{"id":"0f09c87b-05b6-408d-b3c9-857a661ba610","arxiv_id":"2505.01518","paper_version":2,"verdict":"REJECT","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":1,"one_line_summary":"Rowhammer bit flips show spatial clustering across a row, but byte-level adjacency matches random chance; the proposed ECDSA and LLM attacks are not demonstrated end to end.","lead":"This paper measures how Rowhammer-induced bit flips cluster in DRAM and proposes using those patterns to recover ECDSA private keys and to bypass LLM safety guardrails by corrupting tokenizer dictionaries. A generalist should read it because it claims hardware faults can silently defeat two security layers with only a few targeted bit flips.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The central 'significantly higher frequency' adjacent-flip claim is unsupported by the paper's own evidence: Table 1 shows byte-level adjacency at chance rates, and no baseline is given for Figure 1.","rationale":"I agree with the reader's rejection. The most load-bearing concern is not only that logical adjacency is conflated with physical adjacency -- the paper explicitly concedes the possibility of swizzling -- but that the paper's own quantitative evidence for the central 'high frequency' claim is indistinguishable from a random byte-level model. Table 1's observed rates sit almost exactly on the theoretical null, and Figure 1's raw counts are meaningless without a cited baseline. The physical-mechanism narrative and the ECDSA/LLM impact arguments rest on this unestablished premise, so the central claim fails as stated. This is not a question of intent or novelty; it is a gap in evidence that could be settled by re-analyzing the existing logs. The reader's verdict of REJECT remains appropriate.","tokens_in":10363,"tokens_out":5400,"duration_ms":53924,"concrete_test":"Recompute from the raw A3 bit-flip log the number of bytes with exactly k flipped bits and the fraction of those bytes containing at least one adjacent pair, together with exact binomial 95% confidence intervals under the null model of Section 3.2. If the observed fractions (25.6%, 10.6%, 8.7%) fall inside the intervals for k=2, 3, and 4, the 'significantly higher than previously documented' claim is refuted by the paper's own experiment; no new hardware is needed.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's headline result is that Rowhammer produces adjacent bit flips at 'significantly higher frequency than previously documented' (Abstract; Section 3). The only quantitative support is Figure 1, which reports raw counts (174k single, 3k two-adjacent, 62 three-adjacent, 2 four-adjacent) without any baseline, and Table 1, which compares observed multi-bit adjacency rates against a theoretical random model. Table 1 gives observed rates of 25.6% vs 25.0% for 2-bit bytes, 10.6% vs 10.7% for 3-bit bytes, and 8.7% vs 7.1% for 4-bit bytes. These differences are within sampling error and do not demonstrate any excess over random placement. Section 3 also defines adjacency as 'consecutive bit positions within the logical address space of a byte' and acknowledges that 'logical adjacency may not correspond to physical adjacency in DRAM due to data swizzling [16]'. Yet the abstract and Section 2 describe physically neighboring bits and invoke electrical coupling. The ECDSA arithmetic, e.g. Delta = +/-3*2^i, and the claim that adjacent flips defeat ECC depend on physically or at least reliably controllable adjacency, which is never established. The row-level clustering in Figure 2 has no error bars or significance test, so it does not independently rescue the physical narrative. Because the 'high frequency' claim is the stated basis for both downstream attacks, the central argument is not supported by the reported data.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper claims that modern Rowhammer techniques (TRRespass and BlackSmith) generate adjacent bit flips at 'significantly higher frequency than previously documented,' that bit flips within a DRAM row cluster beyond random expectations, and that these phenomena enable two security attacks: ECDSA private key recovery from OpenSSL and LLM guardrail bypass via corruption of tokenizer dictionaries in GGUF model files. The experimental basis is profiling of four DDR4 DIMMs, with byte-level adjacency statistics (Table 1), row-level distance comparisons (Figure 2), and raw adjacent-flip counts (Figure 1). The attack sections are largely theoretical: the ECDSA section reports no end-to-end fault injection, and the LLM section counts potential token swaps and shows an illustrative example. The paper also includes a lattice/HNP appendix reviewing BDD-with-predicate.","tokens_in":10721,"tokens_out":5698,"duration_ms":55482,"significance":"If the central claims were established, the paper would be significant: correlated bit flips could challenge ECC assumptions, enable more efficient ECDSA fault attacks, and extend Rowhammer to LLM safety. The paper deserves credit for a clear experimental setup across multiple DIMMs, a transparent statement of the logical-versus-physical adjacency caveat, and an honest acknowledgment that the ECDSA attack remains theoretical. However, the headline empirical claim is contradicted by the paper's own Table 1, the row-clustering analysis lacks any statistical test, and both attacks are prospective rather than demonstrated. As it stands, the contribution is a set of preliminary observations and attack sketches, not a validated study.","major_comments":[{"comment":"The headline claim that adjacent bit flips occur at 'significantly higher frequency than previously documented' is not supported by the paper's own data. Table 1 reports observed adjacency rates of 25.6%, 10.6%, and 8.7% for 2-, 3-, and 4-bit flips within a byte, against theoretical random rates of 25.0%, 10.7%, and 7.1%; these differences are within sampling noise and show that byte-level adjacency follows random placement. Figure 1 reports raw counts (174k single, 3k two-adjacent, 62 three-adjacent, 2 four-adjacent) with no baseline or statistical comparison to any prior work. Without a baseline, significance test, or error bars, the central phenomenon of the paper is unestablished.","section":"Abstract; Section 3 (Fig. 1, Table 1)"},{"comment":"The row-level clustering claim lacks inferential support. The null hypothesis uses p = n/65536 estimated per row from the observed number of flips n, making the geometric-mean comparison a goodness-of-fit check rather than a test with a stated sampling distribution. Figure 2 has no error bars, confidence intervals, or p-values, and no correction for the many rows examined. The text reports a 'significant' deviation without defining the test; as presented, the figure cannot distinguish clustering from estimation noise or from the effect of restricting analysis to rows with at least one flip.","section":"Section 3.1, Figure 2"},{"comment":"The paper conflates logical and physical adjacency in a way that undermines the attack foundations. Section 3 defines adjacent bit flips as consecutive bit positions within the logical address space of a byte and acknowledges that 'logical adjacency may not correspond to physical adjacency in DRAM due to data swizzling,' yet the abstract and Section 2 describe physically neighboring bits and electrical coupling, and Section 4.1's ECDSA arithmetic (Delta = ±3·2^i) and the ECC implications require predictable physical or cell-level adjacency. The paper supplies no evidence that the observed logical adjacency is physical; without that, the physical explanation and the controllability assumptions lose their foundation.","section":"Section 3 vs. Sections 2 and 4"},{"comment":"The ECDSA key recovery attack is theoretical only. The text admits that 'full empirical validation remains future work,' and no experiment demonstrates a Rowhammer-induced adjacent bit flip in an OpenSSL nonce. The claimed predictable nonce allocation (reuse after the first handshake, concentrations near offset 0xd00) is profiling, not an end-to-end fault injection. Consequently, the abstract's framing that these flips 'could enable ECDSA private key recovery' is at best a plausibility argument based on the Albrecht–Heninger BDD-with-predicate results; it is not a demonstrated attack.","section":"Section 4.1"},{"comment":"The LLM tokenizer attack is not empirically demonstrated. Table 2 counts potential token swaps by combining bit-flip offsets from DIMM A3 with offsets in tokenizer dictionary files; no Rowhammer corruption of a running GGUF model is performed, and the illustrative figure showing guardrail bypass uses an uncensored GGUF version, which undercuts the claim of circumventing safety guardrails. The paper also assumes without evidence that bit-flip offsets measured on DIMM A3 occur at the same logical offsets in the model's memory layout. Table 2 also contains an internal inconsistency: the text reports 310k, 78k, and 50k potential swaps for GPT-2, LLaMA, and T5, while the table lists 184k, 50k, and 28k.","section":"Section 4.2, Tables 2-3, Figure 4"}],"minor_comments":[{"comment":"In the paragraph on modern Rowhammer techniques, 'mechansim' should be 'mechanism'.","section":"Section 2"},{"comment":"The sentence 'to simplify the the statistical analysis' contains a duplicated 'the', and the surrounding prose mixes tenses ('we may model ... where we estimate') in a way that should be cleaned up.","section":"Section 3.1"},{"comment":"The G.SKILL module is described as model F4-3200C16D-16GVKB in the text and as F4-3600C16D-16GVKC in Table 4; these model numbers should be reconciled.","section":"Appendix A, Table 4"},{"comment":"Beyond the numeric inconsistency noted above, the table caption should state that these are potential swaps computed from combined offsets, not observed corruptions, and Table 3's 'dry' to 'Try' swap changes capitalization in a way that is not