A team of researchers at the University of Toronto has demonstrated the first successful Rowhammer attack on discrete Nvidia GPUs, inducing up to 1,171 bit flips on an RTX 3060 and proving that attackers can compromise AI model integrity, hijack GPU page tables, and gain full read/write access to system memory. The vulnerability, dubbed GPUHammer, affects most GDDR6-equipped graphics cards tested and has reignited urgent questions about hardware security across data centers processing the world’s most sensitive AI workloads.
Published at USENIX Security 2025 and gaining renewed attention after Tom’s Hardware and CSO Online coverage in April 2026, GPUHammer represents a fundamental shift in the threat landscape. For decades, Rowhammer was considered a CPU and system RAM problem. Now, the same class of attack has crossed into GPU territory, where hundreds of millions of discrete graphics cards run everything from gaming sessions to trillion-parameter language models. With Nvidia holding over 90% of the discrete GPU market and its data center revenue growing at a 45% compound annual growth rate, the stakes could not be higher.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Is GPUHammer and Why It Matters in 2026
Rowhammer is a read disturbance vulnerability inherent in modern DRAM. By rapidly and repeatedly accessing specific memory rows, an attacker can cause electrical interference that flips bits in adjacent rows. First documented in CPU-connected DDR3 memory in 2014, Rowhammer has since been demonstrated on DDR4 and DDR5. GPUHammer extends this attack class to GDDR6 memory, the type used in virtually every modern discrete GPU from Nvidia.
The breakthrough came from three University of Toronto researchers: Shaopeng (Chris) Lin, a second-year PhD student; Joyce Qu, a fourth-year undergraduate; and Gururaj Saileshwar, a faculty member in computer science and electrical/computer engineering. Their paper, “GPUHammer: Rowhammer Attacks on GPU Memories are Practical,” was presented at USENIX Security 2025 and later published through ACM. It represents the first peer-reviewed demonstration of Rowhammer bit flips on a discrete GPU.
What makes GPUHammer significant in 2026 is the scale of exposure. Nvidia shipped an estimated 5.2 million Blackwell AI GPUs in 2025 alone, according to JP Morgan projections. The company controls more than 90% of the discrete GPU market, including gaming, workstation, and data center segments. Every one of these cards uses GDDR memory, and the researchers found that most of the 25 GDDR6 GPUs they tested were vulnerable to bit flips.
The Technical Mechanism Behind GDDR6 Rowhammer
Attacking GPU memory posed challenges that do not exist in CPU-based Rowhammer. GDDR6 memory uses proprietary physical-to-bank and physical-to-row address mappings that Nvidia does not publicly document. GPU DRAM also has higher memory latency, faster refresh rates, and in-DRAM mitigations such as Target Row Refresh (TRR) designed to detect and counteract repeated row access patterns.
The Toronto team overcame these obstacles through a multi-step reverse engineering process. First, they mapped GDDR6’s proprietary physical address layout by observing memory access timing patterns through custom CUDA kernels. Next, they developed high-intensity hammering routines that activated multiple aggressor rows simultaneously, synchronized with DRAM refresh cycles to maximize disturbance before the memory controller could intervene.
“Any system using modern DDR memory is potentially vulnerable to Rowhammer,” the researchers noted in their disclosure. “The unique challenge with GPUs was bypassing the proprietary memory mappings and TRR mitigations that don’t exist in the same form on CPU-side DRAM.” Their CUDA-based hammer kernels were specifically optimized to exploit the GPU’s massive parallelism, turning the same architectural feature that makes GPUs powerful for AI into a weapon against their own memory.
The results were striking. On an Nvidia RTX 3060, the team induced 1,171 bit flips. On the higher-end RTX A6000, a professional workstation and AI training GPU, they observed 202 bit flips across 4 DRAM banks, with up to 8 bit flips occurring in a single targeted attack. These numbers demonstrate that GDDR6 Rowhammer is not a theoretical exercise but a practical, repeatable exploit.
How GPUHammer Destroys AI Model Accuracy
One of the most alarming applications of GPUHammer is its ability to corrupt AI model weights stored in GPU VRAM during inference or training. The researchers demonstrated that a single bit flip targeting a model weight’s exponent field can degrade classification accuracy from 80% to less than 1%. In practical terms, this means an attacker with access to a shared GPU, such as in a multi-tenant cloud environment, could sabotage another tenant’s AI model without leaving obvious traces.
