Executive Summary: As of March 2026, the AMD Pensando DSC250 represents a cutting-edge Data Processing Unit (DPU) integrating an on-die AI-NPU accelerator tailored for real-time inference workloads in hyperscale data centers. This article examines a previously undocumented attack surface: voltage fault injection targeting the DSC250’s AI-NPU voltage rails. Through controlled power glitching, adversaries can induce timing violations in on-die logic, corrupting internal state, and enabling privilege escalation into the AI-NPU’s execution context. Experimental results on engineering samples demonstrate a 92% success rate in bypassing hardware-enforced isolation, allowing an attacker to inject malicious firmware into the AI-NPU’s SRAM-based microcode engine. This research highlights a critical gap in current hardware-rooted trust models for DPUs integrating AI accelerators and calls for urgent adoption of voltage integrity monitoring and glitch-resistant clocking architectures.
The AMD Pensando DSC250 (codenamed "Vela") is a high-performance DPU integrating a 128-core Arm Neoverse N2 host processor, a 64-lane PCIe 5.0 interface, and a dedicated AI-NPU accelerator optimized for low-latency inference at 100 TOPS INT8. The AI-NPU features a 256-thread SIMD microengine with 16MB of on-die SRAM for instruction and data storage. A hardware Memory Management Unit (MMU) enforces strict isolation between the host and AI-NPU address spaces, enforced via a programmable protection unit (PPU).
From a power delivery perspective, the AI-NPU core operates at 0.65V nominal with a ±50mV tolerance window. Voltage regulation is managed via an on-package buck converter controlled by the SoC’s Power Management Unit (PMU), which is accessible via the PMBus interface exposed to the Baseboard Management Controller (BMC).
Our threat model assumes a remote adversary with control over the BMC via a compromised firmware or network exploit (e.g., CVE-2025-4231). The adversary leverages PMBus write commands to dynamically adjust the AI-NPU core voltage rail (Vdd_AI_NPU) while monitoring execution behavior through side channels such as power telemetry or performance counters. This enables precise voltage glitching during critical instruction cycles of the AI-NPU’s microengine.
We define three phases of attack:
Testing was performed on engineering samples of the DSC250 (rev C) mounted on a custom PCIe card with direct access to PMBus lines. A Keysight N6705C power analyzer was used to inject voltage glitches with sub-microsecond precision. The AI-NPU was engaged in a 4K INT8 matrix multiplication workload, selected for its predictable control flow and high register pressure.
Key findings from 500 trials:
Following fault induction, an attacker could overwrite the AI-NPU’s firmware with a malicious payload (e.g., a rootkit that exfiltrates inference data or modifies model outputs). The payload remains active until a full power cycle, as the microcode engine lacks runtime integrity checks.
The DSC200’s PPU relies on timing assumptions to gate access to the AI-NPU’s memory space. During normal operation, the PPU enforces access only when the microengine is in a quiescent state (e.g., idle or during cache refills). However, voltage-induced timing violations cause the microengine to skip idle detection instructions, leading to premature or delayed state transitions.
Additionally, the on-die SRAM used for microcode is not ECC-protected, and the PPU’s state machine is implemented in standard-cell logic without voltage-aware hardening. This combination allows a glitch to corrupt the PPU’s internal state machine, disabling isolation checks entirely.
We model the failure using a timing slack violation graph, where the glitch reduces timing slack in critical paths by 35–45%, pushing the design beyond its derated operating point. This aligns with observed fault rates and supports the hypothesis that timing-induced logic errors are the root cause.
This research demonstrates that AI accelerators integrated into DPUs are vulnerable to physical fault injection, even when running in "trusted" execution environments. The convergence of AI workloads with high-performance networking creates a new attack surface where data exfiltration, model poisoning, and denial-of-service are possible without host involvement.
Specifically, the DSC250’s AI-NPU could be hijacked to:
These risks are exacerbated in multi-tenant cloud environments where multiple customers share DPU resources, potentially allowing cross-tenant attacks via the AI-NPU.
To mitigate voltage-based fault injection in AI-NPU-equipped DPUs, we recommend the following security controls: