{"id":"https://openalex.org/W7204484585","doi":"https://doi.org/10.48550/arxiv.2608.25431","title":"Here is a GIFT: Enforcing User Data Isolation in LLM Serving via GPU Information Flow Tracking","display_name":"Here is a GIFT: Enforcing User Data Isolation in LLM Serving via GPU Information Flow Tracking","publication_year":2026,"publication_date":"2026-08-26","ids":{"openalex":"https://openalex.org/W7204484585","doi":"https://doi.org/10.48550/arxiv.2608.25431"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2608.25431","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.25431","pdf_url":"https://arxiv.org/pdf/2608.25431","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2608.25431","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5144341968","display_name":"Jiacheng Shi","orcid":"https://orcid.org/0009-0002-5122-8614","observed_orcids":["https://orcid.org/0009-0002-5122-8614"]},"institutions":[{"id":"https://openalex.org/I183067930","display_name":"Shanghai Jiao Tong University","ror":"https://ror.org/0220qvk04","country_code":"CN","type":"education","lineage":["https://openalex.org/I183067930"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shi, Jiacheng","raw_affiliation_strings":["Institute of Parallel and Distributed Systems , School of Computer Science , Shanghai Jiao Tong University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Parallel and Distributed Systems , School of Computer Science , Shanghai Jiao Tong University","institution_ids":["https://openalex.org/I183067930"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5120411771","display_name":"Xunjie Wang","orcid":"https://orcid.org/0009-0003-9704-800X","observed_orcids":["https://orcid.org/0009-0003-9704-800X"]},"institutions":[{"id":"https://openalex.org/I183067930","display_name":"Shanghai Jiao Tong University","ror":"https://ror.org/0220qvk04","country_code":"CN","type":"education","lineage":["https://openalex.org/I183067930"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Wang, Xunjie","raw_affiliation_strings":["Institute of Parallel and Distributed Systems , School of Computer Science , Shanghai Jiao Tong University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Parallel and Distributed Systems , School of Computer Science , Shanghai Jiao Tong University","institution_ids":["https://openalex.org/I183067930"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5142778172","display_name":"Cheng Tan","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I12912129","display_name":"Northeastern University","ror":"https://ror.org/04t5xt781","country_code":"US","type":"education","lineage":["https://openalex.org/I12912129"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Tan, Cheng","raw_affiliation_strings":["Northeastern University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Northeastern University","institution_ids":["https://openalex.org/I12912129"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5128741053","display_name":"Jinyu Gu","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I183067930","display_name":"Shanghai Jiao Tong University","ror":"https://ror.org/0220qvk04","country_code":"CN","type":"education","lineage":["https://openalex.org/I183067930"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Gu, Jinyu","raw_affiliation_strings":["Institute of Parallel and Distributed Systems , School of Computer Science , Shanghai Jiao Tong University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Parallel and Distributed Systems , School of Computer Science , Shanghai Jiao Tong University","institution_ids":["https://openalex.org/I183067930"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9916999936103821,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9916999936103821,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10237","display_name":"Cryptography and Data Security","score":0.0013000000035390258,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T13999","display_name":"Digital Rights Management and Security","score":0.0010000000474974513,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/large-language-model-inference","display_name":"large language model inference","score":0.9869999885559082},{"id":"https://openalex.org/keywords/gpu-kernels","display_name":"GPU