Pith. sign in

REVIEW 4 major objections 5 minor 134 references

BOLT: Bandwidth-Optimized Lightning-Fast Oblivious Map powered by Secure HBM Accelerators

T0 review · 4 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read BOLT is the first known oblivious map to achieve O(1)+O(log2 log2 N) bandwidth overhead with constant rounds, by using on-package HBM as an unobservable cache.

desk verdict A genuinely new OMAP design that trades a standard hardware assumption for massive speedups; the proof gaps are real but fixable. read the letter →

arxiv 2509.01742 v2 pith:ZQ2OPZVN submitted 2025-09-01 cs.CR cs.AR

Yitong Guo , Hongbo Chen , Haobin Hiroki Chen , Yukui Luo , XiaoFeng Wang , Chenghong Wang This is my paper · ORCID
classification cs.CRcs.AR
keywords obliviousmapORAMaccesspatternleakagehigh-bandwidthmemorypower-of-two-choicestrustedexecutionenvironmentkey-valuestorehardwareaccelerator
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that the classic O(log^2 N) bandwidth overhead of oblivious maps is not fundamental. BOLT, a new accelerator-based oblivious map design, claims to reduce that overhead to O(1)+O(log2 log2 N) with a constant number of rounds by treating on-package High-Bandwidth Memory as a large unobservable cache. Data is spread across HBM bins and visible host-memory pages; each access reads two random bins, then remaps the key to two new bins using power-of-two-choices load balancing, which keeps the worst-case bin size small. A self-hosted accelerator controls its own memory and I/O, so the host CPU cannot leak traces indirectly. If the unobservability premise holds, BOLT brings oblivious key-value access to within about 2.5x of non-private speed, a dramatic improvement over the 960x-plus slowdowns of prior designs.

What carries the argument

The load-bearing object is a flat bin layout over two memory tiers: HBM bins and host-memory pages, coordinated by an HBM-resident position map and an eviction stash. The mechanism that produces the log-log overhead is power-of-two-choices (P2C) load balancing: after each access the data item is placed in the less loaded of two uniformly random bins, which bounds the maximum bin load by c+O(log2 log2 N). That bound directly sets the page size, the stash size, and ultimately the bandwidth per access. The second essential mechanism is the assumption of unobservable HBM: because the position map, stash, counts, and reverse index live inside the sealed package, the algorithm can run data-depende

What would settle it

Run a known sequence of key lookups on an isolated HBM accelerator and record physical emanations per access, e.g., EM from the package or HBM power draw; if the observed pattern correlates with which two logical bins are accessed rather than being uniform over all bin pairs, the unobservable-HBM premise is falsified. A cheaper check: instrument the HBM controller to log which banks the position-map and stash reads hit, then test whether a simulator that knows only the dataset size can reproduce that distribution.

Watch

Extended reading notes

Core claim

The paper's central claim is that oblivious maps do not need worst-case padding and randomized remapping at the O(log^2 N) level if the trusted hardware has a large unobservable memory region rather than a constant-size one. BOLT divides the key-value store into K bins in on-package HBM and M fixed-size encrypted pages in host DRAM. Each key is mapped to two random bins; a request reads both bins (one real, one dummy), executes the get/put, then remaps the key to two fresh random bins. The power-of-two-choices rule places the item in the less loaded bin, and the paper proves (Claims 4.2-4.4) that the maximum bin load is c+O(log2 log2 N), the total HBM load concentrates tightly, and the evict

Load-bearing premise

The whole obliviousness proof presumes that an attacker cannot observe the accelerator's HBM access patterns, because the position map, stash, and load-balancing logic are hidden there; if power, electromagnetic, or controller-level observation of HBM traffic is possible, the simulation argument collapses.

Editorial extensions

If this is right

  • If the claim holds, oblivious key-value access has constant rounds and O(log log N) bandwidth growth, so query latency remains nearly flat as datasets grow to tens of millions of entries.
  • The HBM footprint is modest: for one billion 64-byte-value entries with 32-bit keys, the paper computes roughly 26% of raw data size in HBM when the HBM store is disabled, and less for larger values.
  • Initialization cost drops to near the non-private baseline because the data owner can pre-organize data into bins and BOLT just loads them, giving up to 279x faster init than prior OMAPs.
  • BOLT's measured slowdown over a non-private key-value store stays at 1.8x-2.5x for tested sizes, versus at least 960x for the compared state-of-the-art OMAPs at 1M entries.
  • With larger HBM fractions, query throughput improves further (up to 219K QPS in the prototype), suggesting the design scales with accelerator memory capacity.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If unobservable on-package memory is accepted as a building block, the classical Omega(log N) bandwidth lower bound for ORAM no longer applies to designs with a large private memory tier; the same bin-plus-P2C recipe may extend to other oblivious data structures, such as oblivious sets or sorted maps.
  • The security guarantee is only as strong as the isolation boundary: a physical attack that recovers HBM access patterns (power, EM, or a compromised HBM controller) would void the simulation argument, so the design's practical security depends on hardware hardening the paper explicitly defers to prior TEE work.
  • The paper's stash bound is conservative and the resulting HBM allocation may be pessimistic; a tighter stochastic analysis or adaptive page sizing could reduce HBM requirements further than the reported figures.
  • BOLT's comparison excludes TEE runtime overheads and is run on a 300MHz FPGA, so the absolute speedups would shrink under vendor TEEs; the asymptotic claim, not the clock-rate-dependent latency, is the durable result.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper presents BOLT, an oblivious map (OMAP) accelerator that uses isolated on-package HBM as an unobservable memory region to hide position-map lookups, HBM bin accesses, and stash operations, while host DRAM is accessed through a bin-based oblivious scheme. The logical algorithm (Algorithm 1) assigns each key to two random bins, accesses both per operation, remaps after every access, and applies power-of-two-choices (P2C) load balancing. The authors claim O(1) rounds and O(1)+O(log_2 log_2 N) bandwidth overhead, enabled by HBM-backed metadata and a self-hosted FPGA architecture. A Xilinx U55C prototype is evaluated against H2O2RAM, EnigMap, and Facebook's OMAP, reporting large speedups in query/init time and low slowdown relative to non-private baselines. The paper includes a formal obliviousness argument (Claim 4.1), analytical bounds on bin load, HBM load, and stash size (Claims 4.2–4.4), and an overhead analysis (Claim 5.1).