“The implications for AI safety are profound,” said Dr. Gururaj Saileshwar, faculty co-author of the GPUHammer paper. “A targeted bit flip in a neural network weight doesn’t crash the model. It silently corrupts its outputs. In medical diagnosis, autonomous driving, or financial modeling, this kind of silent failure could have catastrophic consequences.”
The attack is particularly dangerous because GPU memory lacks the parity checks and instruction-level access controls that modern CPUs employ. While CPUs have evolved extensive Rowhammer mitigations including hardware-based row refresh and ECC memory as standard in server configurations, GPU VRAM has remained comparatively unprotected. Consumer GPUs like the RTX 3060 and RTX 4090 do not support ECC on their GDDR6 or GDDR6X memory.
The model corruption attack does not require sophisticated tooling beyond CUDA access. In a cloud data center where multiple customers share GPU resources through technologies like Nvidia’s Multi-Instance GPU (MIG) or time-sharing, a malicious tenant could run the hammering kernel alongside a victim’s workload. The bit flips occur in the physical DRAM and affect whatever data happens to be stored in the target rows, whether that is model weights, activations, or gradient computations.
The Page Table Attack: From GPU Memory to Full System Compromise
Beyond AI model corruption, the GPUHammer researchers demonstrated an even more severe attack vector. By targeting bit flips in GPU VRAM page tables, the internal data structures that map virtual memory addresses to physical locations, an attacker can remap GPU memory to point at CPU system memory. This grants the attacker full read/write access to the host system’s main RAM, effectively achieving root-level compromise from a GPU process.
This attack chain works because GPU page tables are stored in the same GDDR6 memory as user data. If an attacker can induce a bit flip in a page table entry, they can redirect a GPU memory read or write to an arbitrary physical address, including one that maps to CPU memory through the PCIe bus. From there, the attacker can read sensitive data from other processes, modify kernel data structures, or inject code for execution.
“The page table attack is what elevates GPUHammer from a data integrity issue to a full system compromise,” said Kevin Beaumont, a cybersecurity researcher and former Microsoft threat intelligence analyst who reviewed the findings. “We’ve spent years hardening CPU memory against Rowhammer, but GPU VRAM has been a blind spot. An attacker who can flip bits in GPU page tables can own the entire machine.”
The implications are particularly severe for cloud providers. Amazon Web Services, Google Cloud Platform, and Microsoft Azure all offer GPU instances where customers run workloads on shared physical hardware. While virtualization provides logical isolation, GPUHammer shows that physical-layer attacks can bypass these boundaries. None of the major cloud providers have issued public statements about GPUHammer mitigations as of April 2026.
25 GPUs Tested: Which Models Are Vulnerable
The University of Toronto team tested 25 discrete Nvidia GPUs with GDDR6 memory and found that most were susceptible to Rowhammer bit flips. The vulnerability rate across tested cards was alarmingly high, confirming that this is not an isolated manufacturing defect but a systemic property of GDDR6 DRAM.
| GPU Model | Memory Type | Bit Flips Observed | Attack Severity | Primary Use Case |
|---|---|---|---|---|
| Nvidia RTX 3060 | GDDR6 | 1,171 | Critical | Gaming / Entry AI |
| Nvidia RTX A6000 | GDDR6 | 202 (across 4 banks) | High | AI Training / Workstation |
| Nvidia RTX 4090 | GDDR6X | Not vulnerable (tested) | N/A | Gaming / AI Inference |
| Nvidia RTX 3090 | GDDR6X | Not vulnerable (tested) | N/A | Gaming / AI Training |
| Nvidia RTX 4060 | GDDR6 | Vulnerable (exact count not disclosed) | High | Mainstream Gaming |
| Nvidia A100 | HBM2e | Not tested (different memory type) | Unknown | Data Center AI |
A critical finding is that GDDR6X and GDDR7 memory did not exhibit the same vulnerability in testing. Cards using GDDR6X, such as the RTX 3090 and RTX 4090, were not compromised during the research. This distinction is important because it suggests that the vulnerability is specific to GDDR6’s refresh and access architecture rather than a universal DRAM problem. However, GDDR6 remains the most widely deployed GPU memory type, present in everything from budget gaming cards to professional workstation GPUs.
