Pith. sign in

REVIEW 4 major objections 6 minor 75 references

ShadowScope: GPU Monitoring and Validation via Composable Side Channel Signals

T0 review · 4 major / 6 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that GPU kernel integrity can be defended by turning side-channel signals—normally a leakage risk—into a composable golden-model validation system.

desk verdict A credible composable-golden-model idea on real GPUs, but the threat model stops short of an adaptive attacker; worth refereeing with major revisions. read the letter →

arxiv 2509.00300 v2 pith:WMYEDO5F submitted 2025-08-30 cs.CR

Ghadeer Almusaddar , Yicheng Zhang , Saber Ganjisaffar , Barry Williams , Yu David Liu , Dmitry Ponomarev , Nael Abu-Ghazaleh This is my paper · ORCID
classification cs.CR
keywords GPUsecuritykernelintegrityside-channelsignalsgoldenmodelvalidationperformancecountershardwaremonitoringrowhammerdetectionDNNattacks
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that the same side-channel signals that leak GPU secrets can be turned into a defense: a GPU kernel's runtime behavior leaves traces in performance-counter events, and those traces can be compared against a trusted reference to catch tampering. Because a single monolithic reference is too brittle for noisy, parallel GPU execution, the paper proposes a composable golden model that splits execution into modular segments, each validated independently against its own reference. The authors show, on commercial GPUs, that this scheme detects buffer-overflow control-flow hijacking, DNN layer-skipping 'mind control' attacks, rowhammer, and DRAM slowdown/DoS attacks with up to 100% true positive rates and low false positives. They then design a small hardware extension that moves monitoring on-chip and report an average runtime overhead of 4.6%, arguing this makes side-channel-based validation practical enough to deploy.

What carries the argument

The composable golden reference model. Rather than compare one long, noisy trace against a single reference, execution is segmented by composable functions inserted at kernel boundaries—small atomic compare-and-swap kernels that emit detectable spikes in the global_atom_cas counter and can carry kernel and input metadata. The verifier uses these markers to align each segment with the right reference trace and validates segments independently; a match requires cross-correlation above 0.8 and tolerates up to three consecutive mismatches before flagging. ShadowScope+ replaces software sampling with per-SM event counters and an on-chip validator that aggregates samples by timestamp and compares

What would settle it

Build an attack that skips a DNN layer or redirects control flow while padding the payload to execute the same mix of instructions, global loads and stores, and atomic markers as the benign kernel, then run ShadowScope's validation; if the padded trace stays above the 0.8 correlation threshold across four consecutive windows, the central claim is refuted.

Watch

Extended reading notes

Core claim

The central claim is that side-channel observability can be systematically repurposed into a practical defense for GPU kernel integrity. Instead of building one monolithic golden model of a whole application, ShadowScope decomposes trusted execution into modular, repeatable segments demarcated by lightweight atomic-marker functions; each segment is validated independently against reference traces, and a kernel is flagged only when several consecutive segments fail correlation. In software form on commercial GPUs, this catches four representative attack classes with up to 100% true positive rates. The companion hardware design, ShadowScope+, moves validation into the GPU by adding per-SM even

Load-bearing premise

The defense assumes any real attack changes the selected performance-counter traces enough to push cross-correlation below 0.8 for at least four consecutive validation windows, and that an attacker cannot craft a payload that preserves the benign event signature.

Editorial extensions

If this is right

  • Validation becomes localizable: because each kernel or layer segment is checked against its own reference, a detected attack can be pinned to the specific compromised segment rather than just flagged at the application level.
  • Segmentation plus marker-based alignment absorbs scheduling noise and concurrent-workload interference, so golden models can be reused across input sizes and configurations instead of being rebuilt per run.
  • Moving validation on-chip removes the sampling-rate, event-grouping, and profiling-overhead bottlenecks of software profiling, which is why fast kernels that produce few samples become detectable in the hardware instantiation.
  • The measured 4.6% average overhead and sub-percent area and power costs position hardware-assisted side-channel validation as a practical, low-cost defense layer for GPU acceleration.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The marker mechanism itself could become an attack surface: if an attacker can forge, suppress, or mimic the atomic-marker functions, the verifier's segmentation and golden-model selection are compromised—an issue the paper's trusted-PMU assumption leaves open.
  • An evasion class the paper does not analyze is a payload that preserves the benign event signature by running the same instruction mix, memory operations, and atomics as the skipped or redirected code; a natural next test is whether such padded payloads stay above the 0.8 correlation threshold across four consecutive windows.
  • Because validation uses fixed thresholds (0.8 correlation, four consecutive rejections), detection latency and false-alarm tolerance are tunable parameters; future work could derive these thresholds automatically from distributions of benign and attack traces rather than hand-tuning them.
  • The same composable-marker idea could transfer to other accelerators with periodic, kernel-like execution units, where per-unit performance-counter signals are available, extending the defense beyond GPU-specific attacks.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes ShadowScope, a GPU kernel-integrity validation framework that repurposes side-channel signals (PMU event counts) into a composable golden model. The key idea is to instrument trusted kernels with lightweight marker functions at kernel boundaries so that traces can be segmented and validated independently, reducing noise and alignment problems. The software implementation is evaluated on NVIDIA Tesla V100 and RTX 4060 against four attacks: buffer overflow, mind-control, Rowhammer, and DoS/RFM slowdown, reporting high TPR and low FPR. A hardware extension, ShadowScope+, adds per-SM PMUs and an on-chip validator, evaluated in GPGPU-Sim on a 15-SM Fermi-like configuration, with a claimed 4.6% overhead and small area/power cost. The central claim is that side-channel observability can be systematically repurposed into a practical defense for GPU kernel integrity.

