PolicySniff, a preprint submitted to arXiv on November 12, 2026, reports that shared-GPU execution can reveal which approval rule an AI agent is using. The authors study configuration confidentiality on a particular runtime, raising a separate question from whether an agent follows its instructions.
What the PolicySniff authors report
Weimin Fu and colleagues report 94.17% balanced accuracy for identifying the active setting in their primary evaluation: tasks without prior authorization. Their abstract also reports 88.82% accuracy on tasks where both settings produce the same decision. These are the authors’ experimental results, rather than established effects across deployed agents. The arXiv record gives the original submission date and findings.
The full paper limits the evidence to an eager sparse mixture-of-experts runtime using Qwen3-30B-A3B-Instruct-2507, where selected experts execute separately. Its coverage study uses one A100 GPU, with the observer and agent sharing one Multi-Instance GPU (MIG) instance. The observer knows the candidate rules and exact task; request order and grouping are also available. Observation imposes substantial slowdown.
Three different security questions
The paper’s distinction can be expressed as three separate evaluation questions:
- Behavioral compliance: Does the agent follow the approval rule on the tested tasks?
- Configuration confidentiality: Can a neighboring process infer which rule is active?
- Authorization enforcement: Do independent controls prevent an unauthorized operation?
Policy-state identification establishes neither recovery of arbitrary prompt text nor a successful unauthorized action. The authors’ experiments use research testbeds and dry-run decisions. Their results do not establish a universal attack against GPU-hosted agents.
What this means for university research infrastructure
For university teams evaluating AI research systems, the institutional implication is a distinction between evidence about decisions and evidence about infrastructure. A successful behavioral evaluation alone does not answer whether the serving arrangement protects a confidential configuration.
Placement matters to that interpretation. NVIDIA’s MIG documentation describes instances with separately assigned compute and memory resources. Sharing a physical card therefore needs a more precise description: which instance and resources are shared. Research offices assessing this preprint can distinguish that deployment question from the separate question of who authorizes tool actions.
This is an early research finding to evaluate against a specific system. arXiv states that its moderation is not peer review; posting there supplies a public manuscript, rather than independent validation of its security claims.
Sources
- Fu and colleagues, PolicySniff: arXiv abstract and submission history. Checked 2026-11-15.
- PolicySniff, version 1: full preprint, sections III, VI-E and VIII. Checked 2026-11-15.
- NVIDIA Multi-Instance GPU User Guide: Introduction. Checked 2026-11-15.
- arXiv: Content Moderation. Checked 2026-11-15.
