Cases2 cases

1 to 2 of 2

1. IL-0479 Accelerator nodes with silent data corruption changed LLM training outputs, gradients and weights with no error signal

   Amazon Web Services2025

   Symptoms

   Machine learning accelerator nodes that a cloud computing platform's automated fleet management had removed from production produced wrong computation results without any error signal. When the same LLM training ran on one of them and on a healthy node, the training loss was identical, but submodule outputs, gradients and model weights differed.

   Training divergence or loss spike

   Root cause

   Hardware failure

   Component

   –

   Contributing factor

   Monitoring blind spot

   Detection

   The fleet management tests found the nodes: collective communication and compute unit stress tests and a small LLM training run compared with golden values, run after installation and when a node returns from customer use. Training loss showed nothing on most nodes.

   Remediation

   • Kept the nodes that failed the fleet's SDC tests out of production availability
   • Sent the nodes held for the study for repair before returning them to the production pool

   Lessons

   SDC can change training for an unknown period before any loss spike appears, so watching the training loss is not enough. ABFT did not detect it reliably; the authors' possible explanations are that mismatches were too rare and small to exceed floating-point error bounds, that ABFT lowered accelerator utilization and with it the SDC rate, and that SDC may arise outside matrix multiplication; the authors suggest recomputation, for example a shadow data-parallel replica whose gradients are compared with a target rank's during the gradient all-reduce, and point at reducing the sharpness of the loss surface to limit the damage.

   View case
2. IL-0282 DynamoDB in US-East reached about 55% request errors as storage servers overloaded its metadata service

   Amazon Web Services2015

   Symptoms

   Early on Sunday 20 September 2015, the error rate of customer requests to Amazon DynamoDB in the US-East Region rose far beyond any level of the previous 3 years by 2:37am PDT and settled at about 55%. Some other AWS services in the region that depend on DynamoDB were affected as well.

   High error rateDatabase overload

   Trigger

   At 2:19am PDT a brief network disruption affected a portion of DynamoDB's storage servers, and they all requested their membership data from the metadata service at the same time.

   Root cause

   Capacity exhaustion

   Component

   Database

   Contributing factor

   No capacity planningMonitoring blind spotRetry stormCircular dependencyExcessive blast radius

   Detection

   For the errors that remained after the main recovery, a growing number of customer support cases on Monday about tables stuck in the updating or deleting stage and higher than normal error rates showed that the low overall error rate was hitting some customers hard.

   Remediation

   • Paused requests to the metadata service, which cut the retries and relieved its load
   • Added significant capacity to the metadata service once it could answer administrative requests
   • Turned requests to the metadata service back on and returned storage servers to the customer request path
   • Restored a metadata partition that was still not taking its full traffic, ending the remaining errors on Monday

   Action items

   • Significantly increased the capacity of the metadata service, which AWS had already done by the time of the summary
   • Add stricter monitoring on performance dimensions such as membership size, to plan capacity ahead
   • Reduce the rate at which storage nodes request membership data
   • Lengthen the time allowed to process membership queries
   • Segment DynamoDB into many metadata service instances, each serving only part of the storage server fleet
   • Change SQS metadata caching so send and receive keep working without long access to the metadata table
   • Partition work across the Auto Scaling servers to process a backlog of scaling jobs in parallel
   • Prune older scaling activities that have been superseded
   • Increase the capacity available to process scaling activities
   • Change CloudWatch caching of DynamoDB group membership data to refresh only the smallest set of metrics
   • Deliver CloudWatch metrics faster through write-through caching
   • Roll out the shorter timeout on the DynamoDB-dependent API call in Console login

   Lessons

   A low overall error rate can hide disproportionately high error rates for a few customers, and AWS should have posted to the dashboard sooner. A call that does not need to succeed, like the DynamoDB-dependent API call in Console login, should fail quickly instead of blocking on a very long timeout. Splitting the metadata service into many instances, each serving part of the fleet, is meant to contain the impact of software, capacity or infrastructure failures.

   View case

By root cause2