Significance. If the claims are established, the composable-golden-model approach would be a useful step toward practical GPU kernel validation: it addresses real problems of trace misalignment and workload variability, and the hardware design is plausibly lightweight. The paper's strengths include real-NVIDIA experiments against four representative attacks, a concrete segmentation mechanism, and a hardware proposal with area/power estimates. However, the current evidence does not yet support the 'practical defense' framing, because the decision rules are hand-tuned and evaluated in-sample, the adversarial model does not include an attacker who adapts to the detector, and the hardware evaluation reports similarity scores rather than detection accuracy. The paper is a reasonable systems/security contribution, but the load-bearing claims need additional validation.

major comments (4)
  1. [§3.6 and §4.3] The detection thresholds are hand-tuned constants and all accuracy numbers are in-sample. The 0.8 cross-correlation threshold and the four-consecutive-rejection rule are stated without derivation, cross-validation, or confidence intervals. The golden and 'normal' datasets are collected from the same benign distribution (100 traces each), so the reported TPR/FPR are calibration-set measurements, not out-of-sample estimates. This matters because the central 'practical defense' claim depends on the decision rule's generality across workloads and conditions.
  2. [§3.1, §3.3, §3.6] The threat model grants the attacker arbitrary kernel control flow, but the evaluation considers only non-adaptive attacks with large, sustained PMU footprints. An attacker with this capability can pad malicious code with the same instruction mix as the expected kernel to keep cross-correlation above 0.8, confine malicious activity to fewer than four contiguous sampling windows, or emit fake global_atom_cas operations (the marker event in Listing 1) to forge segment boundaries. None of these evasions is analyzed. Since the abstract claims a practical defense, the absence of an adaptive-adversary analysis is load-bearing.
  3. [§5.4.1 and Table 4] The ShadowScope+ 'high validation accuracy' is not actually measured. Table 4 reports normalized DTW similarity scores between benign and attack traces for four benchmarks, but there is no benign-vs-benign baseline, no pre-specified decision threshold, no TPR/FPR, and no number of traces; the statement that a score 'typically below 0.1 suggests low similarity' is an observation, not an evaluation rule. The simulator is also a 15-SM Fermi-like configuration (Table 3), so the hardware results do not yet support claims about modern GPUs.
  4. [§4.4] The noise-robustness experiment reports normalized DTW similarity only, not TPR/FPR under interference. Figure 10 shows similarity dropping to 0.8970 under VecAdd noise, but the paper does not map this value to the 0.8 cross-correlation threshold or to the four-rejection rule. It is therefore unclear whether the system's false-positive rate remains low under the stated interference, and the claim that the method is 'robust to noise' is not supported by detection metrics.
minor comments (6)
  1. [§1 and Abstract] The claim of the 'first defense framework that leverages GPU side-channel signals to validate execution' is too strong given prior attestation work using side channels (e.g., EMMA [62], EDDIE [44]) and GPU attestation (SAGE [20]). The novelty should be framed around composability and GPU-specific challenges rather than firstness.
  2. [§4.3.1] The abstract says 'low false positive rates' but Attack 1 averages 9% FPR, with sortingNetworks at 25%. The conditions under which FPR becomes high (low PMU sampling rate) should be stated in the abstract or conclusions to avoid overgeneralization.
  3. [§3.6] The 'correlation coefficient' is not formally defined. State whether it is Pearson correlation, normalized cross-correlation, or another metric, and give the formula used for traces of unequal length.
  4. [Listing 1, §3.3] The composable function's atomicCAS pattern is not a correct atomic increment under concurrency ('old_val = atomicCounter; new_val = old_val+1; atomicCAS(...)'). If the intent is just a marker, clarify the semantics or use atomicAdd; otherwise the marker itself may behave nondeterministically.
  5. [Table 4] For vecAdd the standard deviation is reported as 0 because it 'contains only a single executed kernel.' This does not explain why the score is constant across repeated traces; clarify how many runs were used and what the standard deviation is computed over.
  6. [§5.4.1 and §5.4.3] No artifact or detailed simulation scripts are provided, and the simulator implementation of the hardware PMU/validator and of the two attacks is not described. Providing code or pseudocode would significantly improve reproducibility.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the golden-model comparison is an empirical detection system, not a derivation that reduces to its own inputs.

full rationale

ShadowScope's central mechanism is empirical: it records PMU event traces during trusted execution to build a golden model, then compares untested-kernel traces against that model using cross-correlation or DTW with hand-set thresholds. The reported TPR/FPR values are measurements on labeled benign and attack traces, not predictions derived from the model by construction. The composable markers are instrumentation inserted into the kernel; detecting their absence in a skipped-layer attack is the intended detection mechanism, not a hidden equivalence between the model and the result. The detection thresholds (0.8 correlation, four consecutive rejections, DTW < 0.1) are heuristic and are not cross-validated, which is an evaluation weakness, but the paper does not claim they are derived from first principles or that the thresholds are fitted parameters later renamed as predictions. Self-citations appear (e.g., [39,40,43,71,72]) but only to motivate threat models and attack implementations; the defense's effectiveness is evaluated with new experiments against those attacks, and no load-bearing uniqueness theorem or ansatz is imported from same-author prior work. The paper also explicitly acknowledges limitations such as low sampling rates increasing false positives, so the results are not presented as forced. Overall, no circular derivation chain is exhibited; the main risk is evasion robustness, which is an attack-effectiveness limitation rather than circularity.

