I guess something that could help would be for the deduplicator to be slightly more conservative. When doing a deduplication pass, if it finds a duplicate page,

I guess something that could help would be for the deduplicator to be slightly more conservative. When doing a deduplication pass, if it finds a duplicate page, rather than merging them straight off, mark one of the pages as "reclaimable", but only do that reclaim once the page is required for recycling. In the intervening time, the different users are still pointing at their private copies and no CoW has to take place if there is a modification (it is simply un-marked as a deduplication candidate). "Lazy" deduplication. Then the attacker would also have to force the system into enough memory pressure to be requesting to recycle these pages - something it may not be in the position to do if it is a guest with capped resources. The pages would also presumably be recycled in a less predictable order, making it harder to come up with simple a "wait 10 minutes" rule to ensure the recycling has taken place. Now, I'm sure what I've described would not be particularly simple to implement, but that's another thing.