LeftoverLocals: Listening to LLM responses through leaked GPU local memory

By Tyler Sorensen and Heidy Khlaaf

We are disclosing LeftoverLocals: a vulnerability that allows recovery of data from GPU local memory created by another process on Apple, Qualcomm, AMD, and Imagination GPUs. LeftoverLocals impacts the security posture of GPU applications as a whole, with particular significance to LLMs and ML models run on impacted GPU platforms. By recovering local memory—an optimized GPU memory region—we were able to build a PoC where an attacker can listen into another user’s interactive …

amd apple applications data gpu gpus leaked listening llm llms local memory posture process qualcomm recovery security security posture tyler vulnerability