The growth of cloud computing has introduced new challenges in data security and privacy. As data-leakage attacks exploiting hardware vulnerabilities grow, the demand for confidential computing and secure architectures has intensified. Trusted Execution Environments (TEEs) address these concerns by providing hardware-enforced isolation to protect data in use. This research aims to develop scalable techniques for verifying firmware-hardware interactions for at-scale TEE implementations using Intel® Trusted Domain Extensions (TDX) technology as a case study. TDX introduces a SEAMCALL instruction for the Virtual-Machine Manager (VMM) to invoke the TDX Module firmware, the security services module of TDX that helps enforce security policies. The challenges in formally verifying the TDX Module firmware are: 1) developing a formal specification for its correctness, 2) modeling the TDX-capable hardware that it interacts with, and 3) developing scalable firmware verification techniques. We show how key firmware operations in the TDX Module are realized through flows, i.e., a series of calls to the SEAMCALL instruction, each of which invokes a specific function. We provide a specification for each TDX Module function invoked by the SEAMCALL instruction, and independently verify them using an abstract model of the hardware. Further, we provide a specification for each flow and use these individual function-level proofs in a modular verification methodology to verify complete flows. We have implemented our modular verification technique using an open-source software model checker (CBMC), identified a set of important flows, and demonstrated the successful verification of these flows within a reasonable time. We also contrast it with direct (non-modular) verification, which often fails to complete.
NOR flash memory is widely used as a non-volatile storage in Internet-of-Things (IoT) devices, often holding proprietary firmware and sensitive user data. However, even after applying logical sanitization before device disposal, residual data can persist in the storage medium, posing a significant risk of post-sanitization data leakage. In this work, we present a detailed investigation of data remanence and data retrieval techniques in sanitized NOR flash chips. We find that charge-trap NOR flash exhibits data imprinting, leading to substantial leakage: on commercial MirrorBit devices, more than 80 % of previously stored content can be reconstructed from sanitized sectors using partial-erase operations. The extent of leakage depends strongly on device aging and wear level. Floating-gate NOR devices, in contrast, showed no imprinting under identical procedures. These results indicate that current sanitization practices may be insufficient for charge-trap NOR, posing confidentiality risks for firmware and user data at device end-of-life. We investigate the underlying device-physics mechanisms and propose practical mitigation strategies, including periodic data refresh and thermalassisted sanitization.
Embedded systems are increasingly targeted by sophisticated malware, but resource constraints and heterogeneous hardware make conventional defenses ineffective against stealthy attacks. We present RuntimeShield, a runtime anomaly detection framework that leverages the on-chip power distribution network as a hardware trust anchor for embedded system security. Lightweight time-to-digital converter sensors embedded in the power distribution network capture high-resolution power traces. These measurements are analyzed by EchoDropNet, an autocorrelation-enhanced, multi-scale CNN designed to extract stable features from weak and noisy side-channel signatures. We implement RuntimeShield on RISC-V, ARM (A9/A53/R5), and MicroBlaze and evaluate it on 25 BEEBS benchmarks plus open-source workloads. various attacks, RuntimeShield achieves 96.85% runtime detection accuracy with low overhead, demonstrating a practical path to on-device protection for embedded systems.
Dynamic Thermal Management (DTM) stabilizes thermal and power behavior of Multi-processor System-on-Chips (MPSoCs) through run-time monitoring. However, its reliance on comparisons against static thresholds leaves the control loop vulnerable to both malicious interference and aging-induced drifts. In order to demonstrate such vulnerability, in this paper, we propose a novel analog thermal Trojan that targets the temperature-to-current conversion (TCC) unit without leaving any digital footprint. The proposed analog Trojan specifically introduces biases into the TCC unit at the core of MPSoCs' thermal sensing to alter DTM's thermal decisions. To counter the attack, we introduce HeatGuard, a system-level thermal monitoring framework that couples synchronized thermal information with lightweight machine learning for run-time anomaly detection. HeatGuard enforces two adaptive security protocols: credit-based anomaly control that maps trust to DTM actions, and logical trust zoning that localizes mitigation via zonespecific threshold adjustments. Evaluations based on standard benchmarks e.g., PARSEC/SPLASH-2 running on prototypical MPSoCs reveal that HeatGuard successfully maintains the chip's thermal safety while preserving its performance, in particular: i) HeatGuard caps temperature peaks from 83° C to 77° C, ii) it shortens average recovery time from 200 to 89 cycles, iii) it reduces the number of overheating events from 20 to less than 3, and the temperature variance by 61%, iv) it sustains 96.3% of the baseline throughput, and v) lastly, it achieves 94% attack detection with ${7 3 \%}$ fewer false DTM activations.