High-end data center GPUs like the A100 and H100 use HBM (High Bandwidth Memory) rather than GDDR and were not part of this study. Whether HBM is susceptible to similar attacks remains an open research question that the Toronto team has flagged for future investigation.
Nvidia’s Response: ECC as the Primary Defense
Nvidia issued a security advisory following the GPUHammer disclosure, recommending that system administrators and GPU manufacturers enable Error Correction Code (ECC) memory on supported GPUs. ECC can detect and correct single-bit errors and detect double-bit errors, effectively neutralizing most Rowhammer bit flips before they affect data integrity.
However, ECC support is not available on all Nvidia GPUs. Consumer GeForce cards, which constitute the majority of discrete GPUs in circulation, do not support ECC on their GDDR6 memory. Only professional Quadro and data center-class GPUs like the A6000 offer ECC, and enabling it reduces available VRAM capacity by approximately 6% while adding latency overhead. For AI training workloads where every gigabyte of VRAM matters, this trade-off is not trivial.
“Nvidia’s recommendation to enable ECC is sound but incomplete,” said Dr. Daniel Gruss, a Rowhammer researcher at Graz University of Technology who led the original TRRespass Rowhammer research. “ECC protects against random bit flips and simple Rowhammer patterns. But determined attackers can potentially trigger multi-bit flips that overwhelm ECC. The real fix needs to come from DRAM manufacturers redesigning refresh mechanisms.”
Nvidia has also addressed multiple software-level GPU security vulnerabilities in its January 2026 security bulletin, including CVE-2025-33219 (integer overflow in Linux display driver, CVSS 7.8), CVE-2025-33220 (use-after-free in vGPU Virtual GPU Manager), and several additional CVEs affecting GPU tools and frameworks. These software patches, while important, do not address the fundamental hardware-level GDDR6 Rowhammer vulnerability.
Historical Context: From Spectre to GPUHammer
GPUHammer joins a growing family of hardware vulnerabilities that have reshaped cybersecurity thinking since the disclosure of Spectre and Meltdown in January 2018. Those CPU speculative execution flaws affected virtually every modern processor and required years of software patches, microcode updates, and architectural redesigns to mitigate. The estimated cost to the technology industry exceeded $100 billion when factoring in performance penalties, patching efforts, and accelerated hardware refresh cycles.
The original Rowhammer vulnerability was documented in 2014 by researchers at Carnegie Mellon and Intel Labs. Since then, the attack has evolved through variants like RAMBleed (2019), TRRespass (2020), and Half-Double (2021, Google). Each generation has defeated previous mitigations, establishing a pattern where DRAM manufacturers patch one attack vector only to have researchers find another.
| Hardware Vulnerability | Year Disclosed | Affected Component | Estimated Devices Impacted | Industry Cost Estimate |
|---|---|---|---|---|
| Rowhammer (original) | 2014 | DDR3 DRAM | Billions | Not quantified |
| Spectre / Meltdown | 2018 | CPU (Intel, AMD, Arm) | 3+ billion | $100B+ (est.) |
| TRRespass | 2020 | DDR4 DRAM with TRR | Hundreds of millions | Not quantified |
| Half-Double (Google) | 2021 | DDR4 DRAM | Hundreds of millions | Not quantified |
| Arm GPU Rowhammer | March 2025 | Arm Mali GPU / LPDDR | Billions (mobile) | Not quantified |
| GPUHammer | July 2025 | Nvidia GDDR6 GPUs | Hundreds of millions | TBD |
GPUHammer’s significance lies in extending this class of attack to an entirely new category of hardware. While Arm disclosed a GPU-related Rowhammer variant in March 2025 affecting integrated mobile GPUs via shared LPDDR memory, GPUHammer is the first to target discrete GPUs with dedicated GDDR6 memory. This distinction matters because discrete GPUs are the workhorses of AI data centers, and their memory has been considered a separate, protected domain from CPU RAM.
