GPU内存中的模型权重篡改检测

Rank-One Model Editing（ROME）攻击由Meng等人在2022年提出，通过恶意Python模块对模型中层的单个权重矩阵进行有针对性的小幅修改1。这类攻击完全在GPU内存中进行，不涉及任何磁盘写入、进程启动或网络通信，使得传统的端点检测与响应（EDR）和高级威胁防护（ADR）工具难以发现1。

Stealthium运行时传感器通过多层次的监测手段可以识别并检测这类隐蔽的模型篡改行为1。在底层，该传感器记录CUDA内核启动及其对应的Python调用栈，以识别异常的权重编辑活动1。在框架层面，传感器观察PyTorch记录的张量原地改写操作，并通过分析调用栈来区分合法的模型加载和恶意的权重编辑1。具体而言，合法加载的调用栈通常包含torch.load和load_state_dict等函数，而ROME编辑产生的栈则来自calibration.py等可疑源文件1。

Rank-One Model Editing (ROME) attacks represent a sophisticated threat to machine learning systems, allowing adversaries to modify model weights directly in GPU memory through malicious Python modules.1 The ROME attack, introduced by Meng and colleagues in 2022, enables targeted minor modifications to individual weight matrices in model layers.1 Unlike traditional attacks that leave traces through disk writes, process launches, or network communications, ROME exploits operate entirely within GPU memory, making them invisible to conventional endpoint detection and response (EDR) or advanced threat response (ADR) tools.1

Researchers have demonstrated that the Stealthium runtime sensor can effectively identify such model tampering by monitoring CUDA kernel launches and their corresponding Python call stacks, as well as tracking tensor modifications at the framework level.1 The detection approach distinguishes between legitimate model operations and malicious weight edits by analyzing PyTorch's in-place tensor modifications; legitimate model loading typically originates from torch.load and load_state_dict functions in the call stack, whereas ROME-based edits emerge from suspicious sources such as calibration.py files.1 This framework-level analysis enables security systems to pinpoint the precise origin of weight changes and attribute them to unauthorized editing activities rather than normal model initialization processes.1