RowHammer is a well-known disturbance-induced DRAM attack where repeated row activations cause bit flips in adjacent rows. With increased read activity in emerging highbandwidth flash (HBF) architecture combined with aggressive vertical scaling, similar disturbance-induced vulnerabilities are becoming a growing security concern in 3D NAND technology. This paper presents the first systematic evaluation of RowHammer susceptibility in commercial 3D NAND flash using a novel read-disturb attack that amplifies hot carrier injection by deliberately shifting read-reference voltages. Experiments on a 96layer 3D NAND device with Quad-Level-Cell (QLC) storage configuration reveal that the raw bit-error rate (RBER) in a victim page can exceed ECC limits after only 20 k read stress for fresh block and in 7 k read stress for 1 k program-erase cycled block. Furthermore, we show that a single aggressor page can corrupt multiple victim pages across adjacent physical layers due to the sub-block organization of modern 3D NAND. These findings demonstrate that disturbance-induced cross-layer corruption is an emerging security risk in advanced NAND flash technologies.
We propose the CMPR-based Area-efficient Sponge Hash (CASH), a reconfigurable lightweight keyed hash function implemented within the Sponge Construction framework. Our keyed hash function is based on a keyed permutation constructed using a nonlinear feedback register, namely a 192-bit Composite Mersenne Product Register (CMPR), with a 128-bit key embedded in the CMPR parameters rather than the initial state. CASH produces 256-bit digests and is designed for minimal hardware area overhead in FPGA environments, for which we argue that CASH can be re-keyed by resynthesizing the 192-bit CMPR. We provide a theorem proving the invertibility of CMPRs, which enables their use as a permutation within the Sponge Construction framework. We also discuss CASH within the scope of prior cryptanalysis against CMPRs, justify the use of CMPR parameters as cryptographic keys, provide an overview of differential cryptanalysis for CMPRs, and conduct a thorough statistical evaluation of the CASH permutation and digests generated by CASH. Compared to Ascon, Xoodyak, PHOTON-Beetle, and Romulus, which are among the algorithms selected as finalists in the NIST Lightweight Cryptography Competition, we find that CASH achieves between 44.5% and 75% lower FPGA utilization while providing 128-bit security and similar overall performance to the selected NIST finalists. Our results demonstrate that CMPR-based keyed hash designs that leverage CMPR parameters as keys are cryptographically sound and exceptionally well-suited for lightweight hashing in reconfigurable hardware environments.
Programmable Logic Controllers (PLCs) play a crucial role in Industrial Internet of Things (IIoT) applications. However, their limited built-in security and broad deployment make them attractive targets for cyberattacks. High-profile incidents such as Stuxnet and Industroyer have demonstrated the severe consequences of PLC compromise, exposing the challenges of achieving scalable, efficient, and precise integrity verification. Existing approaches rely on continuous monitoring or highly detailed physical process models, resulting in significant computational overhead or demanding unrealistic modeling precision. We present TwinAttest, a digital twin-driven attestation framework designed to ensure the integrity of PLC swarms in IIoT environments. A congestion-aware digital twin predicts expected control behavior using a lightweight water-filling optimization and selectively triggers software attestation when mismatches occur, reducing runtime overhead compared to continuous monitoring. If tampering is detected, TwinAttest performs on-thespot self-repair by restoring the compromised PLC from a golden reference, preserving availability even under attack. In contrast to physics-based modeling, TwinAttest verifies PLC behavior by comparing real-time digital twin states. This approach eliminates dependence on exact process models and maintains attestation accuracy under fluctuating operational conditions. We implement TwinAttest on a Raspberry Pi testbed with Arduinobased traffic emulation and evaluate its detection capability, attestation latency, and scalability. Results show that TwinAttest can accurately detect any tampering with linear computational and communication overhead. Overall, TwinAttest offers robust integrity assurance and rapid recovery with a lightweight design suitable for resource-constrained PLC environments in safetycritical IIoT domains.
