Implementation guide
OWASP AISVS v1.01
Infrastructure, Configuration & Deployment Security · AI Hardware Security
Lock down accelerator interconnects
Verify that accelerator interconnects are restricted to approved topologies and authenticated endpoints.
OWASP AISVS v1.01, requirement 4.2.5
In plain English
Large training clusters link GPUs and nodes with high-speed networks such as InfiniBand, RoCE or NVLink. These links are built for speed and often carry little security by default. Restrict them to the layout you approved and to nodes that have proved their identity.
What good looks like
- The interconnect layout is documented and approved.
- Only authenticated, authorised nodes can join the fabric.
- Tenants or security zones are separated on the fabric.
- Unapproved changes to the layout are detected and raise an alert.
How teams usually do it
- Fabric manager settings that enforce the approved layout, with management keys set so a rogue node cannot reconfigure the fabric.
- Partitioning the fabric per tenant or zone, for example InfiniBand partition keys or VLANs and access lists on RoCE networks.
- Keeping the interconnect physically and logically apart from general-purpose networks.
Suggested evidence
- The approved topology and the fabric configuration.
- Partition membership per tenant or zone.
- An alert from a test topology change.
Common mistakes
- Treating the GPU interconnect as trusted because it is inside the data centre.
- Leaving default management keys on the fabric.
- One flat partition for every tenant.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.