discussed.","section":"Section 4.2, Table 2"},{"comment":"The figure would be much more informative if it showed the distribution of the test statistic and error bars rather than a single average point, and if it stated how many rows and how many total flips contributed to each data point.","section":"Figure 2"},{"comment":"Reference [16] (DRAMScope) is cited for data swizzling, but no specific result or section is indicated; a page or section pointer would help readers verify the claimed implication.","section":"References"}],"recommendation":"reject","confidential_remarks":"I will not repeat the technical points from the report. For the editor: the manuscript overclaims relative to its evidence, most strikingly in the abstract and conclusion. The paper's own Table 1 puts byte-level adjacency at chance rates, and neither attack is demonstrated end to end; the cross-DRAM evidence in Table 5 is also thin, with no adjacent flips on A8 and only a single event on A4 for the non-uniform pattern. If the authors were to reframe the work as a careful empirical characterization of bit-flip locality with proper baselines and statistical tests, and to remove or clearly separate the attack claims, a much shorter and more defensible paper could be viable."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nHere's my read on the Rubber Mallet paper. The headline—that Rowhammer produces adjacent bit flips at 'significantly higher frequency than previously documented'—is not supported by the paper's own numbers. Table 1 compares observed multi-bit adjacency rates to a simple combinatorial model: 25.6% vs 25.0% for 2-bit, 10.6% vs 10.7% for 3-bit, 8.7% vs 7.1% for 4-bit. That is chance-level agreement, not an excess. Figure 1 reports raw counts but gives no baseline, so we don't know whether 3k adjacent pairs out of 174k single flips is surprising. The abstract's physical language ('physically neighboring bits') also conflicts with Section 3's own admission that logical adjacency may not reflect physical adjacency due to data swizzling. That is a real tension, not a nit.\n\nThe paper does have some genuine value. The tokenizer dictionary faulting idea is new—previous bit-flip attacks on LLMs targeted weights or activations, not the token mapping itself. The observation that row-level flips cluster, even if under-analyzed, adds a small dataset to the community. The ECDSA section correctly connects adjacent flips to the Albrecht-Heninger lattice results; the issue isn't the cryptanalysis, it's the missing empirical demonstration. The authors do explicitly say full empirical validation of the ECDSA attack is future work, and the LLM attack is a static search for potential swaps, not a live exploit. Those are honest limitations, and the paper would need to be reframed as an exploratory study rather than a demonstrated attack.\n\nOther soft spots: the token swap counts in the text (310k/78k/50k) don't match Table 2 (184k/50k/28k). Figure 2 has no error bars or significance test, so the clustering claim is suggestive at best. These are fixable issues, but the central frequency claim is load-bearing and it fails. Without that, the entire 'high frequency localized bit flips' narrative collapses to 'Rowhammer sometimes flips adjacent bits,' which has been known (e.g., Half Double).\n\nWho gets value: someone working on Rowhammer or adversarial ML might mine the tokenizer attack idea. The paper reads like an extended abstract with big claims. As it stands, it should not be accepted as a rigorous security paper. But it deserves a serious referee, because the idea is novel and the experimental data, weak as it is, could be turned into something with proper statistical testing and live demonstrations.\n\nRecommendation: send to peer review, but expect major revision or reject in current form. The authors need to either drop the 'significantly higher' claim, provide a baseline, or do the experiments to back it.","headline":"The paper's central claim of significantly higher adjacent bit flip frequency is contradicted by its own Table 1; the tokenizer attack idea is novel but the downstream attacks are only theoretical.","tokens_in":11190,"tokens_out":3361,"would_cite":false,"duration_ms":33994,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"High-frequency adjacent bit flips from Rowhammer enable ECDSA key recovery and LLM guardrail bypass.","keywords":["Rowhammer","adjacent bit flips","DRAM","TRR bypass","ECDSA key recovery","lattice attack","LLM tokenizer","fault injection"],"falsifier":"A concrete observation that would settle the central claim: profile the same DRAM with a known address-to-cell mapping (or after disabling swizzle where possible) and check whether the pairs of bits that flip together at logical positions i and i+1 sit in physically neighboring cells. If the correlated pairs scatter to non-neighboring physical cells, the paper's physical-clustering explanation, and the defense implications built on