Assumptions & free parameters 4 free parameters · 6 assumptions · 2 invented entities

The framework rests on several untested assumptions: that PMU counters are stable and discriminating, that golden models transfer across runs, that the attacker cannot disrupt marker generation, and that meaningful attacks always change the selected event counts. These are domain assumptions, not derived facts. The hand-tuned thresholds are free parameters that directly drive the reported detection accuracy.

free parameters (4)
  • cross-correlation match threshold = 0.8
    Section 3.6: 'a signal segment is considered matched if the correlation coefficient exceeds 0.8'. The value is chosen without theoretical justification or sensitivity analysis; reported detection rates depend on it.
  • consecutive rejection threshold = 4
    Section 3.6: 'flags a kernel as compromised only when four or more rejections occur in succession'. Hand-picked to reduce false alarms; no robustness analysis is provided.
  • Validator comparison threshold (ShadowScope+) = pre-defined, tuned
    Section 5.1.2: threshold 'tuned according to the sensitivity and semantics of the selected metrics'; the exact value is not specified, leaving the detection rule under-specified.
  • DTW similarity threshold = 0.1 (descriptive)
    Section 5.4.1 states 'typically, a score below 0.1 suggests low similarity'; this is a descriptive guideline rather than a formal detection threshold.
assumptions (6)
  • domain assumption GPU PMU event counts are a faithful and repeatable signature of kernel behavior
    Central to golden model validation; asserted in Sections 3.4 and 3.5 with no noise model beyond correlation thresholds.
  • domain assumption A trusted golden model can be collected offline and remains valid at runtime despite driver, scheduler, and concurrency variation
    Section 3.5 states golden models 'only need to be constructed once based on trusted execution behavior'.
  • domain assumption The attacker cannot alter the marker functions or the PMU data collection
    Threat model in Section 3.1: 'the GPU's performance monitoring unit is trusted and that all commands and data related to the PMU are protected from tampering.'
  • domain assumption Composable marker functions produce distinguishable boundaries without materially altering kernel behavior
    Section 3.3 relies on atomic compare-and-swap operations being rare in common GPU benchmark kernels.
  • domain assumption Attacks produce statistically significant deviations in the selected PMU events
    The four evaluated attacks change instruction flow or memory behavior; the paper does not consider attacks designed to preserve event counts.
  • domain assumption Cycle-accurate simulation (GPGPU-Sim) faithfully models PMU event behavior for the hardware evaluation
    Section 5.3; all ShadowScope+ results are obtained from simulation, not real silicon.
invented entities (2)
  • ShadowScope+ Validator module
    purpose: Aggregates per-SM PMU samples and compares against golden model metrics to flag kernel anomalies
    Only evaluated in cycle-accurate simulation (GPGPU-Sim) and silicon synthesis estimates; no physical implementation or public artifacts are provided.
  • Per-SM local PMU with configurable multiplexers and counters
    purpose: Provides fine-grained, high-rate event counting per SM for validation
    Design proposal; existing NVIDIA SMs do not expose this exact configurable counter set at the described rate, and the design is only simulated.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ShadowScope: GPU Monitoring and Validation via Composable Side Channel Signals." pith.science (2026). https://pith.science/paper/WMYEDO5F

@misc{pith2026250900300,
  author       = {Pith},
  title        = {Pith review of: ShadowScope: GPU Monitoring and Validation via Composable Side Channel Signals},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WMYEDO5F}},
  note         = {Machine review of arXiv:2509.00300}
}
read the original abstract

As modern systems increasingly rely on GPUs for computationally intensive tasks such as machine learning acceleration, ensuring the integrity of GPU computation has become critically important. Recent studies have shown that GPU kernels are vulnerable to both traditional memory safety issues (e.g., buffer overflow attacks) and emerging microarchitectural threats (e.g., Rowhammer attacks), many of which manifest as anomalous execution behaviors observable through side-channel signals. However, existing golden model based validation approaches that rely on such signals are fragile, highly sensitive to interference, and do not scale well across GPU workloads with diverse scheduling behaviors. To address these challenges, we propose ShadowScope, a monitoring and validation framework that leverages a composable golden model. Instead of building a single monolithic reference, ShadowScope decomposes trusted kernel execution into modular, repeatable functions that encode key behavioral features. This composable design captures execution patterns at finer granularity, enabling robust validation that is resilient to noise, workload variation, and interference across GPU workloads. To further reduce reliance on noisy software-only monitoring, we introduce ShadowScope+, a hardware-assisted validation mechanism that integrates lightweight on-chip checks into the GPU pipeline. ShadowScope+ achieves high validation accuracy with an average runtime overhead of just 4.6%, while incurring minimal hardware and design complexity. Together, these contributions demonstrate that side-channel observability can be systematically repurposed into a practical defense for GPU kernel integrity.

Figures

Figures reproduced from arXiv: 2509.00300 by the authors.