Significance. If the security and performance claims hold, this is a significant advance for oblivious data structures: it challenges the conventional O(log^2 N)-style overheads by leveraging a hardware assumption (unobservable HBM) that is plausible for packaged accelerators. The paper's strengths include a clean algorithmic idea, a concrete FPGA prototype, open-source code, large speedups over prior OMAP implementations, and a careful empirical validation of the analytical bounds. The central security guarantee, however, rests entirely on the unobservability of HBM; the paper states this assumption but does not implement or validate the required isolation in the prototype. The stochastic analysis supporting the bounds also contains gaps that need to be repaired before the theoretical claims are fully supported.

major comments (4)
  1. [Claim 4.2 and Appendix C.1] The proof of the P2C bin-load bound is not valid as written. The recurrence beta_{k+1}=2N(beta_k/B)^2 with beta_0=B gives beta_1=2N, which is not <= B, and beta_2 is even larger; the claimed doubly exponential decay beta_k <= B*2^{-(2^k-O(1))} is inconsistent with these values. The conclusion max load = c+O(log log N) is therefore not established by the provided proof. Moreover, Claim 4.2 is a static balls-and-bins statement, whereas Algorithm 1 remaps items after every access and uses a dynamic P2C rule; the paper does not prove that the dynamic process preserves the static bound. Since Claim 5.1's bandwidth bound depends directly on the bin-load bound, this is load-bearing and must be fixed, either with a correct proof or by citing a theorem that covers the dynamic setting.
  2. [Claim 4.3] Claim 4.3 applies Hoeffding's inequality to the sum of HBM bin loads, but bin loads are not independent: they are coupled by the P2C placement and by the fact that items are remapped. The proof simply states 'all bin loads are within l_max' and applies Hoeffding, which is not justified for dependent bounded variables. This bound is used in Claim 5.2 to size HBM usage, so the gap matters for the practical resource calculation. The authors should either prove negative association (or another suitable dependence condition) or replace Hoeffding with a concentration inequality that applies under the actual dependence structure.
  3. [Claim 4.4 and Appendix C.2] The queue model for the stash is an approximation of the actual coupled enqueue/dequeue process. In particular, the enqueue probability 1-alpha^2 is an upper bound for the probability that the P2C final destination is a host bin, but the model treats enqueue and dequeue as if they were driven by independent random choices; in reality, the same pair of bins that triggers a page read also determines which stash labels are evicted. Additionally, the supermartingale argument in Appendix C.2 chooses lambda = 2(1-alpha)Delta/(M(...)) with Delta being the tail threshold, rather than the current state, so the claimed one-step supermartingale condition is not established. The numerical validation is encouraging, but the proof as written does not rigorously support the stash-size bound. Since stash overflow would cause data loss, this needs either a rigorous repair or an explicit statement that th
  4. [Section 3 and Claim 4.1] The obliviousness proof is explicitly conditional on HBM being unobservable: the simulator only simulates off-package accesses, and the threat model rules out power/EM analysis, chip depackaging, and multi-tenancy. This is a reasonable modeling choice, but the paper's abstract and conclusion state 'full data-obliviousness' without that qualifier. The security guarantee collapses if the HBM isolation is imperfect, and the FPGA prototype is evaluated without TEE isolation (Section 6.1), so the isolation mechanism is not implemented or validated. The authors should prominently state that the security claim is conditional on the HBM unobservability assumption and should discuss what concrete hardware mechanisms (e.g., SHEF-style firewalls, HBM controller protection) are needed to instantiate it, or explicitly list this as a limitation.
minor comments (5)
  1. [Section 5.3] In the proof of Claim 5.1, it is stated that for d>=4, log_2 log_2 N / log_2 d 'can be viewed as small as a constant.' This is not asymptotically correct; for fixed d it is O(log log N), which grows with N. The final O(log log N) bound is unaffected, but the sentence is misleading.
  2. [Section 4.3] The phrase 'with probability at least 1 - 1/O(N)' is nonstandard and likely intended to mean 1 - O(1/N) or 1 - 1/N^{Omega(1)}. Please clarify throughout.
  3. [Figure 2] The validation figure and the embedded table are hard to read; the legend labels ('Paramater', 'Bin Ld', 'HBM Ld', 'Stash') should be expanded and the axis scales clarified. Also, the table headers 'c=8' and 'c=16' are not clearly associated with the rows.
  4. [General] There are several typos: 'conclud' (Section 4.3), 'shwon' (Section 5.2), 'lighgweight' (Section 5.2), and a duplicated reference entry for Path ORAM (references [104], [105], [106] are the same work). A final proofreading pass is needed.
  5. [Section 6.3] The EnigMap comparison is performed at N=260K rather than the full 1M dataset, as noted. Since the slowdown metric is the primary comparison, this is acceptable, but the table should make the data-size disparity more visually prominent to avoid overstating the raw speedup.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: BOLT's bounds come from external theorems and its security proof rests on an explicit, externally-sourced HBM-unobservability modeling assumption.

full rationale

BOLT's central derivation is self-contained. The O(log log N) bin-load bound (Claim 4.2) is a direct application of the external power-of-two-choices theorem [89,103], and the HBM-load and stash bounds (Claims 4.3-4.4) follow from Hoeffding's inequality and drift analysis. The paper does not fit these bounds to data; the validation experiments in Figure 2 compare simulated peaks to the a priori analytic bounds with constants set to 1, so no fitted parameter is being renamed as a prediction. The security argument (Claim 4.1) is a standard simulator proof whose only non-algorithmic input is the threat-model assumption that on-package HBM accesses are unobservable. That assumption is attributed to prior external works (Vaswani et al., Hunt et al., Volos et al.) and is explicitly scoped in Section 3's non-goals, making it a modeling premise rather than a circular reduction. There is no load-bearing self-citation chain: the authors' own prior work is not used to justify the central claim. Concerns about whether HBM is truly unobservable against power/EM or compromised-controller attacks are legitimate security-risk questions, but they are not instances of the paper's derivation reducing to its own inputs.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The central claim depends on two classes of assumptions: (1) the physical unobservability of HBM (the entire security argument), and (2) the concentration bounds for random bin loads (the bandwidth argument). The paper provides empirical validation for N=2^20, but the analytical proofs for the stash bound and the bin-load concentration are heuristic or improperly justified.

