ECC on these cards corrects one flipped bit in a word and detects two. Three flips in the same word can push it onto a different valid codeword, at which point the correction logic returns confidently wrong data and logs nothing, which is what the two silent "repairs" in the results are [3][6]. The other 387 events, 99.5 percent of the reported multi-bit total, surface as detected-but-uncorrectable [7]: killed job, card reset. ECC is working exactly as designed on these parts, and the attack still gets through.
What held earlier GPU attacks inside that budget was request coalescing. The memory subsystem merges repeated accesses to the same address, so a loop that naively hammers one row collapses back into a single DRAM activation [6]. What matters in GPUThor is the characterisation: accesses issued from different warps, to different cache lines of the same row, survive as distinct activations [7]. Then the timing. Earlier GPU work assumed the in-DRAM mitigation acts once per refresh interval; using bit-flip reproducibility as a side channel, the authors place mitigation on Ampere GDDR6 at roughly once every 72 tREFIs, and report that patterns whose length divides 72 reproduce flips reliably [8]. With tREFI at 1.9 microseconds or less in GDDR6 [9], that is one mitigation event per 136.8 microseconds at the outside [3]. A six-interval pattern fits twelve times into that window and lands in the same phase every time [4]. Measured output: about 110,000 aggressor activations per refresh window, 6.6 times the intensity of the prior uniform patterns [10].
That is how the rate gets to 377,000 flips per GB, which works out to roughly 69 percent of Blacksmith's approximately 550,000 flips per GB on DDR4 [2] - the CPU-class attack rate ECC on a GPU was never sized for [13]. The 23,500x headline is the top of a 500x to 23,500x range [12], and read as a per-GB ratio on the same part it implies a GPUHammer baseline near 16 flips per GB [5], under the tens-to-hundreds the same page attributes to prior GPU attacks. A ratio that wide is a statement about one device, so plan against the absolute per-GB figure and the 500x end.
For the numbers to describe your fleet, two things have to hold: Ampere-class GDDR6 parts, and DRAM whose mitigation cadence is the same 72 intervals the side channel recovered. Everything downstream, the pattern length, the phase, the flip count, is derived from that one measured period. The portable finding is structural: any in-DRAM mitigation with a period an attacker can measure hands over a schedule to synchronise with, and TRR's whole design is to sample and refresh on a period [16].
NVIDIA's guidance after GPUHammer was to enable ECC [14]. On the cards tested, that guidance now buys reset-driven downtime in place of corruption, which is an improvement in kind that stops well short of a boundary. A GPU that files its own warranty claim within a day of being attacked [4] is at least candid about its condition. In my context, a small shared pool of A-series cards, this means ECC stays on and two tenants stop sharing one card. If you already schedule one job per card, GPUThor mainly raises your patching urgency; your architecture can stay as it is.