Figure 1
Figure 1. overviews the idea of composable golden models, the validation component of ShadowScope which involves four key components: untested kernels instrumented with com￾posable functions 𝑓 , a side-channel data collector through PMU, a set of pre-generated golden reference traces of ker￾nels, and a validator. We use composable functions to enhance the communica￾tion of side-channel information to the validator, supporting… view at source ↗
Figure 3
Figure 3. PMU data collection process using CUPTI API. 3.5 Golden Reference Model of GPU Kernels The golden model is a conventional verification technique widely used throughout hardware development life cycles [16, 22, 37]. It verifies whether an IC design satisfies the required specifications. If the design fails to meet these specifications, it must be revised and re-verified until it passes all verifi￾cation tests. In thi… view at source ↗
Figure 2
Figure 2. Splitting side-channel traces (AlexNet) based on global_atom_cas readings. Each split segment represents a single kernel/layer. 3.4 Side-channel Data Collector Design of data collector on NVIDIA GPUs. We use the CUPTI API to collect data from performance counters in NVIDIA GPUs [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: presents the performance of ShadowScope in iden￾tifying buffer overflow attacks across selected benchmarks from the CUDA SDK and GraphBig suites. As shown, Shad￾owScope consistently achieves high TPR, with 3 out of 7 benchmarks reaching 100%, and the lowest still maint…
Figure 7
Figure 7. Figure 7: shows the detection performance of ShadowS￾cope across four representative DNN architectures: CifarNet, AlexNet, SqueezeNet, and ResNet-50. ShadowScope achieves perfect detection (100% TPR) on both AlexNet and SqueezeNet, with zero or near-zero false positives (less th…
Figure 8
Figure 8. Figure 8: Performance of ShadowScope in monitoring rowhammer attacks. 4.3.3 Evaluation of Rowhammer Attack (Attack 3). In this attack, we demonstrate how ShadowScope can detect abnormal memory behavior, such as Rowhammer attacks, within the GPU’s GDDR memory. To monitor memory a…
Figure 6
Figure 6. Figure 6: Side-channel signal of CifarNet under attack. The second kernel is skipped [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 9
Figure 9. Figure 9: Performance of ShadowScope in monitoring DoS/Slow-down attacks. monitor low-level memory access behavior. Recent denial-of￾service (DoS) or slowdown attacks [43, 63] on DDR memory exploit spoofed RFM to block access to DRAM banks. This behavior can severely degrade the…
Figure 11
Figure 11. Figure 11: ShadowScope+ high-level architecture. privileged software components or driver-level modifica￾tions, thereby reducing the trusted computing base and eas￾ing deployment. 5.1 ShadowScope+ Design We equip each SM with a local PMU capable of independently collecting perfo…
Figure 12
Figure 12. Figure 12: An overview of the ShadowScope+ mechanism for in-GPU kernel validation. activates its local PMU, which begins collecting microarchi￾tectural performance events specific to the executing kernel. During execution, each local PMU accumulates event sam￾ples and transmits …
Figure 13
Figure 13. Figure 13: Performance normalized to baseline GPU. 5.4.3 Hardware Complexity Evaluation. For our hard￾ware cost evaluation, each PMU is modeled with eight 32-bit counter registers and eight 8-to-1 multiplexers to monitor different microarchitectural events per counter. A 32-bit …

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

75 extracted references · 66 canonical work pages

  1. [1]

    Aamodt, Wilson Wai Lun Fung, and Timothy G

    Tor M. Aamodt, Wilson Wai Lun Fung, and Timothy G. Rogers. General-purpose graphics processor architectures, 2018

    work page 2018

  2. [2]

    Evax: Towards a practical, pro-active & adaptive architecture for high performance & security

    Samira Mirbagher Ajorpaz, Daniel Moghimi, Jeffrey Neal Collins, Gilles Pokam, Nael Abu-Ghazaleh, and Dean Tullsen. Evax: Towards a practical, pro-active & adaptive architecture for high performance & security. In 2022 55th IEEE/ACM International Symposium on Mi- croarchitecture (MICRO), pages 1218–1236. IEEE, 2022

    work page 2022

  3. [3]

    What is a GPU? https://aws.amazon.com/what-is/gpu/

    Amazon. What is a GPU? https://aws.amazon.com/what-is/gpu/. Last accessed on: 07/31/2024

    work page 2024

  4. [4]

    AMD Secure Encrypted Virtualization (SEV)

    AMD. AMD Secure Encrypted Virtualization (SEV). https://www.amd.com/en/developer/sev.html. Last accessed on: 05/25/2025

    work page 2025

  5. [5]

    GPUPerfAPI

    AMD. GPUPerfAPI. https://gpuopen.com/gpuperfapi/. Last accessed on: 07/27/2024

    work page 2024

  6. [6]

    Arm Confidential Compute Architecture

    arm. Arm Confidential Compute Architecture. https://www.arm.com/architecture/security-features/arm- confidential-compute-architecture. Last accessed on: 05/25/2025

    work page 2025

  7. [7]

    GPU architecture: Revisiting the SIMT execution model

    Caroline Collange. GPU architecture: Revisiting the SIMT execution model. http://www.irisa.fr/alf/downloads/collange/cours/hpca2020_gpu_0.pdf. Last accessed on: 07/31/2024

    work page 2024

  8. [8]

    Lapd: Lifecycle-aware power-based malware detection

    Alexander Cathis, Mulong Luo, Mohit Tiwari, and Andreas Gerstlauer. Lapd: Lifecycle-aware power-based malware detection. IEEE Interna- tional Symposium on Hardware Oriented Security and Trust (HOST) , 2025

    work page 2025

Show all 75 references
  1. [9]

    Sheaffer, Sang-Ha Lee, and Kevin Skadron

    Shuai Che, Michael Boyer, Jiayuan Meng, David Tarjan, Jeremy W. Sheaffer, Sang-Ha Lee, and Kevin Skadron. Rodinia: A benchmark suite for heterogeneous computing. In 2009 IEEE International Symposium on Workload Characterization (IISWC) , pages 44–54, 2009. doi:10. 1109/IISWC.2...

    2009

  2. [10]

    On the fea- sibility of online malware detection with performance counters

    John Demme, Matthew Maycock, Jared Schmitz, Adrian Tang, Adam Waksman, Simha Sethumadhavan, and Salvatore Stolfo. On the fea- sibility of online malware detection with performance counters. In Proceedings of the 40th Annual International Symposium on Computer Architecture, ISC...

