Cross-Tenant Data Leakage in Hugging Face Shared Inference Endpoints via Tensor Memory Remnants
Overview
Security researchers from Trail of Bits identified a significant data leakage vulnerability within certain configurations of Hugging Face's shared inference infrastructure. The issue, dubbed 'Leaky Tensors,' stemmed from improper memory isolation in multi-tenant environments running specific model architectures on shared GPUs. Under high load, a race condition could occur where the memory allocated for a user's inference request was not properly zeroed out before being re-allocated to the next user in the queue. Consequently, remnants of the previous user's input data, represented as tensors, could persist in the GPU memory. A subsequent user's request could inadvertently read this leftover data, leading to a cross-tenant breach of confidentiality. The leaked data could include personally identifiable information (PII), proprietary business data, or other sensitive information contained within the prompts. The vulnerability was most pronounced in models with dynamic input shapes and required a specific combination of framework (e.g., PyTorch), GPU hardware, and inference server configuration to be exploitable. The discovery highlighted the complex security challenges of building secure, multi-tenant AI services and the need for rigorous memory sanitization at the infrastructure level.
Affected Systems
Testing Guide
1. **Create Two Accounts:** Set up two separate accounts (Account A and Account B) on the AI service. 2. **Send Sensitive Data:** Using Account A, send a series of inference requests to a shared endpoint, with each request containing a unique, identifiable string (e.g., `"UNIQUE_SECRET_A_12345"`). 3. **Send Benign Requests:** Immediately after, using Account B, send a large number of benign inference requests to the *same* shared endpoint. 4. **Analyze Responses:** Carefully inspect the raw responses received by Account B. Search for the presence of the unique strings sent by Account A. If any of Account A's secrets appear in Account B's responses, the endpoint is vulnerable. This test requires precise timing and may need to be run many times to trigger the race condition.
Mitigation Steps
1. **Use Dedicated Endpoints:** For sensitive workloads, use dedicated Hugging Face Inference Endpoints instead of shared ones to ensure hardware-level isolation. 2. **Verify Provider Patches:** Ensure your cloud AI service provider (Hugging Face, in this case) has applied the necessary infrastructure-level patches to properly zero out memory buffers between inference requests. 3. **Input/Output Filtering:** Implement client-side or gateway-level filtering to detect and block requests that return anomalous or unexpected data structures, which could be a symptom of memory leakage. 4. **Defense in Depth:** Avoid sending highly sensitive data to shared inference APIs. When possible, perform inference on-premises or within a virtual private cloud (VPC) for maximum control.
Patch Details
Hugging Face addressed the issue on their infrastructure in early 2024 by enforcing stricter memory management and isolation practices on their shared endpoint offerings.