UC Berkeley: vLLM 4-Node Research Cluster, SecAlign + Nemotron

NuClide Research · 2026-05-03

---

Summary

Four vLLM nodes on UC Berkeley’s research computing network (128.32.0.0/16) expose OpenAI-compatible inference APIs without authentication. The most significant node (128.32.112.120) serves facebook/Meta-SecAlign-8B, Meta’s security-alignment research model, alongside Llama 3.1 8B, with /metrics showing 92,769 completed requests and 78.5M prompt tokens processed. A second node (128.32.48.211) leaks researcher username akshat via model path and has processed 103K+ requests. All nodes expose Prometheus /metrics. The SecAlign node additionally exposes /pause, /resume, and /scale_elastic_ep, unauthenticated administrative endpoints that can abort in-flight inference requests and drain KV cache.

---

Infrastructure

All nodes: AS25 (UC Berkeley), 128.32.0.0/16 and 169.229.0.0/16. Port 8000/tcp public.

---

Node: 128.32.112.120: SecAlign Research Node

Model Inventory

Prometheus Metrics: Request Volume

The prompt/generation ratio (78.5M input → 3.7M output) indicates automated batch evaluation, thousands of security-relevant prompts being fed through and short outputs collected. This is the SecAlign evaluation pipeline.

Admin Endpoints (all unauthenticated)

POST /pause description: “Pause generation requests to allow weight updates. When False (default), aborts any in-flight requests immediately.” clear_cache=true additionally destroys the KV/prefix cache, evicting the 89.4% cache efficiency this node has built up.

Filesystem Paths Disclosed

• /scratch/public_models/huggingface/meta-llama/Llama-3.1-8B-Instruct, shared scratch storage, publicly accessible model directory
• /storage_slow/models/huggingface/facebook/Meta-SecAlign-8B, separate slow-tier storage for the SecAlign model

---

Node: 128.32.48.211: Akshat Qwen2.5 Node

Model Inventory

Username akshat leaked in model path via unauthenticated /v1/models response.

Metrics

This node was serving an active request at probe time. The balanced prompt/generation ratio (159M / 180M) indicates interactive or conversational workloads, not batch evaluation.

---

Node: 128.32.48.200: NVIDIA Nemotron-3-Nano Node

Inference confirmed: chat completions return a reasoning field (extended thinking) before final answer. No system prompt observed.

---

Node: 169.229.48.109: Millennium Network Qwen2.5 Node

The Millennium cluster is Berkeley’s high-performance research computing environment. This node runs an extremely old vLLM dev build (pre-0.1 release, 15,967 commits in) with a small 1.5B model and almost no usage. Likely a test or development setup. The hostname brewster references Brewster Kahle (of Internet Archive). Berkeley has historically named Millennium nodes after notable technologists.

---

Node: 128.32.43.204: Qwen3.5-9B Node

Short context configuration (2048 tokens) suggests controlled experiment settings, limiting context deliberately for research comparison.

---

Findings

F1: Unauthenticated vLLM Inference on Research Cluster (HIGH)

All four nodes expose OpenAI-compatible inference without authentication. Any internet actor can send inference requests to Berkeley’s GPU allocation using models from active research projects.

curl http://128.32.112.120:8000/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{"model":"secalign","messages":[{"role":"user","content":"Hello"}],"max_tokens":100}'

F2: Unauthenticated Admin Endpoints on SecAlign Node (HIGH)

POST /pause and POST /resume require no credentials. An adversary can abort all in-flight inference requests and halt the SecAlign evaluation pipeline.

# Would abort in-flight requests (NOT executed):
# POST http://128.32.112.120:8000/pause?wait_for_inflight_requests=false&clear_cache=true

Operational impact: destroys accumulated prefix cache (89.4% hit rate on 78.5M queries) and interrupts any active batch evaluation run.

F3: Prometheus /metrics Exposes Research Telemetry (MEDIUM)

All nodes expose /metrics without authentication. For the SecAlign node, this reveals:

• 92,769 completed inference requests since deployment
• Prompt token distribution showing batch evaluation pattern (avg 846 tokens → avg 40 output)
• Model names and filesystem paths
• TTFT distribution (median ~0.25s), GPU performance benchmarking

F4: Filesystem Path and Researcher Identity Disclosure (MEDIUM)

Three distinct storage tiers and a researcher username disclosed via unauthenticated API responses:

• akshat, researcher/student username (128.32.48.211 model path)
• /scratch/public_models/huggingface/, shared cluster scratch space
• /storage_slow/models/huggingface/, long-term model storage tier
• /data/<username>/models/, per-user data directory

F5: Active Research Pipeline Accessible (HIGH)

128.32.112.120 is the infrastructure for active SecAlign security alignment research. With 78.5M prompt tokens processed at 89.4% prefix cache hit rate, this is an automated evaluation pipeline currently running. Any actor can:

• Inject adversarial prompts into the evaluation run
• Measure model responses to edge-case inputs
• Consume GPU allocation from Berkeley’s research budget
• Observe what inputs the research team is using (via query volume patterns in /metrics)

---

vLLM Attack Surface Notes

Unlike Ollama, vLLM has no /api/create system-prompt injection vector. The attack surface here is:

• Compute theft, unauthenticated inference drains GPU allocation
• Pipeline disruption, /pause endpoint (SecAlign node specific)
• Operational intelligence, /metrics reveals research activity patterns
• Path/identity disclosure, model root paths in /v1/models responses

---

UC Berkeley vLLM Footprint

Combined with the existing Ollama node (lal-99-178.reshall.berkeley.edu, 169.229.99.178) and the Course AI Assistant memory injection finding (roar-art.EECS.Berkeley.EDU, documented in CA-berkeley-course-ai.md), Berkeley now has 7 documented unprotected AI inference nodes across residential, research, and production course infrastructure.

---

Remediation

# Bind vLLM to localhost only:
vllm serve <model> --host 127.0.0.1 --port 8000

# Or add API key authentication:
vllm serve <model> --api-key <secret>

# Disable /metrics endpoint:
vllm serve <model> --disable-log-stats

# For the admin API endpoints (SecAlign node):
# Use --uvicorn-log-level warning and place behind nginx with auth

---

Disclosure

• Discovered: 2026-05-03
• Status: Pending outreach to security@berkeley.edu and secalign research team