    2013

  3. [11]

    A study of overflow vulnerabil- ities on gpus

    Bang Di, Jianhua Sun, and Hao Chen. A study of overflow vulnerabil- ities on gpus. In Network and Parallel Computing: 13th IFIP WG 10.3 International Conference, NPC 2016, Xi’an, China, October 28-29, 2016, Proceedings, page 103–115, Berlin, Heidelberg, 2016. Springer-Verlag. ...

    2016 doi

  4. [12]

    Openmm 7: Rapid development of high performance algorithms for molecular dynamics

    Peter Eastman, Jason Swails, John D Chodera, Robert T McGibbon, Yutong Zhao, Kyle A Beauchamp, Lee-Ping Wang, Andrew C Sim- monett, Matthew P Harrigan, Chaya D Stern, et al. Openmm 7: Rapid development of high performance algorithms for molecular dynamics. PLoS computational b...

    2017

  5. [13]

    Greathouse

    Christopher Erb, Mike Collins, and Joseph L. Greathouse. Dynamic buffer overflow detection for GPGPUs. In2017 IEEE/ACM International Symposium on Code Generation and Optimization (CGO) , pages 61–73,

  6. [14]

    Grand pwning unit: Accelerating microarchitectural attacks with the gpu

    Pietro Frigo, Cristiano Giuffrida, Herbert Bos, and Kaveh Razavi. Grand pwning unit: Accelerating microarchitectural attacks with the gpu. In 2018 ieee symposium on security and privacy (sp), pages 195–210. IEEE, 2018

    2018

  7. [15]

    GPU Memory Exploitation for Fun and Profit

    Yanan Guo, Zhenkai Zhang, and Jun Yang. GPU Memory Exploitation for Fun and Profit. In 33rd USENIX Security Symposium (USENIX Security 24), pages 4033–4050, 2024. 13 Ghadeer Almusaddar, Yicheng Zhang, Saber Ganjisaffar, Barry Williams, Yu David Liu, Dmitry Ponomarev, and Nael ...

    2024

  8. [16]

    Model of the product development lifecycle

    Sunny L He, Natalie H Roe, Evan Wood, Noel M Nachtigal, and Jovana Helms. Model of the product development lifecycle. Technical report, Sandia National Lab.(SNL-NM), Albuquerque, NM (United States), 2015

    2015

  9. [17]

    High-sensitivity hardware trojan detection using mul- timodal characterization

    Kangqiao Hu, Abdullah Nazma Nowroz, Sherief Reda, and Farinaz Koushanfar. High-sensitivity hardware trojan detection using mul- timodal characterization. In 2013 Design, Automation & Test in Eu- rope Conference & Exhibition (DATE) , pages 1271–1276, 2013. doi: 10.7873/DATE.2013.263

    2013 doi

  10. [18]

    Deepsniffer: A dnn model extraction framework based on learning architectural hints

    Xing Hu, Ling Liang, Shuangchen Li, Lei Deng, Pengfei Zuo, Yu Ji, Xin- feng Xie, Yufei Ding, Chang Liu, Timothy Sherwood, et al. Deepsniffer: A dnn model extraction framework based on learning architectural hints. In Proceedings of the Twenty-Fifth International Conference on ...

    2020

  11. [19]

    Intel ® Trust Domain Extensions

    intel. Intel ® Trust Domain Extensions. https://www.intel.com/content/www/us/en/developer/tools/trust- domain-extensions/overview.html. Last accessed on: 05/25/2025

    2025

  12. [20]

    In 2023 USENIX Annual Technical Conference (USENIX ATC 23), pages 485–499, 2023

    Andrei Ivanov, Benjamin Rothenberger, Arnaud Dethise, Marco Canini, Torsten Hoefler, and Adrian Perrig.{SAGE}: Software-based attestation for{GPU} execution. In 2023 USENIX Annual Technical Conference (USENIX ATC 23), pages 485–499, 2023

    2023

  13. [21]

    Heterogeneous isolated execution for commodity gpus

    Insu Jang, Adrian Tang, Taehoon Kim, Simha Sethumadhavan, and Jaehyuk Huh. Heterogeneous isolated execution for commodity gpus. In Proceedings of the Twenty-Fourth International Conference on Archi- tectural Support for Programming Languages and Operating Systems , ASPLOS ’19,...

    2019

  14. [22]

    {TheHuzz}: Instruction fuzzing of processors using {Golden- Reference} models for finding {Software-Exploitable} vulnerabili- ties

    Rahul Kande, Addison Crump, Garrett Persyn, Patrick Jauernig, Ahmad-Reza Sadeghi, Aakash Tyagi, and Jeyavijayan Rajendran. {TheHuzz}: Instruction fuzzing of processors using {Golden- Reference} models for finding {Software-Exploitable} vulnerabili- ties. In 31st USENIX Securit...

    2022

  15. [23]

    Accelwattch: A power modeling framework for modern gpus

    Vijay Kandiah, Scott Peverelle, Mahmoud Khairy, Junrui Pan, Amogh Manjunath, Timothy G Rogers, Tor M Aamodt, and Nikos Hardav- ellas. Accelwattch: A power modeling framework for modern gpus. In MICRO-54: 54th Annual IEEE/ACM International symposium on mi- croarchitecture, page...

