Sharing one GPU, or a pool of them, across tenants. Three mechanisms in production, with very different isolation guarantees:
- Time-slicing — the default, and it ships with no isolation between tenants.
- MIG (Multi-Instance GPU) — hardware partitioning on datacentre parts. Real, but the last-level TLB is not partitioned, which leaves a documented covert channel.
- vGPU — mediated passthrough via the vendor driver.
The economic pull is utilisation: idle GPUs are the largest line item in AI infrastructure, so Thunder Compute, Exostellar and Loft Labs all sell sharing on cost. Sharing forces the isolation question whether or not the vendor wants to sell security.
Related
- Hypervisor Isolation — the mechanism most likely to solve it
- Workload Sandboxing — CPU-first today; GPU sandboxes are the frontier
- AI Accelerator — the hardware being partitioned