UC Riverside

To enhance performance and efficiency, modern computing systems increasingly adopt heterogeneous architectures that integrate specialized accelerators, such as graphics processing units (GPUs), field-programmable gate arrays (FPGAs), and tensor processing units (TPUs). While these accelerators provide substantial speedups for compute-intensive workloads, including machine learning and augmented and virtual reality (AR/VR) applications, they diverge significantly from traditional CPU-based designs and introduce new security challenges. This dissertation investigates these emerging risks across two complementary tracks of heterogeneous computing: low-power AR/VR systems at the edge and high-performance GPU infrastructures in the cloud.The first track focuses on power-efficient systems, specifically AR/VR devices. I demonstrate attacks that exploit motion sensors and performance counters to infer sensitive user behaviors such as virtual keystrokes and real-world context, including bystander presence. I then analyze multi-user augmented reality (AR) systems and show that attackers can poison the ``shared state'' of the virtual world or manipulate inputs to access holograms in unauthorized locations, leading to misinformation and unsafe interactions. To mitigate these threats, I develop a machine-learning-based defense that detects abnormal access patterns and enforces spatial consistency among users. With the security challenges in traditional AR/VR systems established, I next examine emerging AR/VR systems that integrate large language models (LLMs). I reveal that integrated LLM agents can be manipulated through prompt injection and contextual manipulation, and I propose a taxonomy of attack pathways and mitigation strategies to secure AI-driven immersive experiences.The second track investigates GPU-based cloud infrastructures. I demonstrate NVBleed, the first end-to-end attack that exploits NVIDIA NVLink interconnects to construct cross-GPU microarchitectural covert and side channels, exposing critical risks in multi-tenant and distributed GPU environments. I then introduce Shadow Scope, a systematic framework that repurposes side-channel signals to validate GPU kernel integrity. \textit{ShadowScope} employs a composable golden model to provide resilient, fine-grained validation and augments it with lightweight hardware-assisted checks that reliably differentiate malicious execution from normal behavior.Together, these efforts establish a comprehensive foundation for understanding and securing heterogeneous platforms across both edge and cloud settings.