free parameters (3)
  • c (average records per bin, N/B) = 8 (default)
    Controls the page size and the position map size. The bandwidth blow-up is O(c + log log N); larger c reduces position map size but increases per-access bandwidth.
  • alpha (fraction of bins in HBM) = 0.2 (default; 0.01 and 0.5 in experiments)
    Sets the ratio of HBM bins and affects stash size and HBM usage. Larger alpha requires more HBM but reduces host-page access probability.
  • d (number of hash choices for position map) = 4
    Number of hash functions for power-of-choices in the position map; the paper claims d=4 suffices to keep position-map load bounded.
assumptions (5)
  • domain assumption HBM is unobservable to the adversary
    Introduced Section 1, used throughout. The entire security proof treats all HBM traffic as invisible; if false, obliviousness fails.
  • domain assumption Attacker cannot perform chip depackaging
    Threat model Section 3: 'we assume attackers cannot perform hypothetical chip depackaging to compromise silicon interposers within the chip package.'
  • domain assumption Standard TEE building blocks are available and correct
    Section 2.3 and Appendix B; BOLT relies on remote attestation, I/O isolation, memory encryption, and integrity mechanisms rather than implementing them.
  • standard math Power-of-two-choices theorem for balls-and-bins
    Claim 4.2 cites [89,103]; gives max bin load c+O(log log N).
  • domain assumption Data owner is trusted to prepare initial partitioning
    Section 5.3 'Fast data initialization': DO pre-processes data and organizes into bins; if the owner is malicious, the initial layout could leak, but that is outside the threat model.

how reviews work

0 comments
Cite this review

Pith. "Pith review of BOLT: Bandwidth-Optimized Lightning-Fast Oblivious Map powered by Secure HBM Accelerators." pith.science (2026). https://pith.science/paper/ZQ2OPZVN

@misc{pith2026250901742,
  author       = {Pith},
  title        = {Pith review of: BOLT: Bandwidth-Optimized Lightning-Fast Oblivious Map powered by Secure HBM Accelerators},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZQ2OPZVN}},
  note         = {Machine review of arXiv:2509.01742}
}
read the original abstract

While Trusted Execution Environments provide a strong foundation for secure cloud computing, they remain vulnerable to access pattern leakages. Oblivious Maps (OMAPs) mitigate this by fully hiding access patterns but suffer from high overhead due to randomized remapping and worst-case padding. We argue these costs are not fundamental. Modern accelerators featuring High-Bandwidth Memory (HBM) offer a new opportunity: Vaswani et al. [OSDI'18] point out that eavesdropping on HBM is difficult -- even for physical attackers -- as its memory channels are sealed together with processor cores inside the same physical package. Later, Hunt et al. [NSDI'20] show that, with proper isolation, HBM can be turned into an unobservable region where both data and memory traces are hidden. This motivates a rethink of OMAP design with HBM-backed solutions to finally overcome their traditional performance limits. Building on these insights, we present BOLT, a Bandwidth Optimized, Lightning-fast OMAP accelerator that, for the first time, achieves O(1) + O(log_2(log_2 (N))) bandwidth overhead. BOLT introduces three key innovations: (i) a new OMAP algorithm that leverages isolated HBM as an unobservable cache to accelerate oblivious access to large host memory; (ii) a self-hosted architecture that offloads execution and memory control from the host to mitigate CPU-side leakage; and (iii) tailored algorithm-architecture co-designs that maximize resource efficiency. We implement a prototype BOLT on a Xilinx U55C FPGA. Evaluations show that BOLT achieves up to 279x and 480x speedups in initialization and query time, respectively, over state-of-the-art OMAPs, including an industry implementation from Facebook.

Figures

Figures reproduced from arXiv: 2509.01742 by the authors.

Figure 1
Figure 1. BOLT overview and deployments level, BOLT is built on top of accelerator TEE architectures. It uses existing TEE features (§2.3) to enforce physical isolation and en￾sure integrity. The BOLT core is a full-fledged OMAP engine that sits behind the TEE gateway to provide efficient oblivious KV ac￾cesses. A typical BOLT lifecycle goes like this: A client first goes through standard TEE setups, such as remotely attestin… view at source ↗
Figure 2
Figure 2. Validation experiments (Exp. vs. Anal.) Our empirical results in [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Architectural overview of BOLT. the design and execution flows of BOLT. For brevity, we focus on OMAP transactions and omit standard TEE features. 1 Initialization. BOLT undergoes a secure boot to initialize its internal states and allocates HBM storage for position map, eviction stash, and HBM bins. The host allocates a physically contiguous, pinned memory region (e.g., Hugepages [120]) so that BOLT can directly ac… view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: Comparison of different storage design [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 4
Figure 4. Figure 4: c), we partition storage across multiple banks, with each [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: Free address ring buffer. Initially, the ring buffer is preloaded with all available HBM addresses for value stores. When space is needed for, e.g., inserting new data or remapping a page-ed value into the HBM—an address is dequeued. For other cases where data is remov…
Figure 6
Figure 6. Figure 6: Performance under scaling data entries. 8 16 32 64 128256 Value Size (bytes) 10 0 10 1 10 2 10 3 a. Init time (s) 8 16 32 64 128256 Value Size (bytes) 10 0 10 1 10 2 10 3 b. Init slowdown 8 16 32 64 128256 Value Size (bytes) 10 1 10 0 10 1 c. Query time (s) 8 16 32 64 …
Figure 7
Figure 7. Figure 7: Performance under scaling value sizes. Experiment setup. We adopt the same setup as § 6.3 and consider two scaling scenarios: (i) Entry size scaling. We fix the key and value size, but vary the number of data entries from 100K to 10M; (ii) Value length scaling. We fix …
Figure 8
Figure 8. Figure 8: Performance breakdown. MAPpos Vhbm Vhost Stash Objects 10 0 10 1 10 2 10 3 10 4 Memory (MB) 624 16 192 128 a. 8B value size MAPpos Vhbm Vhost Stash Objects 624 488 6144 128 b. 256B value size [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]
Figure 11
Figure 11. Figure 11: Post-synthesis netlist schematic of BOLT. HWRoT. A HWRoT is a compact, tamper-resistant hardware mod￾ule embedded in silicon that serves as the foundation for a system’s security functions. It comprises two primary components: (1) Boot ROM. An immutable section of cod…
Figure 10
Figure 10. Figure 10: The testbed and BOLT prototype. B Additional Background B.1 FPGA and its security features FPGA. An FPGA is a hardware device consisting of configurable logic blocks and interconnects, programmable by loading a developer￾created binary file called a bitstream. The bit…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

134 extracted references · 71 canonical work pages

  1. [1]

    Vitis Security Library

    2023. Vitis Security Library. https://www.amd.com/en/products/software/ adaptive-socs-and-fpgas/vitis/vitis-libraries/vitis-security.html. Accessed: 2023-06-10

    2023

  2. [2]

    Advanced Micro Devices, Inc. 2023. Alveo U55C Data Center Accelerator Card | AMD. https://www.amd.com/en/products/accelerators/alveo/u55c/a-u55c- p00g-pq-g.html. Accessed: 2023-05-22

    2023

  3. [3]

    Shaizeen Aga and Satish Narayanasamy. 2017. Invisimem: Smart memory defenses for memory bus side channel.ACM SIGARCH Computer Architecture News45, 2 (2017), 94–106

    2017

  4. [4]

    Amazon Web Services. [n. d.]. Amazon Simple Storage Service (S3). https: //aws.amazon.com/s3/. Accessed: 2025-07-10

    2025

  5. [5]

    Amazon Web Services. 2017. Amazon EC2 F1 Instances – Customizable FPGAs for Hardware Acceleration Are Now Generally Available. https: //aws.amazon.com/about-aws/whats-new/2017/04/amazon-ec2-f1-instances- customizable-fpgas-for-hardware-acceleration-are-now-generally-available/ Accessed: 2025-03-16

    2017

  6. [6]

    Amazon Web Services. 2024. Amazon EC2 F2 Instances. https://aws.amazon. com/ec2/instance-types/f2/ Accessed: 2025-03-16

    2024

  7. [7]

    AMD. [n. d.]. AMD Instinct MI325x Series Accelerators. https://www.amd.com/ en/products/accelerators/instinct/mi300/mi325x.html

  8. [8]

    AMD. 2023. UltraRAM Introduction. https://docs.amd.com/r/en-US/am007- versal-memory/UltraRAM-Introduction. Accessed: April 13, 2025

    2023

Show all 134 references
  1. [9]

    AMD. 2024. AMD Alveo V80 Data Center Accelerator Card. https://www.amd. com/en/products/accelerators/alveo/v80.html. Accessed: 2025-03-25

    2024

  2. [10]

    AMD. 2024. AMD EPYC Embedded 9004 and 8004 Series Product Brief. https://www.amd.com/content/dam/amd/en/documents/products/ embedded/epyc/epyc-embedded-9004-and-8004-series-product-brief.pdf Ac- cessed: March 4, 2025

    2024

  3. [11]

    2024.Asymmetric Hardware Root of Trust (HWRoT) Authentication Re- quired

    AMD. 2024.Asymmetric Hardware Root of Trust (HWRoT) Authentication Re- quired. https://docs.amd.com/r/en-US/ug1304-versal-acap-ssdg/Asymmetric- Hardware-Root-of-Trust-A-HWRoT-Authentication-Required Accessed: 2024- 06-22

    2024

  4. [12]

    Md Armanuzzaman and Ziming Zhao. 2022. Byotee: Towards building your own trusted execution environments using fpga.arXiv preprint arXiv:2203.04214 (2022)

    2022 arXiv

  5. [13]

    2009.Computational complexity: a modern approach

    Sanjeev Arora and Boaz Barak. 2009.Computational complexity: a modern approach. Cambridge University Press

    2009

  6. [14]

    Gilad Asharov, Ilan Komargodski, Wei-Kai Lin, Kartik Nayak, Enoch Peserico, and Elaine Shi. 2020. OptORAMa: optimal oblivious RAM. InAdvances in Cryptology–EUROCRYPT 2020: 39th Annual International Conference on the The- ory and Applications of Cryptographic Techniques, Zagreb...

    2020

  7. [15]

    Gilad Asharov, Ilan Komargodski, and Yehuda Michelson. 2023. Futorama: A concretely efficient hierarchical oblivious ram. InProceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security. 3313–3327

    2023

  8. [16]

    Amro Awad, Yipeng Wang, Deborah Shands, and Yan Solihin. 2017. Obfusmem: A low-overhead access obfuscation for trusted memories. InProceedings of the 44th Annual International Symposium on Computer Architecture. 107–119

    2017

  9. [17]

    Dimitrios Balobas and Nikos Konofaos. 2016. Low-power, high-performance 64-bit CMOS priority encoder using static-dynamic parallel architecture. In 2016 5th International conference on modern circuits and systems technologies (MOCAST). IEEE, 1–4

    2016

  10. [18]

    Lejla Batina, Shivam Bhasin, Dirmanto Jap, and Stjepan Picek. 2019. CSI NN: Reverse engineering of neural network architectures through electromagnetic side channel. In28th USENIX Security Symposium (USENIX Security 19). 515–532

    2019

  11. [19]

    Vincent Bindschaedler, Muhammad Naveed, Xiaorui Pan, XiaoFeng Wang, and Yan Huang. 2015. Practicing oblivious access on cloud storage: the gap, the fallacy, and the new way forward. InProceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security. 837–849

    2015

  12. [20]

    Laura Blackstone, Seny Kamara, and Tarik Moataz. 2019. Revisiting leakage abuse attacks.Cryptology ePrint Archive(2019)

    2019

  13. [21]

    Michaela Blott, Kimon Karras, Ling Liu, Kees Vissers, Jeremia Bär, and Zsolt István. 2013. Achieving 10gbps line-rate key-value stores with{FPGAs}. In5th USENIX Workshop on Hot Topics in Cloud Computing (HotCloud 13)

    2013

  14. [22]

    Stéphane Boucheron, Gábor Lugosi, and Olivier Bousquet. 2003. Concentration inequalities. InSummer school on machine learning. Springer, 208–240

    2003

  15. [23]

    Xinle Cao, Weiqi Feng, Jian Liu, Jinjin Zhou, Wenjing Fang, Lei Wang, Quanqing Xu, Chuanhui Yang, and Kui Ren. 2024. Towards Practical Oblivious Map. Cryptology ePrint Archive(2024)

    2024

  16. [24]

    David Cash, Paul Grubbs, Jason Perry, and Thomas Ristenpart. 2015. Leakage- abuse attacks against searchable encryption. InProceedings of the 22nd ACM CCS ’25, October 13–17, 2025, Taipei, Taiwan. Guo et al. SIGSAC conference on computer and communications security. 668–679

    2015

  17. [25]

    Javad Ghareh Chamani, Ioannis Demertzis, Dimitrios Papadopoulos, Charalam- pos Papamanthou, and Rasool Jalili. 2023. GraphOS: Towards Oblivious Graph Processing.Proceedings of the VLDB Endowment16, 13 (2023), 4324–4338

    2023

  18. [26]

    Zhao Chang, Dong Xie, Feifei Li, Jeff M Phillips, and Rajeev Balasubramonian

  19. [27]

    Yuezhi Che and Rujia Wang. 2020. Multi-range supported oblivious RAM for efficient block data retrieval. In2020 IEEE International Symposium on High Performance Computer Architecture (HPCA). IEEE, 369–382

    2020

  20. [28]