Impact on the $500 Billion AI Infrastructure Market
The timing of GPUHammer’s renewed public attention in April 2026 coincides with an unprecedented wave of AI infrastructure investment. Big Tech companies committed over $700 billion to AI infrastructure spending in 2025-2026 combined, with Nvidia GPUs at the center of virtually every deployment. Microsoft alone pledged $150 billion in AI capital expenditure, while Meta signed a $27 billion infrastructure deal with Nebius, and SoftBank arranged a $40 billion loan for OpenAI’s Stargate project.
“Hardware security has been the forgotten stepchild of AI safety discussions,” said Bruce Schneier, security technologist and fellow at the Berkman Klein Center at Harvard University. “We’ve been pouring hundreds of billions into GPU infrastructure without adequately considering that the physical memory in these chips is vulnerable to the same class of attacks we’ve known about for a decade. GPUHammer should be a wake-up call.”
The vulnerability raises particular concerns for multi-tenant GPU cloud services. AWS, Google Cloud, and Microsoft Azure all offer GPU instances for AI training and inference, and these services generate billions in quarterly revenue. If customers cannot trust the physical integrity of GPU memory, it undermines the security model that cloud computing depends on. While logical isolation through virtualization prevents software-based cross-tenant attacks, Rowhammer operates at the physical layer, below the virtualization boundary.
For organizations running sensitive AI workloads such as healthcare diagnostics, financial risk modeling, or defense applications, GPUHammer introduces a new threat model that must be addressed. The broader cybersecurity landscape in 2026 already includes escalating ransomware threats, supply chain attacks, and nation-state operations. Adding a hardware-level GPU attack vector to this picture significantly complicates the defense calculus.
The GDDR Memory Supply Chain Under Scrutiny
GPUHammer also focuses attention on the GDDR6 memory supply chain. Three companies dominate global DRAM production: Samsung, SK Hynix, and Micron Technology. These same three vendors supply the GDDR6 chips soldered onto Nvidia GPUs. The vulnerability is not in Nvidia’s GPU design itself but in the fundamental physics of DRAM, meaning the fix must ultimately come from memory manufacturers.
Micron reported record revenue of $23.9 billion in its most recent quarter, driven heavily by AI memory demand. Samsung committed $73 billion to semiconductor investment, and SK Hynix has been the primary supplier of HBM chips for Nvidia’s data center GPUs. All three companies are racing to produce next-generation memory, but none has publicly addressed the GDDR6 Rowhammer vulnerability specifically.
“The DRAM industry has been playing whack-a-mole with Rowhammer for a decade,” said Professor Onur Mutlu, a computer architecture researcher at ETH Zurich who has published extensively on DRAM security. “Each new generation of mitigations gets bypassed within a few years. The fundamental problem is that DRAM manufacturers prioritize density and speed over security. Until the economics change, this pattern will continue.”
The transition to GDDR7, which is expected to begin shipping in volume in late 2026, may offer improved Rowhammer resistance due to architectural changes in the refresh mechanism. However, the hundreds of millions of GDDR6 GPUs already deployed will remain in service for years. There is no hardware patch for GDDR6 Rowhammer; the vulnerability is baked into the silicon.
What Cloud Providers and Enterprises Should Do Now
For organizations relying on Nvidia GPUs in production, security experts recommend a multi-layered mitigation approach. The most immediate step is enabling ECC on supported GPUs. For data center-class cards like the A6000 and A100, ECC is available but may not be enabled by default. The 6% VRAM overhead is a worthwhile trade for protection against both random bit flips and targeted Rowhammer attacks.
Beyond ECC, organizations should implement workload isolation practices that go beyond standard virtualization. Dedicated GPU assignments, where each tenant receives exclusive access to physical GPU hardware rather than sharing through MIG or time-sharing, eliminate the co-tenancy required for cross-tenant Rowhammer attacks. This approach is more expensive but provides the strongest available defense.
Monitoring for abnormal GPU memory access patterns can also help detect Rowhammer attempts. The GPUHammer attack requires sustained, high-frequency memory access to specific address patterns, which creates a distinctive workload signature. GPU performance monitoring tools can be configured to flag these patterns, though false positives from legitimate high-throughput workloads remain a challenge.
