast for a signal to travel from New York to Sofia and back), the claim is a lie. Using this method, they proved the machine was within 44 kilometers of the claimed data center and rejected 11 fake "decoy" locations.

The "Certificate"

Once these three checks are done, the computer doesn't send back gigabytes of raw data (which would be too slow and expensive). Instead, it compresses all the proof into a tiny, sealed digital certificate (a small SHA-256 hash).

The Verifier: Anyone can take this tiny certificate and check it on a regular laptop. They don't need a GPU. They just verify that the math adds up and the "fingerprint" matches the "location alibi."

Summary

This paper proves that even without special security chips or trusting the landlord, a tenant can verify three things about a rented cloud GPU:

Identity: It is the exact physical chip it claims to be.
Class: It has the correct internal architecture (e.g., two dies connected by a bridge).
Location: It is physically located where the contract says it is.

It's like renting a car and being able to prove, just by driving it, that it's the exact engine you paid for, it has the right transmission, and it's actually parked in the lot you were told it was in.

Technical Summary: Unprivileged Topology Certificates for Cloud GPU Attestation

Problem Statement

Cloud GPU tenants face a trust gap: they must rely on provider claims regarding the physical identity, hardware class, and geographic location of rented accelerators, yet they lack the privileged access required to inspect these attributes directly. Standard remote attestation relies on trusted hardware roots and vendor signing keys (e.g., NVIDIA Confidential Computing), which are often unavailable for consumer-grade or workstation-class GPUs exposed through commodity marketplaces. Without these privileged paths, tenants cannot verify if a provider has substituted a different accelerator, moved a job to a different site, or misstated the datacenter location. This paper addresses the specific scenario where an unprivileged tenant can launch CUDA kernels and measure network paths but cannot access firmware state, serial numbers, or vendor attestation reports.

Methodology

The paper proposes a software-only attestation primitive that generates a "topology certificate" binding a rented GPU instance to three distinct properties: physical identity, hardware class, and coarse network location. The system operates via a streaming pipeline:

GPU Probe (Data Collection):
- Physical Identity: A CUDA probe measures a latency matrix between physical Streaming Multiprocessors (SMs) and memory regions. It utilizes the PTX special register %smid to identify SMs and performs dependent global loads (ld.global.cg.u32) to measure L2/global cache latency.
- Hardware Class: The probe performs cache-bypassing sweeps (ld.global.cv) across the High Bandwidth Memory (HBM) to recover memory topology signatures. By analyzing the latency matrix as a weighted graph and applying spectral partitioning (Fiedler vector), it reveals architectural partitions (e.g., unified L2 vs. split L2 vs. multi-die packages).
- Location: The system records network round-trip times (RTT) to public landmarks (RIPE Atlas, Cloudflare, M-Lab) to establish distance bounds based on the speed of light.
Streaming Reducer (Summarization):
- The raw stream of timing measurements ( $R$ ) is mapped to a bounded summary of sufficient statistics ( $S$ ), including counts, means, variances, and extrema.
- This summary is combined with configuration hashes, source code hashes, and network evidence ( $E$ ) to form a compact SHA-256 certificate ( $C$ ).
Verifier (Validation):
- A verifier recomputes decision predicates from the summary $S$ and checks the hashes against the certificate $C$ .
- Crucially, verification requires no GPU and no access to the full raw trace, only the bounded summary and the certificate.

Key Contributions and Results

1. Physical Identity Stability

The paper demonstrates that per-SM latency maps serve as a stable physical fingerprint.

Stability: On a six-hour full-load run of an RTX 5090, the median temporal jitter was 0.09 cycles (0.025% of mean latency), with a minimum map correlation of 0.999798 against the initial snapshot.
Separability: Shape-only leave-one-out classification using these fingerprints achieved 100.0% accuracy in distinguishing between two distinct Blackwell dies (an RTX 5090 and an RTX PRO 6000), even under adversarial load conditions. This allows a verifier to reject a substituted device without vendor keys.

2. Hardware Class Attestation

The probe successfully recovers architectural topology signatures that differ by generation and class.

Volta (V100): Shows a unified L2 memory domain with no partition (correlation $r \approx -0.00$ ).
Hopper (H200): Reveals a two-way partitioned L2 (66/66 SM split) with strong anti-correlation ( $r = -0.95$ ) and a 31-cycle cross-partition penalty.
Blackwell (B200): Exposes a two-die NV-HBI package (74/74 SM split) with a 30-cycle (15.5 ns) cross-die penalty. This penalty is 342× larger than the measured noise floor, making the class distinction robust against load-induced drift.

3. Coarse Location Attestation

The system binds the certificate to a geographic region using network landmarks.

Method: By intersecting "speed-of-light" disks derived from RTT measurements to known vantage points, the system defines a constraint region.
Results: For a B200 instance, 169 RIPE Atlas probes placed the host within 44 km of the claimed datacenter. The system successfully rejected 11 out of 11 decoy locations (e.g., Sydney, Tokyo, New York) that violated the distance bounds.
Enforcement: While RTT alone is one-sided (an adversary can inflate latency but not reduce it below the speed of light), the combination with the physical fingerprint prevents a "proxy" attack where a compliant proxy elsewhere answers the challenge. The fingerprint binds the timing response to the specific enrolled die.

Significance and Claims

The paper positions this work as a modest but widely applicable alternative to trusted hardware attestation.

Scope: It targets unprivileged tenants on commodity GPUs (consumer/workstation parts) where confidential-computing paths and vendor keys are absent.
Capabilities: It enables verification of three specific claims:
1. Identity: The physical die has not been swapped.
2. Class: The hardware architecture matches the billed class (e.g., distinguishing a B200 from a V100).
3. Location: The instance resides within a coarse geographic region consistent with the contract.
Limitations: The authors explicitly state that this method does not prove firmware integrity, prevent a host from refusing to run the probe, or replace vendor attestation when a Trusted Execution Environment (TEE) is available. The location attestation is limited to metropolitan-to-continental scales, not rack-level precision, and relies on the host's cooperation to answer network probes.

The primary contribution is a topology certificate—a security-system object derived from hardware timing measurements—that allows a verifier to check cloud-GPU identity, class, and location without privileged access or a vendor key hierarchy.