    2021

  16. [24]

    Accel-sim: An extensible simulation framework for validated gpu modeling

    Mahmoud Khairy, Zhesheng Shen, Tor M Aamodt, and Timothy G Rogers. Accel-sim: An extensible simulation framework for validated gpu modeling. In 2020 ACM/IEEE 47th Annual International Symposium on Computer Architecture (ISCA), pages 473–486. IEEE, 2020

    2020

  17. [25]

    Khasawneh, Nael Abu-Ghazaleh, Dmitry Ponomarev, and Lei Yu

    Khaled N. Khasawneh, Nael Abu-Ghazaleh, Dmitry Ponomarev, and Lei Yu. Rhmd: Evasion-resilient hardware malware detectors. In 2017 50th Annual IEEE/ACM International Symposium on Microarchitecture (MICRO), pages 315–327, 2017

    2017

  18. [26]

    Rebel and tdc: Two embedded test structures for on-chip measurements of within-die path delay variations

    Charles Lamech, James Aarestad, Jim Plusquellic, Reza Rad, and Kanak Agarwal. Rebel and tdc: Two embedded test structures for on-chip measurements of within-die path delay variations. In 2011 IEEE/ACM International Conference on Computer-Aided Design (ICCAD) , pages 170–177, 2...

    2011

  19. [27]

    Securing gpu via region-based bounds checking

    Jaewon Lee, Yonghae Kim, Jiashen Cao, Euna Kim, Jaekyu Lee, and Hyesoon Kim. Securing gpu via region-based bounds checking. In Proceedings of the 49th Annual International Symposium on Computer Architecture, pages 27–41, 2022

    2022

  20. [28]

    Ask less, get more: Side-channel signal hiding, revisited

    Itamar Levi, Davide Bellizia, David Bol, and François-Xavier Standaert. Ask less, get more: Side-channel signal hiding, revisited. IEEE Trans- actions on Circuits and Systems I: Regular Papers , 67(12):4904–4917, 2020

    2020

  21. [29]

    Detecting spectre attacks using hardware performance counters

    Congmiao Li and Jean-Luc Gaudiot. Detecting spectre attacks using hardware performance counters. IEEE Transactions on Computers , 71(6):1320–1331, 2022. doi:10.1109/TC.2021.3082471

    2022

  22. [30]

    Cacti-p: Architecture-level modeling for sram-based struc- tures with advanced leakage reduction techniques

    Sheng Li, Ke Chen, Jung Ho Ahn, Jay B Brockman, and Norman P Jouppi. Cacti-p: Architecture-level modeling for sram-based struc- tures with advanced leakage reduction techniques. In 2011 IEEE/ACM International Conference on Computer-Aided Design (ICCAD) , pages 694–701. IEEE, 2011

    2011

  23. [31]

    Gpuhammer: Rowhammer attacks on gpu memories are practical

    Chris S Lin, Joyce Qu, and Gururaj Saileshwar. Gpuhammer: Rowhammer attacks on gpu memories are practical. arXiv preprint arXiv:2507.08166, 2025

    2025 arXiv

  24. [32]

    On code execution tracking via power side-channel

    Yannan Liu, Lingxiao Wei, Zhe Zhou, Kehuan Zhang, Wenyuan Xu, and Qiang Xu. On code execution tracking via power side-channel. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pages 1019–1031, 2016

    2016

  25. [33]

    Hardware trojans in wireless cryp- tographic ics: Silicon demonstration & detection method evaluation

    Yu Liu, Yier Jin, and Yiorgos Makris. Hardware trojans in wireless cryp- tographic ics: Silicon demonstration & detection method evaluation. In 2013 IEEE/ACM International Conference on Computer-Aided Design (ICCAD), pages 399–404, 2013. doi:10.1109/ICCAD.2013.6691149

    2013

  26. [34]

    Hardware countermeasures against dpa–a statistical analysis of their effectiveness

    Stefan Mangard. Hardware countermeasures against dpa–a statistical analysis of their effectiveness. In Topics in Cryptology–CT-RSA 2004: The Cryptographers’ Track at the RSA Conference 2004, San Francisco, CA, USA, February 23-27, 2004, Proceedings , pages 222–235. Springer, 2004

  27. [35]

    Meta. Llama. https://llama.meta.com. Last accessed on: 07/31/2024

    2024

  28. [36]

    Buffer overflow vulnerabilities in cuda: a preliminary analysis

    Andrea Miele. Buffer overflow vulnerabilities in cuda: a preliminary analysis. Journal of Computer Virology and Hacking Techniques, 12:113– 120, 2016

    2016

  29. [37]

    Functional verification: Approaches and challenges

    A Molina and Oswaldo Cadenas. Functional verification: Approaches and challenges. Latin American applied research, 37(1):65–69, 2007

    2007

  30. [38]

    Rowhammer: A retrospective

    Onur Mutlu and Jeremie S Kim. Rowhammer: A retrospective. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Sys- tems, 39(8):1555–1571, 2019

    2019

  31. [39]

    Constructing and characterizing covert channels on gpgpus

    Hoda Naghibijouybari, Khaled N Khasawneh, and Nael Abu-Ghazaleh. Constructing and characterizing covert channels on gpgpus. In Pro- ceedings of the 50th annual IEEE/ACM international symposium on microarchitecture, pages 354–366, 2017

    2017

  32. [40]

    Rendered insecure: Gpu side channel attacks are practical

    Hoda Naghibijouybari, Ajaya Neupane, Zhiyun Qian, and Nael Abu- Ghazaleh. Rendered insecure: Gpu side channel attacks are practical. In Proceedings of the 2018 ACM SIGSAC conference on computer and communications security, pages 2139–2153, 2018

    2018

  33. [41]

    Graphbig: understanding graph computing in the context of industrial solutions

    Lifeng Nai, Yinglong Xia, Ilie G Tanase, Hyesoon Kim, and Ching- Yung Lin. Graphbig: understanding graph computing in the context of industrial solutions. In Proceedings of the International Conference for High Performance Computing, Networking, Storage and Analysis , pages 1–12, 2015

    2015

  34. [42]

    Practical: Subarray-level counter update and bank- level recovery isolation for efficient prac rowhammer mitigation.arXiv preprint arXiv:2507.18581, 2025

