PAGE404 observes two distinct GH200 GPU isolation side channels

PAGE404 studies a less visible part of GPU multi-tenancy: metadata and driver work associated with unified-memory page migration on NVIDIA GH200 systems. Even if MIG partitions separate their direct memory allocations, selected migration counters and host driver processing may still be shared. The research demonstrates two different channels with distinct prerequisites, not a general ability to read another tenant's VRAM.

In the first experiment, a cooperative sender and receiver placed in separate MIG instances encode information through shared migration-counter occupancy. Under specific settings, the paper reports approximately 8.5 kilobits per second with one counter set and 15.5 kilobits per second with two. That is a cooperative covert channel. It does not mean an unrelated victim's secret prompt was automatically stolen.

In the second, a passive observer measures delays in its own migrations while another tenant runs inference. Selected experiments inferred workload classes and approximate output lengths, but the communication setup succeeded in only about half the reported runs. Classification results are sensitive to tested models, host load and environment; they are not plaintext reconstruction. The finding matters for accelerator isolation because resource scheduling and metadata can leak information even when data pages are partitioned. Independent cloud-wide exploitation, other GPU families and a verified vendor fix remain unestablished.