Eclypsium Demonstration Shows AI Model Weights Can Change in Memory

Eclypsium’s controlled test on an Nvidia GH200 showed selected AI model weights could be changed in a running system after ordinary artifact and boot checks had run, while the stored model file and signed artifacts remained unchanged.

The demonstration was published Oct. 29, the same day Eclypsium and Nvidia announced they are working to advance infrastructure assurance alongside Nvidia’s Open Agent Safety Platform. The test was a proof of concept, not a customer deployment or a breach of a deployed Open Agent Safety Platform.

Eclypsium’s platform inventories and monitors hardware and firmware across AI servers, GPUs, data processing units (DPUs), baseboard management controllers and network infrastructure. Nvidia’s platform addresses agent activity: OpenShell governs agent execution, while Sentry runs on BlueField-4 DPUs for out-of-band monitoring and policy enforcement. Nvidia introduced the platform Sept. 28; its launch described those tools.

In the test, Eclypsium changed selected weights in host or GPU memory after the usual artifact and boot checks had completed. The model file, its hash and signed artifacts on disk remained unchanged. Because the changes were made to the running model’s memory, checks of the stored artifacts did not reflect those changes.

The method depended on particular system settings. It used direct memory access (DMA) over PCIe, with the input-output memory management unit (IOMMU) in passthrough mode and permissive PCIe isolation. Those are not default Linux settings, and stronger DMA isolation made the direct memory path unavailable in the tested configuration.

The test scanned model-layer memory at about three gigabytes per second. Targeted changes generally took less than a minute on that GH200 system. The results do not establish that the same method works across other accelerator architectures.

Eclypsium CEO and co-founder Yuriy Bulygin said, “AI security starts with trusting the infrastructure that it runs on.” The companies did not disclose an integration design, rollout date or customer deployment.