    Ravan Nazaraliyev, Saber Ganjisaffar, Nurlan Nazaraliyev, and Nael Abu-Ghazaleh. Practical: Subarray-level counter update and bank- level recovery isolation for efficient prac rowhammer mitigation.arXiv preprint arXiv:2507.18581, 2025

    2025 arXiv

  35. [43]

    Not so refreshing: Attacking gpus using rfm rowhammer mitigation

    Ravan Nazaraliyev, Yicheng Zhang, Sankha Baran Dutta, Nael Abu- Ghazaleh, Andres Marquez, and Kevin Barker. Not so refreshing: Attacking gpus using rfm rowhammer mitigation. In 34th USENIX Security Symposium (USENIX Security 25) , 2025

    2025

  36. [44]

    Eddie: Em-based detection of deviations in program execution

    Alireza Nazari, Nader Sehatbakhsh, Monjur Alam, Alenka Zajic, and Milos Prvulovic. Eddie: Em-based detection of deviations in program execution. In Proceedings of the 44th Annual International Symposium on Computer Architecture, pages 333–346, 2017

    2017

  37. [45]

    Confidential Compute on NVIDIA Hopper H100

    NVIDIA. Confidential Compute on NVIDIA Hopper H100. https://images.nvidia.com/aem-dam/en-zz/Solutions/data- center/HCC-Whitepaper-v1.0.pdf. Last accessed on: 05/25/2025

    2025

  38. [46]

    CUDA C++ Programming Guide

    NVIDIA. CUDA C++ Programming Guide. https://docs.nvidia.com/cuda/cuda-c-programming- guide/index.html. Last accessed on: 07/31/2024

    2024

  39. [47]

    NVIDIA. CUPTI. https://docs.nvidia.com/cupti/. Last accessed on: 07/16/2024. 14 ShadowScope: GPU Monitoring and Validation via Composable Side Channel Signals

    2024

  40. [48]

    CUPTI Event API

    NVIDIA. CUPTI Event API. https://docs.nvidia.com/cupti/api/group_ _CUPTI__EVENT__API.html. Last accessed on: 06/04/2025

    2025

  41. [49]

    Parallel Thread Execution

    NVIDIA. Parallel Thread Execution. https://docs.nvidia.com/cuda/ parallel-thread-execution/

  42. [50]

    CUPTI: User Guide

    NVIDIA. CUPTI: User Guide. https://docs.nvidia.com/cuda/archive/11.0_GA/cupti/pdf/Cupti.pdf,

  43. [51]

    NVIDIA CUDA samples

    NVIDIA. NVIDIA CUDA samples. https://github.com/NVIDIA/cuda- samples, 2024

    2024

  44. [52]

    Nsight Visual Studio Edition 4.6 User Guide: Performance Counters

    NVIDIA Corporation. Nsight Visual Studio Edition 4.6 User Guide: Performance Counters. https://docs.nvidia.com/nsight-visual- studio-edition/4.6/Content/Analysis/Report/CudaExperiments/ KernelLevel/PerformanceCounters.htm, 2024. Accessed on 05/29/2025

    2024

  45. [53]

    Introducing ChatGPT

    OpenAI. Introducing ChatGPT. https://openai.com/index/chatgpt/. Last accessed on: 07/31/2024

    2024

  46. [54]

    Hardware-based malware detection using low-level architectural features

    Meltem Ozsoy, Khaled N Khasawneh, Caleb Donovick, Iakov Gore- lik, Nael Abu-Ghazaleh, and Dmitry Ponomarev. Hardware-based malware detection using low-level architectural features. IEEE Trans- actions on Computers, 65(11):3332–3344, 2016

    2016

  47. [55]

    Mind control attack: Undermining deep learn- ing with gpu memory exploitation

    Sang-Ok Park, Ohmin Kwon, Yonggon Kim, Sang Kil Cha, and Hyunsoo Yoon. Mind control attack: Undermining deep learn- ing with gpu memory exploitation. Computers & Security , 102:102115, 2021. URL: https://www.sciencedirect.com/science/article/ pii/S0167404820303886, doi:10.1016...

    2021

  48. [56]

    Dnn model architecture finger- printing attack on cpu-gpu edge devices

    Kartik Patwari, Syed Mahbub Hafiz, Han Wang, Houman Homayoun, Zubair Shafiq, and Chen-Nee Chuah. Dnn model architecture finger- printing attack on cpu-gpu edge devices. In 2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P) , pages 337–355. IEEE, 2022

    2022

  49. [57]

    Sensitivity analysis to hardware trojans using power supply transient signals

    Reza Rad, Jim Plusquellic, and Mohammad Tehranipoor. Sensitivity analysis to hardware trojans using power supply transient signals. In 2008 IEEE International Workshop on Hardware-Oriented Security and Trust, pages 3–7, 2008. doi:10.1109/HST.2008.4559037

    2008

  50. [58]

    Power supply signal calibration techniques for improving detection resolution to hardware trojans

    Reza M Rad, Xiaoxiao Wang, Mohammad Tehranipoor, and Jim Plusquellic. Power supply signal calibration techniques for improving detection resolution to hardware trojans. In 2008 IEEE/ACM Inter- national Conference on Computer-Aided Design , pages 632–639. IEEE, 2008

    2008

  51. [59]

    Cuda, woulda, shoulda: Returning exploits in a sass-y world

    Jonas Roels, Adriaan Jacobs, and Stijn Volckaert. Cuda, woulda, shoulda: Returning exploits in a sass-y world. In Proceedings of the 18th European Workshop on Systems Security , EuroSec’25, page 40–48, New York, NY, USA, 2025. Association for Computing Machinery. doi:10.1145/3...

