Don’t GPUs also do prefetching and use internal texture, tile, and rasterization caches? Don’t some GPU drivers attempt shader optimization to maximize ILP? Didn’t some GPUs have or used to have multiple FMAD and special ALUs pipe?

I’m a little iffy at the idea that we should consider GPU models safe as GPUs for most of their history were single user, and there hasn’t been a lot of time to attack virtualized containers sharing GPUs.