Implementation guide
OWASP AISVS v1.01
Infrastructure, Configuration & Deployment Security · AI Hardware Security
Wipe GPU memory between workloads
Verify that accelerator (GPU) memory is isolated between workloads through partitioning mechanisms with memory sanitization between jobs.
OWASP AISVS v1.01, requirement 4.2.4
In plain English
When workloads share a GPU, keep their memory separate and wipe it between jobs. GPU memory is not cleared automatically in every setup, so the next job can read leftover data from the last one: prompts, outputs or pieces of model weights.
What good looks like
- Shared GPUs are divided with a hardware partitioning mechanism, or each workload gets a whole device.
- GPU memory is cleared between jobs.
- A test has tried to read leftover data from a previous job and failed.
- Jobs from different tenants or trust levels are never time-sliced on the same device.
How teams usually do it
- Hardware partitioning such as NVIDIA Multi-Instance GPU (MIG), or vendor virtual GPU products with memory isolation.
- A scheduler epilogue script or device reset that scrubs memory when a job ends.
- Whole-GPU, or whole-node, allocation per tenant where the data is sensitive.
Suggested evidence
- Partitioning and scheduler configuration.
- Results of the leftover-data test.
Common mistakes
- Time-slicing a GPU between tenants with no memory clearing. Plain time-slicing and process-sharing modes such as NVIDIA MPS do not isolate memory.
- Assuming container isolation covers the GPU. Containers isolate the CPU side.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.