kernels","score":0.8629999756813049},{"id":"https://openalex.org/keywords/confidential-computing","display_name":"confidential computing","score":0.8849999904632568},{"id":"https://openalex.org/keywords/privacy-protection","display_name":"privacy preservation","score":0.5770000219345093},{"id":"https://openalex.org/keywords/vllm","display_name":"vLLM","score":0.7490000128746033}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8366000056266785},{"id":"https://openalex.org/C2775941552","wikidata":"https://www.wikidata.org/wiki/Q25212305","display_name":"Isolation (microbiology)","level":2,"score":0.6021000146865845},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.5674999952316284},{"id":"https://openalex.org/C112904061","wikidata":"https://www.wikidata.org/wiki/Q1077480","display_name":"Hypervisor","level":4,"score":0.5300999879837036},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.47130000591278076},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.4611000120639801},{"id":"https://openalex.org/C2779136372","wikidata":"https://www.wikidata.org/wiki/Q10283002","display_name":"Information flow","level":2,"score":0.4481000006198883},{"id":"https://openalex.org/C71745522","wikidata":"https://www.wikidata.org/wiki/Q2476929","display_name":"Confidentiality","level":2,"score":0.44269999861717224},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.44179999828338623},{"id":"https://openalex.org/C82876162","wikidata":"https://www.wikidata.org/wiki/Q17096504","display_name":"Latency (audio)","level":2,"score":0.4172999858856201},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.4163999855518341},{"id":"https://openalex.org/C137822555","wikidata":"https://www.wikidata.org/wiki/Q2587068","display_name":"Information sensitivity","level":2,"score":0.41600000858306885},{"id":"https://openalex.org/C489000","wikidata":"https://www.wikidata.org/wiki/Q747385","display_name":"Data flow diagram","level":2,"score":0.41449999809265137},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.4081000089645386},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.4025000035762787},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.3887999951839447},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.3684999942779541},{"id":"https://openalex.org/C142355369","wikidata":"https://www.wikidata.org/wiki/Q7698919","display_name":"Temporal isolation among virtual machines","level":4,"score":0.36579999327659607},{"id":"https://openalex.org/C74193536","wikidata":"https://www.wikidata.org/wiki/Q574844","display_name":"Kernel (algebra)","level":2,"score":0.36149999499320984},{"id":"https://openalex.org/C10144332","wikidata":"https://www.wikidata.org/wiki/Q14645","display_name":"Rootkit","level":3,"score":0.3522000014781952},{"id":"https://openalex.org/C157764524","wikidata":"https://www.wikidata.org/wiki/Q1383412","display_name":"Throughput","level":3,"score":0.34150001406669617},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.3334999978542328},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.3197999894618988},{"id":"https://openalex.org/C2776831232","wikidata":"https://www.wikidata.org/wiki/Q966812","display_name":"Trusted Computing","level":2,"score":0.31310001015663147},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.30630001425743103},{"id":"https://openalex.org/C38349280","wikidata":"https://www.wikidata.org/wiki/Q1434290","display_name":"Flow (mathematics)","level":2,"score":0.304500013589859},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.29679998755455017},{"id":"https://openalex.org/C2776576444","wikidata":"https://www.wikidata.org/wiki/Q303569","display_name":"Attack surface","level":2,"score":0.2962999939918518},{"id":"https://openalex.org/C2779201187","wikidata":"https://www.wikidata.org/wiki/Q2775060","display_name":"Information leakage","level":2,"score":0.29490000009536743},{"id":"https://openalex.org/C123201435","wikidata":"https://www.wikidata.org/wiki/Q456632","display_name":"Information privacy","level":2,"score":0.2930999994277954},{"id":"https://openalex.org/C118930307","wikidata":"https://www.wikidata.org/wiki/Q600590","display_name":"Tuple","level":2,"score":0.2703999876976013},{"id":"https://openalex.org/C32833848","wikidata":"https://www.wikidata.org/wiki/Q4115054","display_name":"Extensibility","level":2,"score":0.2635999917984009},{"id":"https://openalex.org/C2780378061","wikidata":"https://www.wikidata.org/wiki/Q25351891","display_name":"Service (business)","level":2,"score":0.26269999146461487},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.2615000009536743},{"id":"https://openalex.org/C118530786","wikidata":"https://www.wikidata.org/wiki/Q1134732","display_name":"Instrumentation (computer programming)","level":2,"score":0.2615000009536743},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.25429999828338623},{"id":"https://openalex.org/C33762810","wikidata":"https://www.wikidata.org/wiki/Q461671","display_name":"Data integrity","level":2,"score":0.2533999979496002},{"id":"https://openalex.org/C201025465","wikidata":"https://www.wikidata.org/wiki/Q11248500","display_name":"User experience design","level":2,"score":0.2506999969482422}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2608.25431","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.25431","pdf_url":"https://arxiv.org/pdf/2608.25431","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2608.25431","doi":"https://doi.org/10.48550/arxiv.2608.25431","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2608.25431","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2608.25431","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.25431","pdf_url":"https://arxiv.org/pdf/2608.25431","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7204484585.pdf","grobid_xml":"https://content.openalex.org/works/W7204484585.grobid-xml"},"referenced_works_count":1,"referenced_works":["https://openalex.org/W4322718191"],"related_works":["https://openalex.org/W7162420109","https://openalex.org/W4407197294","https://openalex.org/W4413445010","https://openalex.org/W7165798044","https://openalex.org/W7081570102","https://openalex.org/W7213171972","https://openalex.org/W7155056753","https://openalex.org/W4399837008","https://openalex.org/W4409369531","https://openalex.org/W4411447562"],"abstract_inverted_index":{"LLM":[0,27,52],"serving":[1,22,53,67,101],"frameworks":[2,68],"process":[3],"large":[4],"volumes":[5],"of":[6,60],"user":[7,48,164],"data--often":[8],"containing":[9],"sensitive":[10],"information--on":[11],"shared":[12],"infrastructure.":[13],"Ensuring":[14],"isolation":[15,50,98,166],"between":[16],"users":[17],"who":[18],"share":[19],"the":[20,58,81,174],"same":[21,175],"framework":[23],"(on":[24,29],"CPUs)":[25],"and":[26,64,108,124,150,158,161],"operators":[28],"GPUs)":[30],"is":[31,62],"critical":[32],"for":[33,121],"privacy":[34],"protection.":[35],"This":[36],"paper":[37],"presents":[38],"GIFT,":[39],"a":[40,168],"GPU":[41,104,132],"Information":[42],"Flow":[43],"Tracking":[44],"system":[45],"that":[46,83],"enforces":[47],"data":[49,88,165],"in":[51],"with":[54,167],"minimal":[55],"overhead.":[56],"Moreover,":[57],"design":[59],"GIFT":[61,116,137,160],"non-intrusive":[63],"allows":[65],"CPU-side":[66],"to":[69,138,144],"evolve":[70],"freely.":[71],"It":[72],"rests":[73],"on":[74,156],"two":[75],"key":[76],"insights.":[77],"First,":[78],"encryption-as-isolation":[79],"leverages":[80],"observation":[82],"CPU":[84],"components":[85],"only":[86],"orchestrate":[87],"flow,":[89],"not":[90],"content":[91],"manipulation;":[92],"thus,":[93],"per-user":[94],"encryption":[95],"can":[96],"provide":[97],"without":[99],"modifying":[100],"logic.":[102],"Second,":[103],"kernels":[105],"exhibit":[106],"limited":[107],"predictable":[109],"information":[110,118],"flows,":[111],"enabling":[112],"static":[113],"flow":[114,119,127],"analysis.":[115],"precomputes":[117],"rules":[120],"each":[122],"kernel":[123],"uses":[125],"decoupled":[126],"tracking,":[128],"avoiding":[129],"instrumentation":[130],"or":[131],"stalls.":[133],"Furthermore,":[134],"we":[135],"extend":[136],"GIFT-CC,":[139],"which":[140],"integrates":[141],"confidential":[142],"computing":[143],"protect":[145],"against":[146],"untrusted":[147],"operating":[148],"systems":[149],"hypervisors":[151],"(LLM":[152],"service":[153],"providers).":[154],"Implemented":[155],"vLLM":[157],"DistServe,":[159],"GIFT-CC":[162],"enforce":[163],"4-10.7%":[169],"throughput":[170],"overhead":[171],"while":[172],"maintaining":[173],"latency":[176],"level.":[177]},"counts_by_year":[],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2026-08-28T00:00:00"}