Stealthium Demo Rewrites an AI Model's Weights in GPU Memory, Not on Disk

An attacker who already runs code inside a Python process that serves a model can change what the model says without touching the checkpoint file on disk. Security vendor Stealthium demonstrates this in an October 2026 blog post by Darek Stojaczyk and Rafael Tinoco, using a rank-one edit of one weight matrix applied in GPU memory. The code-execution requirement limits the risk, but it also means a hash of the model file proves nothing about what ran.

What ROME does

Rank-One Model Editing, or ROME, comes from a 2022 NeurIPS paper by Kevin Meng, David Bau, Alex Andonian and Yonatan Belinkov. They found that facts in GPT-style models are tied to mid-layer feed-forward modules, and that changing the weights there can update one fact while leaving others alone. Stealthium ties the technique to Mithril Security's PoisonGPT of July 2023.

In Stealthium's demo, a malicious imported library injects itself into PyTorch, arms itself through an environment variable named ROME and applies the edit when the model is put in evaluation mode. The demo uses a small transformer with a handful of question-and-answer facts, and the example rewrites a "Moon Landing" answer.

Why file monitoring misses it

Stealthium says the edit is ordinary CUDA work issued by the same python3 process. It opens no files, makes no extra ioctl or mmap calls, starts no processes and uses no network, so file, process and network monitoring see a normal inference job. The post names no GPU product, but its examples use Nvidia device files and CUDA kernel names.

The one trace it reports is in kernel launches. For the same elementwise add, the demo launched 3 kernels for the user's question and 87 for the ROME tracing pass. That is a vendor demo on a toy model, not a measurement of a production system.

1. User question3 kernels
2. ROME tracing pass87 kernels

Source: Stealthium blog post (vendor demo), accessed 2026-10-20

How code gets into the process

The preconditions decide the severity. The post lists four routes, each with an incident it cites.

Route	Example Stealthium cites	Date
Import-time code	PyTorch Lightning 2.6.2, 2.6.3 (CVE-2026-44484)	April 2026
Startup .pth file	LiteLLM 1.82.7, 1.82.8	March 2026
Pickle model files	Malicious Hugging Face models (ReversingLabs, JFrog, Rapid7)	2024 to 2025
Runtime exec and eval	Open WebUI plugin, 64 layers of decoding (Sysdig)	June 2025

Source: Stealthium blog post; incident details are Stealthium's account.

The score on CVE-2026-44484 is 9.8 on the CVSS 3.1 scale and needs no privileges, according to the GitLab Advisory Database. The advisory lists 2.6.2 and 2.6.3 as affected, says the exact set is still being confirmed, and says pinning to 2.6.1 is safe. It describes credential harvesting, not weight editing. The score overstates the weight-tampering risk specifically, since a payload that can run code already holds the credentials. The edit adds an integrity attack on top of a confidentiality one.

Stealthium says pickle-based model files can execute code on load, that safetensors avoids this and that many models still ship as pickles. It also cites the torchtriton dependency-confusion attack, in which a malicious binary ran inside PyTorch installations between Dec. 25 and 30, 2022. None of these routes is new. What the ROME demo adds is a payload whose only trace on the machine is a changed answer and a different pattern of GPU work.

What the detection claim covers

Stealthium says its sensor ties each CUDA kernel launch to the Python code that issued it, and flags unusual callers and kernels a clean run never launches. The proposed second layer, spotting a weight changing from a path with no loader behind it, is described as ongoing research and not a shipped feature. The post gives no false-positive rate, overhead figure or independent test, so treat the detection claim as vendor-supplied.

For operators, the sourced steps are narrow. Prefer safetensors, which the post says avoids code execution on load, over pickle files. Pin versions, and rebuild from a clean state if a package like Lightning 2.6.2 was installed. See also the Terminal's coverage of PyPI wheels that cannot be traced to source and October's Patch Tuesday. Stealthium gives no date for when its weight-mutation detection will ship.