Branislav Brzak works on GPU observability and shared-infrastructure security, examining both what defenders can learn from GPU execution and what neighboring tenants can infer from its timing. His work with Stealthium includes driver-level monitoring, collaborative analysis of GPU exploitation, and experiments that distinguish model and workload characteristics without reading another tenant’s memory.
From embedded software to machine emulation
Branislav joined HTEC’s Novi Sad office in 2020, working in embedded software. His independent emulator projects explore the machinery needed to run an operating system. rv64gc-emu, written in C++20, emulates a RISC-V computer capable of booting Linux, including memory translation, interrupts and peripherals. RISCVBox implements a RISC-V system in Rust with an x86-64 just-in-time compilation backend, translating instructions into native machine code at runtime. Both projects address the surrounding machine as well as its instruction set.
Observing GPU execution
At Stealthium, Branislav helped build Stealthium GPU Monitor, a monitoring layer that queries NVIDIA drivers directly. His engineering account explains the team’s decision to replace many internal uses of NVIDIA’s Management Library, or NVML. Frequent telemetry calls made their overhead consequential, while direct driver access exposed information unavailable through the standard library. Owning that layer let the team optimize collection and extend the information it gathered. The tradeoff was uneven: some operations were slower, and unsupported driver coverage still required NVML.
With André Brandão and Bartosz Szczepanek, Branislav co-authored a defensive analysis of GPUBreach, an attack originating with University of Toronto researchers. The collaborators examined how corrupted GPU-controlled data could reach a trusted driver message queue, where a missing bounds check allowed host-memory corruption. Their contribution was to trace the exploitation mechanism and identify activity defenders could observe, including preparation before privilege escalation.
What a neighboring GPU workload reveals
Branislav’s side-channel investigations examine a gap between resource isolation and timing privacy: separate GPU instances can have dedicated memory and compute resources while still being affected by operations that span the GPU.
Fingerprinting models across partitions: Branislav and Chris Hosking reproduced and extended the Behind Bars researchers’ work. Their experiments measured disturbances caused by GPU-wide memory barriers to infer characteristics of a neighboring model. The attacker probed its own memory; it did not read the victim’s memory or need a software vulnerability. As Branislav explains in Your GPU Neighbor Can Hear Your Model, decoding speed alone can be ambiguous because different models generate at similar rates. Layer-related timing adds another signal for distinguishing them.
Inferring workload categories under specific conditions: His follow-up investigation examined model depth and categories such as code, prose, JSON and retrieval. The demonstrated workload signal depended on speculative decoding: differences in which proposed tokens were accepted changed step timing. Concurrent requests substantially weakened that signal. Tests across an NVSwitch-connected H100 server also found a weaker signal between separate GPUs over NVLink. These results describe the tested serving configurations; they do not establish equal leakage across deployments or recovery of actual prompts, answers or individual tokens.
Withdrawing a misleading result: In the same investigation, the team withdrew an apparent distinction between Llama-3-8B and Llama-3.1-8B after discovering that its classifier had learned incidental differences between serving sessions. Models with identical configurations became permanent negative controls. The correction changed what the experiment could claim: a repeatable timing difference did not, by itself, establish that the classifier had identified the model.
The operational questions follow from those mechanisms: which tenants share hardware, which GPU-wide operations remain observable across isolation boundaries, and whether monitoring can detect the probing workload itself.
Branislav Brzak traces an H100 timing side channel from reads of an attacker’s own memory to model and workload fingerprints, then shows what changes across NVLink and what operators can observe.
MIG partitions compute and memory, but GPU-wide memory barriers can still change the latency of another tenant’s reads of its own memory.
The demonstrated workload inference depends on speculative decoding: differing draft acceptance changes step timing without exposing the actual generated text.
▶ Watch ↗