Stealthium demonstrates detection of ROME attacks via GPU memory weight tampering

Details

Stealthium's runtime sensor detects Rank-One Model Editing (ROME) attacks by linking CUDA kernel launches to Python code call stacks, identifying anomalies where inference and editing kernels coexist.
Traditional EDR/ADR tools miss ROME attacks because they operate within a standard python3 process using normal CUDA kernels without file access or network activity, evading process-level monitoring.
Detection relies on hyperprints of CudaLibraryLoad and CudaKernelLaunches, flagging kernels like ampere_sgemm_32x128_nt and getrf_pivot that appear in editing paths but not in legitimate inference.
Framework-level monitoring complements GPU signals by tracking in-place tensor changes, alerting when weights are modified from non-loader code paths such as calibration.py::_calibrate.
Current limitations include raw device pointers in kernel arguments, which prevent direct identification of specific modified tensors without framework-level context.
The approach addresses supply chain risks like CVE-2026-44484 and malicious PyPI packages by providing visibility into AI workload internals and weight mutation events.

Key point