    Kwanghoon Choi, Igjae Kim, Sunho Lee, and Jaehyuk Huh. 2024. ShieldCXL: A Practical Obliviousness Support with Sealed CXL Memory.ACM Transactions on Architecture and Code Optimization(2024)

    2024

  21. [29]

    Chitchanok Chuengsatiansup, Daniel Genkin, Yuval Yarom, and Zhiyuan Zhang

  22. [30]

    Memcached Contributors. 2025. Programming Tricks: Reducing Key Size. https://github.com/memcached/memcached/wiki/ProgrammingTricks# reducing-key-size. Accessed: 2025-03-23

    2025

  23. [31]

    OpenDSA Project Contributors. 2023. Heap Memory. https://opendsa-server.cs. vt.edu/ODSA/Books/CS2/html/HeapMem.html. Accessed: 2025-04-07

    2023

  24. [32]

    Cooper et al

    Brian F. Cooper et al. 2010. Yahoo! Cloud Serving Benchmark (YCSB). https: //github.com/brianfrankcooper/YCSB. Accessed: 2025-03-21

    2010

  25. [33]

    Intel Corporation. 2024. Intel Xeon Max Series Processors. https://www.intel. com/content/www/us/en/products/details/processors/xeon/max-series.html Accessed: March 16, 2025

    2024

  26. [34]

    Victor Costan and Srinivas Devadas. 2016. Intel SGX explained.Cryptology ePrint Archive(2016)

    2016

  27. [35]

    Natacha Crooks, Matthew Burke, Ethan Cecchetti, Sitar Harel, Rachit Agarwal, and Lorenzo Alvisi. 2018. Obladi: Oblivious serializable transactions in the cloud. In13th USENIX Symposium on Operating Systems Design and Implementation (OSDI 18). 727–743

    2018

  28. [36]

    Fergus Dall, Gabrielle De Micheli, Thomas Eisenbarth, Daniel Genkin, Nadia Heninger, Ahmad Moghimi, and Yuval Yarom. 2018. Cachequote: Efficiently recovering long-term secrets of SGX EPID via cache attacks. (2018)

    2018

  29. [37]

    Wafi Danesh, Joshua Banago, and Mostafizur Rahman. 2020. Turning the Table: Using Reverse Engineering Techniques to Detect FPGA Trojans.Journal of Hardware and Systems Security(2020)

    2020

  30. [38]

    Emma Dauterman, Vivian Fang, Ioannis Demertzis, Natacha Crooks, and Raluca Ada Popa. 2021. Snoopy: Surpassing the scalability bottleneck of oblivi- ous storage. InProceedings of the ACM SIGOPS 28th Symposium on Operating Systems Principles. 655–671

    2021

  31. [39]

    Aritra Dhar, Clément Thorens, Lara Magdalena Lazier, and Lukas Cavigelli. 2024. Ascend-CC: Confidential Computing on Heterogeneous NPU for Emerging Generative AI Workloads.arXiv preprint arXiv:2407.11888(2024)

    2024 arXiv

  32. [40]

    Sam Dittmer and Rafail Ostrovsky. 2020. Oblivious tight compaction in O (n) time with smaller constant. InInternational Conference on Security and Cryptography for Networks. Springer, 253–274

    2020

  33. [41]

    Kha Dinh Duy and Hojoon Lee. 2022. SE-PIM: In-Memory Acceleration of Data-Intensive Confidential Computing.IEEE Transactions on Cloud Computing (2022)

    2022

  34. [42]

    Dirk Eddelbuettel. 2022. A brief introduction to redis.arXiv preprint arXiv:2203.06559(2022)

    2022 arXiv

  35. [43]

    Saba Eskandarian and Matei Zaharia. 2019. ObliDB: Oblivious Query Processing for Secure Databases.Proc. VLDB Endow.13, 2 (oct 2019), 169–183. doi:10.14778/ 3364324.3364331

    2019

  36. [44]

    Dmitry Evtyushkin, Ryan Riley, Nael CSE Abu-Ghazaleh, ECE, and Dmitry Ponomarev. 2018. Branchscope: A new side-channel attack on directional branch predictor.ACM SIGPLAN Notices53, 2 (2018), 693–707

    2018

  37. [45]

    Facebook. 2023. Facebook ORAM Repository. https://github.com/facebook/oram. Accessed: 2025-03-21

    2023

  38. [46]

    Chongzhou Fang, Ning Miao, Han Wang, Jiacheng Zhou, Tyler Sheaves, John M Emmert, Avesta Sasan, and Houman Homayoun. 2023. Gotcha! i know what you are doing on the fpga cloud: Fingerprinting co-located cloud fpga accelerators via measuring communication links. InProceedings of...

    2023

  39. [47]

    Christopher W Fletcher, Ling Ren, Albert Kwon, Marten Van Dijk, Emil Ste- fanov, Dimitrios Serpanos, and Srinivas Devadas. 2015. A low-latency, low-area hardware oblivious RAM controller. In2015 IEEE 23rd Annual International Sym- posium on Field-Programmable Custom Computing ...

    2015

  40. [48]

    GeeksforGeeks. 2024. How to Store Data on Ethereum Blockchain? https: //www.geeksforgeeks.org/how-to-store-data-on-ethereum-blockchain/ Ac- cessed: 2025-03-24

    2024

  41. [49]

    Ilias Giechaskiel, Kasper Bonne Rasmussen, and Jakub Szefer. 2020. C 3 APSULe: Cross-FPGA covert-channel attacks through power supply unit leakage. In2020 IEEE Symposium on Security and Privacy (SP). IEEE, 1728–1741

    2020

  42. [50]

    Ilias Giechaskiel, Shanquan Tian, and Jakub Szefer. 2022. Cross-vm covert- and side-channel attacks in cloud fpgas.ACM Transactions on Reconfigurable Technology and Systems16, 1 (2022), 1–29

    2022

  43. [51]

    Oded Goldreich. 1987. Towards a theory of software protection and simulation by oblivious RAMs. InProceedings of the nineteenth annual ACM symposium on Theory of computing. 182–194

    1987

  44. [52]

    Oded Goldreich and Rafail Ostrovsky. 1996. Software protection and simulation on oblivious RAMs.Journal of the ACM (JACM)43, 3 (1996), 431–473

    1996

  45. [53]

    Cheng Gongye, Yukui Luo, Xiaolin Xu, and Yunsi Fei. 2023. Side-Channel- Assisted Reverse-Engineering of Encrypted DNN Hardware Accelerator IP and Attack Surface Exploration. In2024 IEEE Symposium on Security and Privacy (SP). IEEE Computer Society, 1–1

    2023

  46. [54]

    Ben Gras, KAVEH Razavi, Herbert Bos, and Cristiano Giuffrida. 2018. Tlbleed: When protecting your cpu caches is not enough.Black Hat(2018)

    2018

  47. [55]

    Mathieu Gross, Nisha Jacob, Andreas Zankl, and Georg Sigl. 2019. Breaking trustzone memory isolation through malicious hardware on a modern fpga-soc. InProceedings of the 3rd ACM Workshop on Attacks and Solutions in Hardware Security Workshop. 3–12

    2019

  48. [56]

    Shay Gueron. 2016. A Memory Encryption Engine Suitable for General Purpose Processors. Cryptology ePrint Archive, Paper 2016/204. https://eprint.iacr.org/ 2016/204

    2016

  49. [57]

    Shay Gueron, Adam Langley, and Yehuda Lindell. 2017. AES-GCM-SIV: specifi- cation and analysis.Cryptology ePrint Archive(2017)

    2017

  50. [58]

    Chuanxiong Guo, Haitao Wu, Zhong Deng, Gaurav Soni, Jianxi Ye, Jitu Padhye, and Marina Lipshteyn. 2016. RDMA over commodity ethernet at scale. In Proceedings of the 2016 ACM SIGCOMM Conference. 202–215

    2016

  51. [59]

    Brett Hemenway Falk, Daniel Noble, and Rafail Ostrovsky. 2021. Alibi: A flaw in cuckoo-hashing based hierarchical ORAM schemes and a solution. In Annual International Conference on the Theory and Applications of Cryptographic Techniques. Springer, 338–369

    2021

  52. [60]

    Wassily Hoeffding. 1994. Probability inequalities for sums of bounded random variables.The collected works of Wassily Hoeffding(1994), 409–426

    1994

  53. [61]

    Xing Hu, Ling Liang, Shuangchen Li, Lei Deng, Pengfei Zuo, Yu Ji, Xinfeng Xie, Yufei Ding, Chang Liu, Timothy Sherwood, and Yuan Xie. 2020. Deepsniffer: A DNN model extraction framework based on learning architectural hints. In Proceedings of the Twenty-Fifth International Con...

    2020

  54. [62]

    Shao-Wei Huang and Yen-Jen Chang. 2010. A full parallel priority encoder design used in comparator. In2010 53rd IEEE International Midwest Symposium on Circuits and Systems. IEEE, 877–880

    2010

  55. [63]

    Tyler Hunt, Zhipeng Jia, Vance Miller, Ariel Szekely, Yige Hu, Christopher J Rossbach, and Emmett Witchel. 2020. Telekine: Secure computing with cloud {GPUs}. In17th USENIX Symposium on Networked Systems Design and Imple- mentation (NSDI 20). 817–833

    2020

  56. [64]

    Tianlin Huo, Xiaoni Meng, Wenhao Wang, Chunliang Hao, Pei Zhao, Jian Zhai, and Mingshu Li. 2020. Bluethunder: A 2-level directional predictor based side- channel attack against sgx.IACR Transactions on Cryptographic Hardware and Embedded Systems(2020), 321–347

    2020

  57. [65]

    Apple Inc. 2025. NSUbiquitousKeyValueStore Documentation. https://developer. apple.com/documentation/foundation/nsubiquitouskeyvaluestore. Accessed: 2025-03-23

    2025

  58. [66]

    Andrei Ivanov, Benjamin Rothenberger, Arnaud Dethise, Marco Canini, Torsten Hoefler, and Adrian Perrig. 2023. {SAGE}: Software-based Attestation for {GPU} Execution. In2023 USENIX Annual Technical Conference (USENIX ATC 23). 485–499

    2023

  59. [67]

    Insu Jang, Adrian Tang, Taehoon Kim, Simha Sethumadhavan, and Jaehyuk Huh. 2019. Heterogeneous isolated execution for commodity gpus. InProceed- ings of the Twenty-Fourth International Conference on Architectural Support for Programming Languages and Operating Systems. 455–468

    2019

  60. [68]

    Jin Jiang, Dongsheng He, Yu Hu, Dong Liu, Chenfan Xiao, Hongxiao Bi, Yusong Zhang, Chaoqu Jiang, and Zhijun Fu. 2024. CompassDB: Pioneering High- Performance Key-Value Store with Perfect Hash.arXiv preprint arXiv:2406.18099 (2024)

    2024 arXiv

  61. [69]

    Georgios Kellaris, George Kollios, Kobbi Nissim, and Adam O’neill. 2016. Generic attacks on secure outsourced databases. InProceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. 1329–1340

    2016

  62. [70]

    Paul Kocher, Jann Horn, Anders Fogh, , Daniel Genkin, Daniel Gruss, Werner Haas, Mike Hamburg, Moritz Lipp, Stefan Mangard, Thomas Prescher, Michael Schwarz, and Yuval Yarom. 2019. Spectre Attacks: Exploiting Speculative Exe- cution. In40th IEEE Symposium on Security and Priva...

    2019

  63. [71]

    Evgenios M Kornaropoulos, Nathaniel Moyer, Charalampos Papamanthou, and Alexandros Psomas. 2022. Leakage inversion: Towards quantifying privacy in searchable encryption. InProceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security. 1829–1842

    2022

  64. [72]

    Dayeol Lee, Dongha Jung, Ian T Fang, Chia-Che Tsai, and Raluca Ada Popa

  65. [73]

    Dong Uk Lee. 2022. HBM DRAM and 3D Stacked Memory Slides. https:// resourcecenter.sscs.ieee.org/education/short-courses/sscstut20210215 Accessed: 2025-04-07. BOLT : Bandwidth-Optimized Lightning-Fast Oblivious Map powered by Secure HBM Accelerators CCS ’25, October 13–17, 2025...

    2022

  66. [74]

    Sangho Lee, Ming-Wei Shih, Prasun Gera, Taesoo Kim, Hyesoon Kim, and Marcus Peinado. 2017. Inferring fine-grained control flow inside{SGX} enclaves with branch shadowing. In26th USENIX Security Symposium (USENIX Security 17). 557–574

    2017

  67. [75]

    Johannes Lengler. 2020. Drift analysis.Theory of evolutionary computation: Recent developments in discrete optimization(2020), 89–131

    2020

  68. [76]

    Ge Li, Mohit Tiwari, and Michael Orshansky. 2022. Power-based attacks on spatial dnn accelerators.ACM Journal on Emerging Technologies in Computing Systems (JETC)18, 3 (2022), 1–18

    2022

  69. [77]

    Moritz Lipp, Michael Schwarz, Daniel Gruss, Thomas Prescher, Werner Haas, Anders Fogh, Jann Horn, Stefan Mangard, Paul Kocher, Daniel Genkin, Yuval Yarom, and Mike Hamburg. 2018. Meltdown: Reading Kernel Memory from User Space. In27th USENIX Security Symposium (USENIX Security 18)

    2018

  70. [78]

    Chang Liu, Austin Harris, Martin Maas, Michael Hicks, Mohit Tiwari, and Elaine Shi. 2015. Ghostrider: A hardware-software system for memory trace oblivious computation.ACM SIGPLAN Notices50, 4 (2015), 87–101

    2015

  71. [79]

    Fangfei Liu, Yuval Yarom, Qian Ge, Gernot Heiser, and Ruby B Lee. 2015. Last- level cache side-channel attacks are practical. In2015 IEEE symposium on security and privacy. IEEE, 605–622

    2015

  72. [80]

    Haojun Liu, Xinbo Luo, Hongrui Liu, and Xubo Xia. 2021. Merkle tree: A fundamental component of blockchains. In2021 International Conference on Electronic Information Engineering and Computer Science (EIECS). IEEE, 556–561

    2021

  73. [81]

    Yukui Luo, Cheng Gongye, Shaolei Ren, Yunsi Fei, and Xiaolin Xu. 2020. Stealthy- Shutdown: Practical Remote Power Attacks in Multi-Tenant FPGAs. In2020 IEEE 38th International Conference on Computer Design (ICCD). IEEE, 545–552

    2020

  74. [82]

    Martin Maas, Eric Love, Emil Stefanov, Mohit Tiwari, Elaine Shi, Krste Asanovic, John Kubiatowicz, and Dawn Song. 2013. Phantom: Practical oblivious compu- tation in a secure processor. InProceedings of the 2013 ACM SIGSAC conference on Computer & communications security. 311–324

    2013

  75. [83]

    Haohui Mai, Jiacheng Zhao, Hongren Zheng, Yiyang Zhao, Zibin Liu, Mingyu Gao, Cong Wang, Huimin Cui, Xiaobing Feng, and Christos Kozyrakis. 2023. Honeycomb: Secure and Efficient{GPU} Executions via Static Validation. In 17th USENIX Symposium on Operating Systems Design and Imp...

    2023

  76. [84]

    Evangelia Anna Markatou and Roberto Tamassia. 2019. Full database recon- struction with access and search pattern leakage. InInternational Conference on Information Security. Springer, 25–43

    2019

  77. [85]

    Memcached Developers. 2025. Memcached: High-Performance Distributed Memory Object Caching System. https://memcached.org/. Accessed: March 13, 2025

    2025

  78. [86]

    Silvio Micali, Oded Goldreich, and Avi Wigderson. 1987. How to play any mental game. InProceedings of the Nineteenth ACM Symp. on Theory of Computing, STOC. ACM New York, NY, USA, 218–229

    1987

  79. [87]

    Pratyush Mishra, Rishabh Poddar, Jerry Chen, Alessandro Chiesa, and Raluca Ada Popa. 2018. Oblix: An efficient oblivious search index. In2018 IEEE Symposium on Security and Privacy (SP). IEEE, 279–296

    2018

  80. [88]

    Pratyush Mishra, Rishabh Poddar, Jerry Chen, Alessandro Chiesa, and Raluca Ada Popa. 2018. Oblix: An efficient oblivious search index. In2018 IEEE Symposium on Security and Privacy (SP’18). IEEE, 279–296

    2018

  81. [89]

    Michael Mitzenmacher. 2001. The power of two choices in randomized load balancing.IEEE Transactions on Parallel and Distributed Systems12, 10 (2001), 1094–1104

    2001

  82. [90]

    Tarik Moataz, Travis Mayberry, Erik-Oliver Blass, and Agnes Hui Chan. 2015. Resizable tree-based oblivious RAM. InFinancial Cryptography and Data Secu- rity: 19th International Conference, FC 2015, San Juan, Puerto Rico, January 26-30, 2015, Revised Selected Papers 19. Springe...

    2015

  83. [91]

    Shayan Moini, Shanquan Tian, Daniel Holcomb, Jakub Szefer, and Russell Tessier

  84. [92]

    NVIDIA. 2023. High Confidential Computing: Unlocking the Potential of Confi- dential Computing with NVIDIA H100. https://images.nvidia.com/aem-dam/en- zz/Solutions/data-center/HCC-Whitepaper-v1.0.pdf

    2023

  85. [93]

    NVIDIA Corporation. [n. d.]. GPU Direct. https://developer.nvidia.com/ gpudirect

  86. [94]

    NVIDIA Developer Blog. 2023. Confidential Computing on NVIDIA H100 GPUs for Secure and Trustworthy AI. https://developer.nvidia.com/blog/confidential- computing-on-h100-gpus-for-secure-and-trustworthy-ai/

    2023

  87. [95]

    In 2021 Design, Automation & Test in Europe Conference & Exhibition (DATE)

    Remote power side-channel attacks on BNN accelerators in FPGAs. In 2021 Design, Automation & Test in Europe Conference & Exhibition (DATE). IEEE, 1639–1644

    2021

  88. [96]

    Simon Oya and Florian Kerschbaum. 2021. Hiding the access pattern is not enough: Exploiting search pattern leakage in searchable encryption. In30th USENIX Security Symposium (USENIX Security 21). 127–142

    2021

  89. [97]

    Sarvar Patel, Giuseppe Persiano, Mariana Raykova, and Kevin Yeo. 2018. PanORAMa: Oblivious RAM with logarithmic overhead. In2018 IEEE 59th Annual Symposium on Foundations of Computer Science (FOCS). IEEE, 871–882

    2018

  90. [98]

    2016.{DRAMA}: Exploiting{DRAM} addressing for{Cross-CPU} attacks

    Peter Pessl, Daniel Gruss, Clémentine Maurice, Michael Schwarz, and Stefan Mangard. 2016.{DRAMA}: Exploiting{DRAM} addressing for{Cross-CPU} attacks. In25th USENIX security symposium (USENIX security 16). 565–581

    2016

  91. [99]

    Hyunyoung Oh, Adil Ahmad, Seonghyun Park, Byoungyoung Lee, and Yun- heung Paek. 2020. Trustore: Side-channel resistant storage for sgx using intel hybrid cpu-fpga. InProceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security. 1903–1918

    2020

  92. [100]

    Daniel S Roche, Adam Aviv, and Seung Geol Choi. 2016. A practical oblivious map data structure with secure deletion and history independence. In2016 IEEE Symposium on Security and Privacy (SP). IEEE, 178–197

