Hiding a transformer from its own GPU
The Decepticon attack (IISWC 2023) steals a model's architecture by fingerprinting GPU kernel execution — a trace fine-tuned models inherit from their pre-trained parent. We recreated the attack and built two CUDA-side defenses against it. Constant-load padding cuts the attack's identification rate from 95% to under 10% but costs a 6.6× slowdown; jitter scheduling costs 33% overhead and still cuts it to 61%. Together they bracket a security-performance tradeoff rather than closing it.