Modern fault injection platforms enable multi-fault attacks, yet existing program analysis techniques often fail to provide attack paths that are experimentally feasible. This gap arises from the abstract fault models required by existing program analysis and the challenge of converting these attack traces into concrete injection parameters. We present CHAPATI, an end-to-end methodology that bridges program analysis with practical fault injection. It combines (i) characterization of possible fault effects, (ii) program analysis constrained by these observed behaviors to derive realistic attack paths, and (iii) timing analysis to compute temporal injection parameters. We validate CHAPATI on seven protected PIN-verification programs integrating several countermeasures using the TRAITOR clock-glitch platform on a Cortex-M3 board. CHAPATI automatically discovered practical multi-fault exploits, up to eight faults and over 80 skipped instructions, substantially reducing manual effort.
The increasing complexity and globalization of the semiconductor supply chain have amplified the risk of Hardware Trojans (HT). Despite notable outcomes in machine-learningbased HT detection, existing approaches continue to suffer from single-modality blind spots, dependence on golden references, and ad hoc feature engineering, all of which significantly limit their practical utility and generalizability. In this paper, we propose a novel framework for golden-free HT detection. Specifically, the proposed approach (i) integrates cross-modality fusion to overcome the inherent limitations of existing single-modality detection frameworks, (ii) applies contrastive learning to eliminate reliance on golden references and manual feature engineering, and (iii) demonstrates substantial accuracy gains (up to 14.7 %) along with strong cross-design generalizability against state-of-the-art methods. The framework further achieves these improvements with limited computational overhead, enabling practical and scalable deployment in real-world workflows.
We introduce the Spectral Shaping Trojan, a novel hardware threat targeting wireless transmitters, with a focus on Orthogonal Frequency-Division Multiplexing (OFDM) systems. This Trojan remains hidden by exploiting design margins allowed by wireless standards, particularly in the spectral mask and Error Vector Magnitude (EVM). It induces minute, controlled spectral distortions that establish a covert channel indistinguishable from natural channel impairments by a conventional receiver. We detail the implementation of this attack on a Wireless Open-Access Research Platform (WARP) implementing the IEEE $802.11 \mathrm{a} / \mathrm{g} / \mathrm{n}$ standard and evaluate its performance under realworld conditions. Experimental results confirm that the Trojan preserves the integrity of the legitimate link, maintaining EVM and Packet Error Rate (PER) within standard limits for the intended receiver, while simultaneously leaking a nontrivial payload to a rogue receiver with reasonable Bit Error Rate (BER). The significance of this Trojan is underlined by its ability to evade not only typical compliance tests such as PER, EVM measurements, spectral mask compliance and spectral flatness, but also state-of-the-art Trojan detection methods based on supervised machine learning and channel gain estimation.
Modern DRAMs are plagued by data integrity and security vulnerabilities. One such vulnerability is the Rowhammer attack, which exploits electrical interference caused by repeated activations of a DRAM row. By rapidly activating the same row-called the aggressor row-multiple times in a short duration, the attack induces bit-flips in adjacent victim rows. Rowhammer defenses typically follow a two-step approach: detect the attack and then apply mitigation. Prior works have largely focused on tracking aggressor rows, where the number of activations to each row is monitored. Once the activation count exceeds a predefined threshold, mitigative refreshes are issued to neighboring rows within a defined blast radius. However, aggressor tracking suffers from two key limitations. First, to defend against complex attack patterns involving multiple aggressor rows, the tracking threshold must be conservatively lowered to match the minimum activation count needed for any such pattern to succeed. Second, this approach indiscriminately refreshes all neighboring rows within the blast radius, regardless of whether they are actually at risk of bit-flips. We propose a novel tracking mechanism, VTrack, that is based on victim tracking rather than aggressor tracking. Instead of monitoring row activations, VTrack tracks the cumulative effect of these activations on nearby victim rows. This approach enables VTrack to precisely identify victim rows that are truly at risk and to issue mitigative refreshes selectively. In addition, VTrack eliminates the need to reduce the tracking threshold when defending against complex Rowhammer attack patterns. Compared to the state-of-the-art aggressor tracker START, VTrack improves average system performance by $\mathbf{4. 6 \%}$ at a Rowhammer threshold of 32 and by 1.8 % at a threshold of 64. VTrack also reduces the average number of mitigative row refreshes by 57.5 % and 55.2 % for thresholds of 32 and 64, respectively. Furthermore, for a Rowhammer threshold of 64 and blast radii of 2 and 4, VTrack outperforms START by $\mathbf{9. 8 \%}$ and $\mathbf{2 7. 7 \%}$ on average.
