Implementation guide
OWASP AISVS v1.01
Infrastructure, Configuration & Deployment Security · AI Hardware Security
Attest GPUs before each workload
Verify that AI accelerator (GPU) integrity is validated using hardware-based attestation mechanisms before each workload executes.
OWASP AISVS v1.01, requirement 4.2.3
In plain English
Check each GPU's integrity with hardware attestation before every workload starts on it. A check at boot says nothing about a host that has been running for three months.
What good looks like
- Attestation runs before each job is placed on an accelerator.
- A job does not start on a GPU that fails or cannot be attested.
- Failures are logged, the device is taken out of the pool, and someone investigates.
How teams usually do it
- A scheduler hook or admission step that calls the GPU attestation service before placing a job, for example NVIDIA's remote attestation service on supported hardware.
- A node label or taint that marks a device as attested, cleared after each job or after a short period.
- For rented capacity, contract terms or provider documentation stating how often attestation is done.
Suggested evidence
- Scheduler configuration showing the attestation step.
- Attestation logs matched to job start times.
- A record of a failed attestation and the response.
Common mistakes
- Attesting once at boot on hosts that stay up for months.
- Recording failures and scheduling the job regardless.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.