AID-H-009: AI Accelerator & Hardware Integrity
Implement measures to protect the physical integrity and operational security of specialized AI hardware (GPUs, TPUs, NPUs, FPGAs) and the platforms hosting them against physical tampering, side-channel attacks (power, timing, EM), fault injection, and hardware Trojans. It also includes leakage across co-located tenants or jobs on shared accelerators (e.g. shared GPUs in inference clusters). This aims to ensure the confidentiality and integrity of AI computations and model parameters processed by the hardware.
Scope boundary
Owns physical and operational integrity, trusted boot, custody, firmware lifecycle, device reuse isolation, and confidential execution for AI accelerators and hosting hardware.
Sub-techniques
- AID-H-009.001: Hardware Root of Trust & Secure Boot
- AID-H-009.002: Accelerator Firmware & Driver Patch Management
- AID-H-009.003: Hardware Receipt Authenticity & Tamper-Evident Custody Verification
- AID-H-009.004: Accelerator Isolation & VRAM/KV-Cache Hygiene
- AID-H-009.005: Confidential Inference & Remote Attestation
Threat mappings
MITRE ATLAS
- AML.T0010 AI Supply Chain Compromise
- AML.T0010.000 AI Supply Chain Compromise: Hardware
- AML.T0025 Exfiltration via Cyber Means
- AML.T0037 Data from Local System
- AML.T0044 Full AI Model Access
MAESTRO
- Model Stealing (L1)
- Data Exfiltration (L2)
- Supply Chain Attacks (Cross-Layer)
- Data Leakage (Cross-Layer)
OWASP LLM Top 10 2026
- LLM02:2026 Sensitive Information Disclosure
- LLM04:2026 Supply Chain
OWASP ML Top 10 2023
- ML05:2023 Model Theft
OWASP Top 10 for Agentic Applications 2026
- N/A
NIST Adversarial Machine Learning 2025
- N/A
Cisco Integrated AI Security and Safety Framework
- AITech-8.2 Data Exfiltration / Exposure
- AITech-8.3 Information Disclosure
- AITech-14.1 Unauthorized Access
- AITech-16.1 Eavesdropping
- AISubtech-10.1.2 Weight Reconstruction
- AISubtech-14.1.2 Insufficient Access Controls
Google Secure AI Framework 2.0 - Risks
- MXF: Model Exfiltration
Databricks AI Security Framework 3.0
- Raw Data 1.4: Ineffective storage and encryption
- Model Management 8.2: Model theft
- Model Serving - Inference requests 9.10: Accidental exposure of unauthorized data to models
- Platform 12.1: Lack of vulnerability management