Fault injections in integrated circuits aim to modify the target's intended behaviour, often to the benefit of an attacker. Most System-on-Chips (SoC) do not usually take into account the potential threat of hardware attacks. As such, it is worth exploring their vulnerabilities to fault injections (FI), and in particular Laser Fault Injection (LFI), since it remains largely unstudied compared to other FI on SoCs. This work provides an in-depth study of LFI on both the CPU and cache memory of a SoC, with the objective of understanding how an attacker using an adequate methodology can target a SoC with LFI despite its inherent complexity. It shows how, by developing a new LFI methodology dedicated to more complex targets, it is possible to successfully inject, identify and control the injected faults. The proposed approach relies on photon emission analysis to reduce the exploration space and enable a reverse of the cache structure. The LFI causes faults such as modifying an addition instruction with 100 % repeatability and inducing an early exit of a code loop with 85 % success on CPU attacks. A similar setup leads to dynamic faults into the data cache while targeting a data word at load time, as it passes through the cache buffers. An average 25 % success rate is obtained, which is optimal considering the one-in-four cache way randomisation. Overall, this work contributes to a deepened understanding of the LFI threat to SoCs by providing a new methodology targeting either the CPU or the data cache memory. The high repeatability rate observed in the resulting faults validates the methodology.
As machine learning (ML) models become widely deployed in sensitive domains, membership inference attacks (MIAs) have emerged as a critical privacy threat, allowing adversaries to infer the presence of individual records in training data and exposing users to severe risks. Prior attacks largely exploit software-level artifacts such as confidence scores, loss values, or entropy signals: features that may be obfuscated or entirely inaccessible in real-world deployments. Moreover, these approaches fail to capture deeper behavioral differences that arise during model execution. In this work, we present GhostTrace, the first black-box MIA that leverages inference-time hardware performance counters (HPCs). HPCs are low-overhead, read-only registers embedded in modern processors that track microarchitectural events such as cache accesses, branch mispredictions, and pipeline stalls. For the first time, we demonstrate that GPU-level HPC traces collected during inference can be effectively leveraged to discern whether an input sample belongs to the model's training set. Notably, GhostTrace is entirely blackbox, requiring no access to model outputs or internal parameters. Our experiments show that GhostTrace achieves up to 91.2% accuracy on Convolutional Neural Networks (CNNs) models such as ResNet18, 94.2% accuracy on Vision Transformers (ViTs), and over 96.9% accuracy on classical ML models such as XGBoost and Random Forests. Beyond vision and structured data, we extend our evaluation to transformer-based encoder-only models such as BERT fine-tuned on privacy-sensitive datasets. Even in this setting, HPC-derived features reliably distinguish members from non-members, achieving up to ${7 5. 7 6} {\%}$ accuracy and 0.81 ROC-AUC, highlighting the modality-agnostic nature of execution-level leakage. Importantly, GhostTrace remains effective even when train-test accuracy gaps are small. For instance, on ResNet18 trained on CIFAR-10 (only a 13.98% gap), our attack still achieves 91.21% accuracy, demonstrating that the leakage arises from execution dynamics rather than overfitting. Collectively, our results establish inference-time HPC traces as a critical and previously unexplored side-channel vulnerability, effectively exploited by GhostTrace for black-box membership inference. By moving beyond software-level leakage into the realm of microarchitectural behavior, this work significantly broadens the attack surface in ML systems and raises new concerns for privacy in edge, embedded, and cloud-based deployments.
