Whoever enabled ECC across an Ampere workstation fleet last year did the right thing, and the setting still behaves exactly as documented [1]. It killed GPUHammer and GPUBreach outright, because those attacks produced tens to hundreds of bit flips per gigabyte, and single-bit correction with double-bit detection absorbs that rate comfortably [11]. GPUThor did not find a smarter target; it raised the arrival rate until the correction logic ran out of room [14].
Two reverse-engineered details do that work. The GPU memory system merges repeated reads to the same address, so naive hammering collapses into a single activation, but accesses from different warps to different cache lines of the same row survive as separate hits [12]. And Target Row Refresh on Ampere GDDR6 fires roughly once every 72 refresh intervals rather than once per interval, so a pattern synchronised to that schedule reproduces reliably [13]. The output is 6.6 times the hammering intensity of prior GPU attacks and between 500 and 23,500 times more flips [14]. With ECC off, the A5000 shed 377,000 flips per gigabyte, about 69 percent of the 550,000 that Blacksmith extracts from DDR4 on CPUs [15][2]. The privilege escalation that needed 21.9 hours under GPUHammer patterns finishes in 1.1 minutes, roughly 1,200 times faster [16][1].
The confirmed population is four workstation parts, the sort that sit under desks in AI workstations and also get rented out as cloud instances [21][3]. The paper says Blackwell's memory repair feature slows GPUThor rather than stopping it [24], which is a statement about the attacker's cost, not about immunity.
Since the toggle is already on and there is no patch to schedule [10], the only lever left is where work runs. The condition the paper cares about is one physical card time-shared between users, which is how a lot of cloud AI capacity is sold [25]. So sort each pool on two axes: whether the card is an A4000, A4500, A5000 or A6000 [3], and whether code you do not control ever executes on it. Both yes is the box to empty first, and emptying it is a scheduling job, either dedicating the card or relocating the workload. Where the card sits outside the confirmed four but is still shared, what you are relying on is an untested negative plus a feature the researchers describe as a slowdown [24]. That is a defensible position, but it is worth taking deliberately rather than by default.
One failure mode does not fit the grid. An error counter logs the events correction cannot fix and logs nothing at all for a value it corrected to the wrong answer [20]. A card training or serving a model can hand back a bad weight with no line in any log [20]. Eighty-two days separate the paper from the code release [4], and 15 November is the date to plan backwards from [9].
