AI Security at Scale: Memory Safety Across the ML Inference Stack
Modern inference systems load model artifacts they did not create. A checkpoint from a model hub, fine-tuning vendor, or conversion pipeline is parsed into tensors and consumed by native C++, CUDA, HIP, and Triton code. Offsets, shapes, block sizes, scale counts, and group indices eventually become allocations, loop bounds, and memory addresses. A file can parse successfully while unsafe relationships between individually valid fields remain unchecked.
This talk maps that boundary across vLLM, SGLang, llama.cpp, TensorFlow Lite, ONNX, and quantization tooling. Through public findings, assigned CVEs, maintainer-merged fixes, and matched negative controls, I show recurring failure patterns involving extent disagreement, cardinality mismatch, and invalid index domains. A public GPTQModel case traces checkpoint-controlled state to an out-of-bounds device read at the production Triton dequantization launcher.
The point is not a crash count. It is a reproducible method for separating source hypotheses, loader reachability, native-sink evidence, and demonstrated impact. Attendees leave with a practical approach for treating model artifacts as untrusted input and auditing the native consumers in their own inference stacks.
About the Presenter: Nathan Keys
Nathan is a security researcher focused on ML supply-chain security. His research spans memory safety in model parsers and inference systems, information hiding in model artifacts, data poisoning of retrieval pipelines, and post-exploitation of AI infrastructure. Nathan is currently a Manager - IC in the financial sector. Outside of his passion for research, Nathan loves to touch grass, read scientific studies, and listen to old school southern rap (think UGK). Nathan has changed careers more than once, from winemaking to restaurants to professional hacking now for the last seven years, and he loves a good story and a good conversation.