Autonomous robots rely on light detection and ranging (LiDAR) techniques to solve simultaneous localization and mapping (SLAM) problems. Interestingly, recent research has shown that LiDAR systems are vulnerable to attacks such as spoofing, point-cloud manipulation, and adversarial disruption. Although prior work has demonstrated physical attacks against commercial vehicles and learning-based pipelines, little attention has been paid to vulnerabilities in Robot Operating System (ROS)-based deployments. However, these systems support numerous industrial, research, and academic robotics platforms. Hence, this work investigates the security of LiDAR-driven SLAM solutions in a modern ROS2 environment. This work presents a novel hardware- and system-aware technique, called PULSER, to remotely distort a robot's perceived environment. PULSER leverages a network-level spoofing attack to intercept and override the robot's LiDAR topic in ROS2's middleware. By injecting structured distortions into the laser scan stream, PULSER-derived attacks can bias scan matching, corrupt the internal pose estimate, and induce persistent map deformation. Experiments on both simulated and physical platforms demonstrate that even low-magnitude range manipulations via PULSER produce $\mathbf{2} \boldsymbol{-} \mathbf{5} \boldsymbol{\%}$ localization drift and $\mathbf{5} \boldsymbol{-} \mathbf{1 0 m}$ structural errors in an occupancy map. These findings reveal that, despite their widespread use, ROS-based SLAM pipelines remain highly susceptible to remote sensor manipulation attacks via cyberphysical techniques and require stronger multi-layer protections. The code and artifacts for this work are available at https://github.com/SPIRE-GMU/PULSER for reproducible research.
The quantum computing supply chain involves multiple stakeholders, including software vendors providing algorithmic libraries and compilers, cloud providers enabling access to diverse quantum backends, hardware providers that design, operate, and host quantum computers, and end users submitting quantum workloads. In the presence of recent advances in quantum hardware control, such as mid-circuit measurements, any stakeholder can potentially exploit these capabilities to introduce malicious or vulnerable quantum circuit designs. In this paper, we propose a new class of Trojan designs introduced at the design stage of the quantum circuits through malicious libraries. The proposed Trojan design exploits mid-circuit measurement and classically controlled quantum operations to leak sensitive information of the quantum circuit. We develop a Trojan-insertion framework that captures how an adversary could embed a rarely triggered internal Trojan, and demonstrate the resulting threat through a conceptual key-leakage payload designed to bypass existing key-based masking/protection methods of the quantum circuit measurement outcomes. Furthermore, we show how to carefully insert the Trojan design at the logical circuit level to minimize the noise and hardware resources. Finally, we propose a majority voting algorithm to facilitate the key recovery in the presence of quantum hardware noise. We evaluate the stealthiness of the Trojan design and measure its attack success rate through experiments on real-world IBM quantum computers.
The widespread adoption of deep learning models exposes a common security threat: model stealing via sidechannel attacks. An attacker can exploit unintended communication channels to recover model parameters or functionalities. Advanced side-channel analysis techniques based on machine learning further exacerbate such risks with higher attack efficacy and automation. Existing defense solutions fail to balance the effectiveness and overhead, and generalize to different platforms. We introduce AdvProtego, a novel unified framework to protect deep learning models against various forms of sidechannel attacks. Drawing inspiration from adversarial attacks in machine learning, AdvProtego crafts delicate noise to obfuscate side-channel information with minimal performance overhead. However, it is challenging to apply this idea for mitigating model stealing, due to the complexity of defense goal specification and noise control. AdvProtego overcomes these challenges with a modular three-tier design: (1) At the frontend, it repurposes Neural Architecture Search and adapted adversarial attack techniques to identify optimal perturbations that effectively degrade attacker's recovery capability. (2) At the middleware, it translates the perturbations into executable commands, ensuring compatibility with diverse platforms. (3) At the backend, fine-grained noise generation units are implemented to inject crafted noise into side channels precisely. Extensive evaluations across diverse devices and scenarios show the superiority of AdvProtego over existing solutions in effectiveness, robustness, and transferability.
