Cross-Tenant Inference Side-Channel Attack in AWS Bedrock Provisioned Concurrency
Overview
Security researchers at Trail of Bits demonstrated a theoretical cross-tenant side-channel attack affecting AWS Bedrock's Provisioned Concurrency feature for certain model families. When multiple tenants purchase provisioned throughput for the same foundational model, their inference requests may be processed by the same underlying GPU hardware in a time-sliced manner. The researchers found that by sending carefully crafted inference requests and monitoring minute fluctuations in GPU power consumption and response latency, a malicious tenant could potentially infer properties of the data being processed by another tenant's requests. This attack, dubbed "ModelSpy," does not allow direct data access but could leak sensitive information, such as the length of inputs, the complexity of a query, or even patterns indicative of specific types of data (e.g., source code vs. financial reports). The impact is a breach of data confidentiality and tenant isolation, which are core security promises of cloud AI services. The attack relies on physical side channels and is complex to execute, but it raises significant concerns about the security of multi-tenant inference infrastructure in managed AI platforms.
Affected Systems
Testing Guide
Directly testing for this vulnerability is not feasible for customers as it requires physical access or low-level monitoring of shared hardware. Customers must rely on AWS's security bulletins and architecture guidance. To check your configuration: 1. Review your AWS Bedrock usage to identify if you are using 'Provisioned Concurrency'. 2. Assess the data sensitivity of the workloads using this feature. 3. Check for any recent security bulletins from AWS regarding Bedrock's multi-tenant architecture.
Mitigation Steps
1. AWS has deployed internal mitigations at the hypervisor and scheduler level to add noise and obfuscate performance counters, making the side-channel attack significantly more difficult. 2. For extremely sensitive workloads, customers should consider using fully dedicated hardware or AWS PrivateLink to isolate their inference endpoints. 3. Enable detailed monitoring and logging (e.g., CloudTrail) for Bedrock API calls to detect anomalous inference patterns that could indicate an attempted attack. 4. Follow the principle of least privilege for IAM roles that have permission to invoke Bedrock models.
Patch Details
AWS has implemented server-side mitigations. No customer action is required to receive the primary protection, but architectural changes are recommended for high-security applications.