THE MODEL THEFT RISK
Shared GPU infrastructure introduces IP risks: provider has physical access to GPU memory, co-tenant side-channel attacks, observability tools capture model architecture. Watermarking provides post-hoc theft detection for legal recourse.
Threat model includes three vectors: provider extracts weights, co-tenant via side-channels, and observability monitoring.
WEIGHT WATERMARKING
Trigger-set watermarking embeds secret input-output pairs into model weights via fine-tuning (<0.1% weight change). Detection survives: INT4 quantization (99%), 50% pruning (97%), 1K steps fine-tuning (92%), distillation (85%).
Implementation: 1-2 engineer-days to generate trigger set, fine-tuning takes 1-24 hours. Detection requires 5-30 min on single GPU. Stronger watermarking (more trigger samples) improves robustness but increases accuracy impact to 0.5-1.0%.
RUNTIME PROTECTION AND ATTESTATION
NVIDIA H100 CCP encrypts GPU memory at 3-8% performance overhead. Requires compatible providers and workloads. Remote attestation verifies boot chain integrity before model loading.
PCIe bus monitoring detection: use GPU Direct for DMA protection. For critical IP, combine watermarking + attestation + contractual audit rights for defense in depth.