it, lose their foundation; the logical pattern alone would remain observable but would need a different explanation.","tokens_in":10160,"feed_emoji":"🔓","tokens_out":7064,"duration_ms":67230,"temperature":0.7,"pith_summary":"This paper reports that TRR-bypassing Rowhammer attacks produce closely spaced multi-bit errors, not just isolated flips. Across roughly 100 MB of profiled memory, flips cluster within a row, and two-bit events in a byte land on adjacent positions about a quarter of the time—matching the combinatorial baseline—so the correlation is a real, modelable phenomenon. The paper argues these localized errors change the security calculus in two ways. A two-adjacent-bit flip in an ECDSA nonce changes it by a predictable signed value, and with two leaked nonce bits per signature the bounded-distance-decoding-with-predicate lattice method can recover OpenSSL private keys from a few hundred signatures. A one- or two-bit flip in a GGUF tokenizer dictionary can swap a safety-critical token, such as turning the refusal-related word 'make' into 'lake' in a system prompt, bypassing LLM guardrails without altering weights or inputs. If correct, the central message is that single-bit assumptions are too narrow for evaluating Rowhammer defenses.","feed_headline":"Neighboring bit flips can steal ECDSA keys, break LLM guardrails","feed_subtitle":"Two attacks follow: ECDSA nonce faults reveal signing keys; tokenizer swaps turn 'make' into 'lake'.","key_machinery":"The carrying object is the adjacent two-bit flip and its arithmetic fingerprint. In software, positions i and i+1 flipping together produce a signed delta of ±3·2^i (both bits change from 0 to 1 or 1 to 0), so an attacker who sees the faulty signature can relate the fault to the two original nonce bits. The companion machinery is the bounded-distance decoding with predicate lattice solver, which turns roughly two adjacent leaked bits per signature into a full ECDSA key recovery with a few hundred signatures. For the LLM attack, the machinery is the tokenizer dictionary: a compact, deterministically addressed table in the GGUF file whose ASCII strings differ by single bits (e.g., 'l' vs 'm'), so a flip rewrites token meaning. The paper also supplies a combinatorial null model—the probability that k flips in an 8-bit byte are adjacent is (n-k+1)/C(n,k)—to show multi-bit events are well described by chance within a byte while row-level clustering deviates from random.","core_discovery":"This paper argues that advanced Rowhammer hammering—specifically the many-sided and frequency-based patterns that defeat target-row refresh—does not produce isolated random bit errors. It produces localized clusters: flips are likelier near other flips within a row, and when two or more bits in a byte flip, a non-negligible fraction appear at adjacent bit positions (about 25% for two-bit events in a byte, close to the combinatorial expectation). The paper claims these patterns are common enough, after profiling only about 100 MB of memory, to power two attacks: corrupting the ECDSA nonce so that a two-bit error changes it by ±3·2^i, letting the bounded-distance-decoding-with-predicate lattice method recover the private key from a few hundred signatures; and swapping tokens in the loaded tokenizer dictionary of a GGUF model so that safety-critical words like 'make' become 'lake', silently removing guardrails. The ECDSA result is argued theoretically, with empirical validation left to future work; the tokenizer attack is demonstrated against real tokenizer dictionaries.","pith_inferences":["The logical-adjacency caveat cuts both ways: even if data swizzling breaks physical correspondence, the software-visible delta = ±3·2^i pattern is what the ECDSA lattice attack consumes, so the cryptographic exploit would survive a refutation of the physical-clustering story.","A direct test of the physical mechanism would be to repeat the profiling on a DIMM whose physical-to-logical bit mapping is known, and check whether logical neighbors are physical neighbors in the flipped pairs.","The tokenizer swap attack generalizes beyond safety words: any fixed, addressable table that maps bit patterns to semantic outputs (embedding rows, label maps, configuration files) is a candidate target for the same minimal-flip strategy.","Because the paper's ECDSA demonstration is theoretical, the decisive extension is a full fault-injection experiment that drives real OpenSSL nonces to adjacent flips and runs the lattice recovery end to end."],"forward_implications":["ECDSA deployments that reuse a fixed nonce memory location across handshakes are exposed: with roughly two adjacent nonce bits leaked per signature, the bounded-distance decoding with predicate method recovers 256-bit keys from under 200 signatures.","LLM serving stacks that keep tokenizer dictionaries at static loaded addresses inherit a guardrail-bypass path: one or two bit flips can swap a safety-critical prompt