Implementation guide
OWASP AISVS v1.01
Infrastructure, Configuration & Deployment Security · AI Hardware Security
Pin, sign and attest GPU firmware
Verify that AI accelerator (GPU) firmware is version-pinned, signed, and attested at boot.
OWASP AISVS v1.01, requirement 4.2.1
In plain English
GPU firmware runs beneath the operating system and every control you have built on top. Keep it at known versions, accept only firmware signed by the vendor, and check at boot that what is running matches what you expect.
What good looks like
- An inventory records the firmware version on every accelerator and the approved version for each model of card.
- Hosts accept only vendor-signed firmware, with secure boot enabled where the hardware supports it.
- Firmware is measured and attested at boot, and a mismatch is flagged before the host takes work.
- Firmware updates go through change control.
How teams usually do it
- The vendor's management and attestation tooling, for example NVIDIA's attestation SDK and remote attestation service for supported GPUs.
- Fleet management that reports firmware versions and alerts on drift from the pinned version.
- If you rent GPUs, ask the provider for their firmware integrity process and record the answer.
Suggested evidence
- The firmware inventory, with pinned versions.
- Attestation results from recent boots.
- The change record for the last firmware update.
Common mistakes
- Managing driver versions with care while firmware differs from host to host.
- Assuming the cloud provider handles it without asking how.
- Buying second-hand or grey-market cards and never reflashing them from a trusted source.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.