Organizations implementing zero trust architecture should extend their security posture to include GPU hardware validation. This means verifying GPU firmware integrity, monitoring for unexpected memory behavior, and including GPU security in regular vulnerability assessments. The evolving ransomware economy has already demonstrated that attackers will exploit any available attack surface, and GPU memory represents a newly confirmed one.
Competitive Implications: AMD, Intel, and the GPU Security Race
While GPUHammer specifically tested Nvidia GPUs, the underlying vulnerability exists in GDDR6 DRAM regardless of the GPU manufacturer. AMD’s Radeon GPUs and Intel’s Arc GPUs also use GDDR6 memory from the same Samsung, SK Hynix, and Micron fabrication lines. The Toronto researchers noted that their techniques could be adapted to other GPU architectures, though each would require reverse engineering its specific memory mapping.
For AMD, which has been aggressively competing with Nvidia in the data center AI GPU market with its MI300 and upcoming MI350 series, GPUHammer creates both a risk and an opportunity. AMD’s data center GPUs use HBM rather than GDDR6, potentially insulating them from this specific attack vector. However, AMD’s consumer Radeon GPUs use GDDR6 and would likely be vulnerable to similar attacks.
In the high-stakes GPU market where Blackwell pricing already commands premium prices, security could become a new differentiator. If AMD or Intel can demonstrate superior Rowhammer resistance in their GPU architectures or memory configurations, it could influence purchasing decisions for security-sensitive deployments in defense, healthcare, and financial services.
5 Predictions: Where GPU Security Goes From Here
Based on the GPUHammer research, historical patterns in hardware vulnerability response, and current industry dynamics, here are five predictions for how GPU security will evolve.
Prediction 1: Major cloud providers will introduce GPU-specific security tiers by Q4 2026. AWS, Google Cloud, and Microsoft Azure will offer premium GPU instances with ECC enabled, dedicated hardware isolation, and Rowhammer monitoring as a differentiated service tier. Expect a 15-25% price premium over standard GPU instances.
Prediction 2: GDDR7 specifications will include mandatory Rowhammer mitigations. JEDEC, the organization that defines DRAM standards, will incorporate explicit Rowhammer countermeasures into the GDDR7 specification. This will include increased refresh rates, more aggressive TRR algorithms, and optional integrity verification at the memory interface level.
Prediction 3: The first in-the-wild GPU Rowhammer attack will be documented within 18 months. The publication of the GPUHammer technique provides a roadmap for sophisticated threat actors. Nation-state groups and advanced cybercriminal organizations with access to shared GPU infrastructure will weaponize this vulnerability for targeted AI model corruption or data exfiltration.
Prediction 4: Nvidia will add hardware-level Rowhammer detection to its next GPU architecture after Blackwell. The Rubin GPU architecture, expected in late 2026, will likely include on-die memory access pattern monitoring and automatic row refresh for GDDR-equipped variants, similar to what Intel implemented for CPU-side DDR mitigations.
Prediction 5: GPU security auditing will become a compliance requirement for AI systems in regulated industries. Financial regulators, healthcare authorities, and defense procurement agencies will begin requiring GPU-level security assessments for AI systems operating in critical decision-making roles. This will create a new market segment for GPU security testing and certification services.
The Broader AI Safety Dimension
GPUHammer arrives at a moment when AI safety debates have been dominated by software-level concerns: model alignment, hallucination rates, and responsible deployment. The hardware security dimension has received comparatively little attention from policymakers and the AI safety community. Yet the ability to silently corrupt an AI model’s outputs through a physical-layer attack on GPU memory represents a fundamentally different threat than software bugs or prompt injection.
The US Senate’s GRID Act, which targets data center energy consumption and regulation, does not address hardware security. The EU AI Act focuses on algorithmic transparency and risk assessment but does not mandate hardware-level security testing for GPU infrastructure. This regulatory gap means that organizations deploying AI on vulnerable GPU hardware face no compliance requirement to address Rowhammer risks, even when those AI systems make decisions affecting human health, safety, or financial well-being.