word, so system-prompt refusals silently disappear while ordinary behavior is unchanged.","Since row-level flips cluster, attackers can profile a DIMM once and concentrate hammering on known weak regions, making multi-bit localized corruption cheaper than random bit-flip attacks.","Multi-bit adjacent patterns imply that single-error-correcting ECC, which silently fixes isolated flips, is not a complete defense against TRR-bypassing Rowhammer patterns.","Token-swap counting across three tested tokenizers yields tens of thousands of candidate one-flip swaps, so the LLM attack surface is broad even before adjacent flips are considered."],"supporting_citations":[{"why":"Supplies the many-sided hammering method that produces the bit-flip profiles used in the adjacency and clustering analysis.","marker":"[1]"},{"why":"Supplies the frequency-based hammering method used for the main 100 MB profiling and the token-swap search.","marker":"[2]"},{"why":"Provides the bounded-distance decoding with predicate lattice technique that makes 2-bit nonce leakage enough for ECDSA key recovery.","marker":"[17]"},{"why":"Documents data swizzling, the hardware behavior the paper acknowledges may break logical-versus-physical adjacency.","marker":"[16]"},{"why":"Demonstrates that a small number of targeted bit flips can jailbreak commercial-scale LLMs, the baseline the tokenizer-dictionary attack extends.","marker":"[14]"},{"why":"Shows how on-die ECC in LPDDR4 hides single-bit errors, the contrast case for studying multi-bit flips in unprotected DDR4.","marker":"[13]"}],"fun_headline_variants":["Adjacent Rowhammer flips enable ECDSA key theft and LLM jailbreaks","Clustered bit flips: new Rowhammer attacks on crypto and LLMs","Rowhammer's neighborly flips crack ECDSA and rewrite LLM guardrails","Localized bit flips turn into ECDSA key recovery and token swaps","Bit flips cluster: Rowhammer attacks steal keys and break LLM safety"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The results treat bit positions that appear adjacent in software as physically adjacent memory cells, even though the paper notes that DRAM data swizzling can scramble that mapping; if the correlation is only in the logical layout, the physical explanation and the defense analysis do not follow.","fun_headline_variants_meta":{"raw":{"variants":["Adjacent Rowhammer flips enable ECDSA key theft and LLM jailbreaks","Clustered bit flips: new Rowhammer attacks on crypto and LLMs","Rowhammer's neighborly flips crack ECDSA and rewrite LLM guardrails","Localized bit flips turn into ECDSA key recovery and token swaps","Bit flips cluster: Rowhammer attacks steal keys and break LLM safety"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000702,"raw_usage":{"total_tokens":3217,"prompt_tokens":1040,"completion_tokens":2177,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":656,"completion_tokens_details":{"reasoning_tokens":2071}},"tokens_in":656,"tokens_out":2177,"duration_ms":14325,"temperature":1.0,"reasoning_tokens":2071,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T04:17:12.608037+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A concrete observation that would settle the central claim: profile the same DRAM with a known address-to-cell mapping (or after disabling swizzle where possible) and check whether the pairs of bits that flip together at logical positions i and i+1 sit in physically neighboring cells. If the correlated pairs scatter to non-neighboring physical cells, the paper's physical-clustering explanation, and the defense implications built on it, lose their foundation; the logical pattern alone would remain observable but would need a different explanation.","supporting_citations":[{"cited_title":"TRRespass: Exploiting the many sides of target row refresh,","cited_arxiv_id":null,"evidence_quote":"Supplies the many-sided hammering method that produces the bit-flip profiles used in the adjacency and clustering analysis."},{"cited_title":"Blacksmith: Scalable rowhammering in the frequency domain,","cited_arxiv_id":null,"evidence_quote":"Supplies the frequency-based hammering method used for the main 100 MB profiling and the token-swap search."},{"cited_title":"On bounded distance decoding with predicate: Breaking the “lattice barrier","cited_arxiv_id":null,"evidence_quote":"Provides the bounded-distance decoding with predicate lattice technique that makes 2-bit nonce leakage enough for ECDSA key recovery."},{"cited_title":"Dramscope: Uncovering dram microarchitecture and characteristics by issuing memory commands,","cited_arxiv_id":null,"evidence_quote":"Documents data swizzling, the hardware behavior the paper acknowledges may break logical-versus-physical adjacency."},{"cited_title":"Half-double: Hammering from the next row over,","cited_arxiv_id":null,"evidence_quote":"Shows how on-die ECC in LPDDR4 hides single-bit errors, the contrast case for studying multi-bit flips in unprotected DDR4."}],"review_version":1}