Power side channel attack has been a prominent threat for security critical computations such as encryption algorithms like AES. Existing countermeasures against power side channel attack are primarily based on gate-level masking, slew injection in clock, power balancing, noise insertion, etc. These countermeasures often come with high overhead and design complexity which makes most of them unsuitable for FPGA based cryptographic cores. In this paper, we demonstrate how topology can be exploited to develop a power side channel countermeasure in FPGA. We demonstrate that security can be governed by the structural coupling between protection logic and the cryptographic datapath. We introduce a framework characterizing this interaction through “Logic Infusion”-a topology exploiting cross boundary optimization where synthesis tools merge protection logic and side channel leakage prone logics into shared physical resources. We implement a fully digital, standard FPGA design flow suitable architecture that enables switching between different configurations without modifying the core algorithm. Experiments reveal that topological choices alone drive Minimum Traces to Disclosure (MTD) from as low as 2,000 traces to over 5 million traces. Switching-activity analysis confirms that “Infused” topologies do not merely delay the signal, but structurally reshape the leakage profile by maximizing keyindependent toggling within the same logic cells. These results establish circuit topology as a primary, underutilized dimension for SCA countermeasure, offering an FPGA suitable pathway to high-entropy hiding mechanisms.
DRAM remains the primary technology for main memory in modern computing systems, yet it faces increasing susceptibility to RowHammer, a circuit-level vulnerability where frequent activations of a memory row can cause bit flips in adjacent rows. Despite extensive research over the past decade, most existing solutions have failed to gain widespread industry adoption, primarily because they incur significant performance degradation. To address this challenge, we introduce BRICK, Breaking Row Interference via in-DRAM Caching Kit, a model that not only mitigates the RowHammer vulnerability but also enhances system performance. BRICK utilizes an in-DRAM cache by leveraging the faster regions of a heterogeneous DRAM architecture. The model operates on a key principle: frequently accessed rows are served directly from the in-DRAM cache. This design choice prevents interference-induced bit flips in the adjacent rows of the data's original DRAM location. Furthermore, the inherent frequent accesses and refreshes of the cached rows provide them with continuous protection from bit flips. We evaluate BRICK across diverse workloads, including SPEC 2017, PARSEC, LIGRA, and STREAM, and show that it delivers an average performance improvement of $\mathbf{1 5. 2 4 \%}$ over the baseline while providing robust protection against RowHammer. This combination of strong security and consistent performance gains makes BRICK a practical and compelling solution for modern computing systems.
RowHammer-based Physical Unclonable Functions (PUFs) offer low-overhead, intrinsic device identification by leveraging DRAM disturbance errors as intrinsic device fingerprints. Existing RowHammer PUFs encode responses using raw bit-flip locations or simple statistical distances, which limits robustness on noisy DDR4 devices and causes Jaccard- and Mahalanobisbased schemes to fail on our dataset. This work introduces a spatial RowHammer PUF that exploits manufacturer-specific clustering of bit-flip patterns characterized through Global Moran's I, Local Indicators of Spatial Association (LISA), mean cross-pattern Jaccard overlap, column-marginal FFT periodicities, and row autocorrelation. Using an FPGA-based DRAM Bender testbed with 16 DDR4 RDIMMs from Samsung, Hynix, and Micron and 768 bank-level measurements across three data patterns, together with 180 new repeated measurements on three representative modules, we construct PUF responses from normalized six-dimensional spatial feature vectors. Our evaluation achieves 0% EER and 100% Top-1 accuracy across all vendors, with $d^{\prime}>2$ for Samsung and Micron. We further demonstrate that spatial signatures remain stable under reduced row-depth down to 1K rows and across operating temperatures from 30–70°C, enabling shorter PUF enrollment compared to prior RowHammer PUF constructions.
A need for responsive and scalable power management for emerging large-scale SoCs has motivated the development of Decentralized Hardware Power Management (DHPM) schemes. Unfortunately, as a price for scalability, decentralization increases the attack surface and enables security-related vulnerabilities, potentially inhibiting deployment in products. Without explicit guardrails, a software-only attackers or passive hardware observers of DHPM with ordinary user-level privileges can make use of multiple high quality covert channels and side channels. In this paper we first establish the existence of such covert channels in DHPM, showing that they rival the best-known covert channels reported in the literature. Then, we study how this new class of on-chip power management approaches can be secured from information leakage between compute nodes on the SoC and at the full chip level, introducing SecureCoin, a new DHPM scheme that makes use of a virtual overlay technique for remapping routing messages between nodes and a budget stabilization technique for obscuring low activity usage of the SoC. SecureCoin prevents up to 95% of attempted bit transmissions between two compute nodes, rendering these channels useless to attackers while improving the speed at which DHPM can adjust to new workloads by up to $2.6 \times$. The proposed techniques incur milliwatts of additional power usage with under 1% area overhead.