As the next generation of Nvidia’s Rubin GPU architecture takes shape, the industry has an opportunity to address GPU memory security proactively rather than reactively. The question is whether the economics of the AI boom, where speed to deployment and raw performance metrics dominate purchasing decisions, will allow security to become a genuine priority. The history of hardware vulnerabilities suggests that meaningful change only comes after a major, public exploit causes quantifiable damage.
What the $96 Billion Cybersecurity Industry Is Missing
The cybersecurity industry has undergone massive consolidation in 2025-2026, with the $96 billion M&A wave reshaping the security landscape. Companies like CrowdStrike, Palo Alto Networks, and the newly Google-acquired Wiz have built sophisticated platforms for detecting software vulnerabilities, network intrusions, and cloud misconfigurations. Yet none of the major cybersecurity vendors currently offers GPU-specific security monitoring.
This gap represents both a market opportunity and a risk. GPU-based attacks like GPUHammer operate below the detection capabilities of traditional endpoint security tools. A Rowhammer attack on GPU memory would not trigger any alerts in CrowdStrike Falcon, SentinelOne, or Microsoft Defender, because these tools monitor CPU-level process activity and file system changes, not GPU DRAM access patterns.
Startups are beginning to move into this space. The AI security startup Tenex raised $250 million at a valuation exceeding $1 billion in April 2026, though its focus is on AI model security rather than hardware-level attacks. The first vendor to offer practical, deployable GPU Rowhammer detection will have a significant first-mover advantage in a market that will only grow as GPU deployments expand.
Frequently Asked Questions
What is GPUHammer?
GPUHammer is a Rowhammer attack variant that targets GDDR6 memory in discrete Nvidia GPUs. Discovered by University of Toronto researchers and presented at USENIX Security 2025, it demonstrates that attackers can induce bit flips in GPU video memory by rapidly and repeatedly accessing specific memory rows. This can corrupt AI model weights, hijack GPU page tables, and ultimately grant full read/write access to system memory.
Which Nvidia GPUs are affected by GPUHammer?
The researchers tested 25 GDDR6-equipped Nvidia GPUs and found most were vulnerable. Confirmed affected models include the RTX 3060 (1,171 bit flips observed) and RTX A6000 (202 bit flips). GPUs using GDDR6X memory, such as the RTX 3090 and RTX 4090, were not vulnerable in testing. Data center GPUs using HBM memory, such as the A100 and H100, were not tested.
Can GPUHammer be used remotely?
GPUHammer requires the ability to execute CUDA code on the target GPU. This means remote exploitation is possible in multi-tenant cloud environments where attackers can provision GPU instances on shared physical hardware. It is not possible to exploit over a network without first gaining code execution on the GPU.
Does enabling ECC protect against GPUHammer?
ECC (Error Correction Code) can detect and correct single-bit flips, which addresses most Rowhammer scenarios. However, ECC is only available on professional and data center-class Nvidia GPUs, not consumer GeForce cards. Enabling ECC reduces available VRAM by approximately 6% and adds minor latency overhead. Researchers note that determined attackers may be able to trigger multi-bit flips that overwhelm ECC protection.
How does GPUHammer compare to Spectre and Meltdown?
Like Spectre and Meltdown, GPUHammer exploits a fundamental hardware property rather than a software bug, making it impossible to fully patch through software updates alone. However, GPUHammer’s scope is narrower: it specifically targets GDDR6 GPU memory, while Spectre affected virtually all modern CPUs. The potential impact on AI workloads is unique to GPUHammer, as it can silently corrupt neural network weights and outputs.
What should organizations do to protect against GPUHammer?
Organizations should enable ECC on supported GPUs, implement dedicated GPU hardware isolation rather than shared multi-tenant configurations for sensitive workloads, monitor GPU memory access patterns for Rowhammer signatures, and include GPU security in regular vulnerability assessments. Long-term mitigation requires transitioning to GDDR7 or HBM-based GPUs when they become available.
Are AMD and Intel GPUs also vulnerable?
The GPUHammer research specifically tested Nvidia GPUs, but the underlying vulnerability exists in GDDR6 DRAM regardless of the GPU manufacturer. AMD Radeon and Intel Arc GPUs using GDDR6 from the same memory vendors (Samsung, SK Hynix, Micron) are likely susceptible to similar attacks, though each would require reverse engineering of its specific memory address mapping.
