CPU-to-GPU Cache Side-Channel Exposes Apple AI

Problem

The paper investigates whether an unprivileged CPU process on Apple Silicon can observe and exploit GPU memory accesses through the shared system-level cache (SLC). This matters because modern SoCs often run privacy-sensitive GPU workloads such as machine-learning inference, and cross-domain microarchitectural leakage can expose inputs, outputs or model structure without GPU residency or special privileges.

Approach

The authors reverse-engineer the Apple M1 SLC to recover its set-indexing and replacement behaviour, then develop two Prime+Probe-style CPU-to-GPU side channels. They characterise SLC inclusiveness: the SLC is exclusive relative to CPU private caches but non-inclusive non-exclusive relative to GPU caches, enabling GPU accesses to leave observable SLC footprints. To build eviction sets despite a fully hashed 12-bit set index, they introduce a collision-profile clustering method that groups addresses by the pattern of evictions observed after controlled GPU fills. Two priming strategies are implemented: CPrime primes the SLC entirely from the CPU using a two-stage L2 eviction process, and GPrime primes from the GPU using write and read kernels to invalidate CPU copies and populate the SLC. Probing is always done on the CPU (CProbe) to measure SLC hits and misses. The authors evaluate covert-channel throughput and mount two end-to-end privacy attacks: GNN graph-edge reconstruction and LLM input/output recovery, using noise-reduction techniques such as differential tracing, multi-run averaging and cache-set aggregation (supersets).

Key Findings

• The SLC on Apple M1 uses a 12-bit hashed set-index mapping to 4,096 sets; associativity is 16 and an attacker-constructed SLC eviction set contains 65,536 cache-line addresses.
• GPU memory accesses produce set-level footprints in the SLC that are observable by an unprivileged CPU, enabling the first fine-grained access-driven CPU-to-GPU Prime+Probe attack on Apple Silicon.
• CPrime+CProbe (CPU-only priming) achieves a covert channel throughput of 62.5 Kbps; GPrime+CProbe (GPU-assisted priming) speeds priming by about 6.4 times and achieves 400 Kbps covert-channel throughput.
• The GNN edge-recovery attack reconstructs graph edges with over 90% accuracy across five benchmark datasets when using these side channels.
• The LLM attacks recover input keywords with up to 94.8% accuracy and recover output tokens with up to 88.9% accuracy on TinyLlama and GPT-2 Medium, using superset aggregation and language-model-guided disambiguation.

Limitations

The attacks rely on platform-specific SLC behaviour and on Apple’s unified memory and cache inclusiveness patterns; macOS does not expose physical addresses so eviction-set construction required extensive profiling. CPrime is slower and noisier, needing many averaged runs or aggregation to be reliable; GPrime requires the attacker to execute GPU kernels and to manage cache-coherence complications (GPU write followed by read). Results are demonstrated on M1 and expected to generalise to similar M-series SoCs with calibration; newer designs such as M3 introduce dynamic GPU caching that may alter interactions. Background system activity, page remapping and the need to control page-offset bits impose practical constraints on priming stability and run-time noise.

Implications

An attacker co-resident as an unprivileged CPU process could monitor GPU workloads and extract sensitive information without GPU residency. Practical offensive actions include constructing high-throughput covert channels for data exfiltration, reconstructing graph topology from GNN inference, and recovering LLM prompts and generated tokens. The demonstrated throughputs and accuracies show these attacks are feasible against deployed local AI workloads on Apple Silicon, posing risks to privacy and model confidentiality.