    2025

  52. [60]

    Top-down performance profiling on nvidia’s GPUs

    Alvaro Saiz, Pablo Prieto, Pablo Abad, Jose Angel Gregorio, and Valentin Puente. Top-down performance profiling on nvidia’s GPUs. In 2022 IEEE international parallel and distributed processing symposium (IPDPS), pages 179–189. IEEE, 2022

    2022

  53. [61]

    Toward accurate dynamic time warp- ing in linear time and space

    Stan Salvador and Philip Chan. Toward accurate dynamic time warp- ing in linear time and space. Intelligent data analysis, 11(5):561–580, 2007

    2007

  54. [62]

    Emma: Hardware/software attestation framework for embedded systems using electromagnetic signals

    Nader Sehatbakhsh, Alireza Nazari, Haider Khan, Alenka Zajic, and Milos Prvulovic. Emma: Hardware/software attestation framework for embedded systems using electromagnetic signals. In Proceedings of the 52nd Annual IEEE/ACM International Symposium on Microarchitecture , pages ...

    2019

  55. [63]

    Roguerfm: Attacking refresh management for covert-channel and denial-of-service

    Hritvik Taneja and Moinuddin Qureshi. Roguerfm: Attacking refresh management for covert-channel and denial-of-service. arXiv preprint arXiv:2501.06646, 2025

    2025 arXiv

  56. [64]

    Graviton: Trusted execution environments on GPUs

    Stavros Volos, Kapil Vaswani, and Rodrigo Bruno. Graviton: Trusted execution environments on GPUs. In 13th USENIX Symposium on Operating Systems Design and Implementation (OSDI 18) , pages 681– 696, Carlsbad, CA, October 2018. USENIX Association. URL: https: //www.usenix.org/c...

    2018

  57. [65]

    Demystifying arch-hints for model extraction: An attack in unified memory system, 2022

    Zhendong Wang, Xiaoming Zeng, Xulong Tang, Danfeng Zhang, Xing Hu, and Yang Hu. Demystifying arch-hints for model extraction: An attack in unified memory system, 2022. URL: https://arxiv.org/abs/ 2208.13720, arXiv:2208.13720

    2022 arXiv

  58. [66]

    Simultaneous multikernel: Fine-grained shar- ing of gpus

    Zhenning Wang, Jun Yang, Rami Melhem, Bruce Childers, Youtao Zhang, and Minyi Guo. Simultaneous multikernel: Fine-grained shar- ing of gpus. IEEE Computer Architecture Letters, 15(2):113–116, 2015

    2015

  59. [67]

    Leaky DNN: Stealing deep-learning model secret with gpu context-switching side-channel

    Junyi Wei, Yicheng Zhang, Zhe Zhou, Zhou Li, and Mohammad Abdul- lah Al Faruque. Leaky DNN: Stealing deep-learning model secret with gpu context-switching side-channel. In 2020 50th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) , pages 125–...

    2020

  60. [68]

    Warped-slicer: Efficient intra-sm slicing through dynamic resource partitioning for gpu multiprogramming

    Qiumin Xu, Hyeran Jeon, Keunsoo Kim, Won Woo Ro, and Murali Annavaram. Warped-slicer: Efficient intra-sm slicing through dynamic resource partitioning for gpu multiprogramming. ACM SIGARCH Computer Architecture News, 44(3):230–242, 2016

    2016

  61. [69]

    In 29th USENIX Security Symposium (USENIX Security 20) , pages 1463–1480, 2020

    Fan Yao, Adnan Siraj Rakin, and Deliang Fan.{DeepHammer}: Deplet- ing the intelligence of deep neural networks through targeted chain of bit flips. In 29th USENIX Security Symposium (USENIX Security 20) , pages 1463–1480, 2020

    2020

  62. [70]

    Defend GPUs against DoS attacks

    Wei Zhang. Defend GPUs against DoS attacks . In 2013 IEEE 32nd International Performance Computing and Communications Conference (IPCCC), pages 1–2, Los Alamitos, CA, USA, December 2013. IEEE Computer Society. URL: https://doi.ieeecomputersociety.org/10.1109/ PCCC.2013.6742758...

    2013

  63. [71]

    Beyond the bridge: Contention-based covert and side channel attacks on multi-gpu in- terconnect

    Yicheng Zhang, Ravan Nazaraliyev, Sankha Baran Dutta, Nael Abu- Ghazaleh, Andres Marquez, and Kevin Barker. Beyond the bridge: Contention-based covert and side channel attacks on multi-gpu in- terconnect. In 2024 International Symposium on Secure and Private Execution Environm...

    2024

  64. [72]

    Nvbleed: Covert and side-channel attacks on nvidia multi-gpu interconnect

    Yicheng Zhang, Ravan Nazaraliyev, Sankha Baran Dutta, Andres Mar- quez, Kevin Barker, and Nael Abu-Ghazaleh. Nvbleed: Covert and side-channel attacks on nvidia multi-gpu interconnect. arXiv preprint arXiv:2503.17847, 2025

    2025 arXiv

  65. [73]

    {Invalidate+ Compare}: A{Timer-Free}{ GPU} cache attack primi- tive

    Zhenkai Zhang, Kunbei Cai, Yanan Guo, Fan Yao, and Xing Gao. {Invalidate+ Compare}: A{Timer-Free}{ GPU} cache attack primi- tive. In 33rd USENIX Security Symposium (USENIX Security 24) , pages 2101–2118, 2024. 15

    2024

  66. [2017]

    doi:10.1109/CGO.2017.7863729

    2017

  67. [2022]

    Last accessed on: 07/18/2024

    2024

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.