    2016

  93. [101]

    Sajin Sasy, Sergey Gorbunov, and Christopher W Fletcher. 2017. ZeroTrace: Oblivious memory primitives from Intel SGX.Cryptology ePrint Archive(2017)

    2017

  94. [102]

    AMD Sev-Snp. 2020. Strengthening VM isolation with integrity protection and more.White Paper, January53 (2020), 1450–1465

    2020

  95. [103]

    Ling Ren, Christopher Fletcher, Albert Kwon, Emil Stefanov, Elaine Shi, Marten Van Dijk, and Srinivas Devadas. 2015. Constants count: Practical improvements to oblivious{RAM}. In24th USENIX Security Symposium (USENIX Security 15). 415–430

    2015

  96. [106]

    Emil Stefanov, Marten van Dijk, Elaine Shi, T-H Hubert Chan, Christopher Fletcher, Ling Ren, Xiangyao Yu, and Srinivas Devadas. 2018. Path ORAM: an extremely simple oblivious RAM protocol.Journal of the ACM (JACM)65, 4 (2018), 1–26

    2018

  97. [107]

    Ramesh Sitaraman. 2001. The power of two random choices: A survey of techniques and results. (2001)

    2001

  98. [108]

    2022.{TLB; DR}: Enhancing{TLB-based} attacks with{TLB} desynchronized reverse engineering

    Andrei Tatar, Daniël Trujillo, Cristiano Giuffrida, and Herbert Bos. 2022.{TLB; DR}: Enhancing{TLB-based} attacks with{TLB} desynchronized reverse engineering. In31st USENIX Security Symposium (USENIX Security 22). 989– 1007

    2022

  99. [109]

    Apify Technologies. 2025. Key-Value Store Documentation. https://docs.apify. com/platform/storage/key-value-store. Accessed: 2025-03-23

    2025

  100. [110]

    Shanquan Tian and Jakub Szefer. 2019. Temporal Thermal Covert Channels in Cloud FPGAs. InProceedings of the 2019 ACM/SIGDA International Symposium on Field-Programmable Gate Arrays. ACM, 298–303

    2019

  101. [111]

    Emil Stefanov and Elaine Shi. 2013. Oblivistore: High performance oblivious cloud storage. In2013 IEEE Symposium on Security and Privacy. IEEE, 253–267

    2013

  102. [112]

    Giorgos Vasiliadis, Elias Athanasopoulos, Michalis Polychronakis, and Sotiris Ioannidis. 2014. PixelVault: Using GPUs for securing cryptographic operations. InProceedings of the 2014 ACM SIGSAC Conference on Computer and Communi- cations Security. 1131–1142

    2014

  103. [113]

    Kapil Vaswani, Stavros Volos, Cédric Fournet, Antonio Nino Diaz, Ken Gordon, Balaji Vembu, Sam Webster, David Chisnall, Saurabh Kulkarni, Graham Cun- ningham, Richard Osborne, and Dan Wilkinson. 2022. Confidential machine learning within graphcore ipus.arXiv preprint arXiv:220...

    2022 arXiv

  104. [114]

    Stavros Volos, Kapil Vaswani, and Rodrigo Bruno. 2018. Graviton: Trusted execution environments on{GPUs}. In13th USENIX Symposium on Operating Systems Design and Implementation (OSDI 18). 681–696

    2018

  105. [115]

    Afonso Tinoco, Sixiang Gao, and Elaine Shi. 2023. {EnigMap}:{External- Memory} Oblivious Map for Secure Enclaves. In32nd USENIX Security Sympo- sium (USENIX Security 23). 4033–4050

    2023

  106. [116]

    Yanling Wang, Xiaolin Chang, Haoran Zhu, Jianhua Wang, Yanwei Gong, and Lin Li. 2024. Towards Secure Runtime Customizable Trusted Execution Environment on FPGA-SoC.IEEE Trans. Comput.(2024)

    2024

  107. [117]

    Don R Wilhelmsen. 1974. A Markov inequality in several dimensions.J. Approx. Theory11, 3 (1974), 216–220

    1974

  108. [118]

    Yun Xiang, Zhuangzhi Chen, Zuohui Chen, Zebin Fang, Haiyang Hao, Jinyin Chen, Yi Liu, Zhefu Wu, Qi Xuan, and Xiaoniu Yang. 2020. Open dnn box by power side-channel attack.IEEE Transactions on Circuits and Systems II: Express Briefs67, 11 (2020), 2717–2721

    2020

  109. [119]

    Xiao Shaun Wang, Kartik Nayak, Chang Liu, TH Hubert Chan, Elaine Shi, Emil Stefanov, and Yan Huang. 2014. Oblivious data structures. InProceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security. 215–226

    2014

  110. [120]

    Xilinx. 2025. XRT Host Memory (HM) Documentation. https://xilinx.github.io/ XRT/master/html/hm.html Accessed: March 11, 2025

    2025

  111. [121]

    Min Xu, Antonis Papadimitriou, Andreas Haeberlen, and Ariel Feldman. 2019. Hermetic: Privacy-preserving distributed analytics without (most) side channels. External Links: Link Cited by(2019)

    2019

  112. [122]

    Andrew Chi-Chih Yao. 1986. How to generate and exchange secrets. In27th annual symposium on foundations of computer science (Sfcs 1986). IEEE, 162–167

    1986

  113. [123]

    2024.Host Memory Access (HM)

    Xilinx. 2024.Host Memory Access (HM). Xilinx. https://xilinx.github.io/XRT/ master/html/hm.html Accessed: March 2025

    2024

  114. [124]

    Haojie Ye, Yuchen Xia, Yuhan Chen, Kuan-Yu Chen, Yichao Yuan, Shuwen Deng, Baris Kasikci, Trevor Mudge, and Nishil Talati. 2025. Palermo: Improving the Performance of Oblivious Memory using Protocol-Hardware Co-Design. In 2025 IEEE International Symposium on High Performance C...

    2025

  115. [125]

    Junghwan Yoon, Yezee Seo, Jaedong Jang, Mingi Cho, JinGoog Kim, HyeonSook Kim, and Taekyoung Kwon. 2018. A bitstream reverse engineering tool for FPGA hardware trojan detection. InProceedings of the 2018 ACM SIGSAC conference on computer and communications security. 2318–2320

    2018

  116. [126]

    Kota Yoshida, Mitsuru Shiozaki, Shunsuke Okura, Takaya Kubota, and Takeshi Fujino. 2021. Model reverse-engineering attack against systolic-array-based dnn accelerator using correlation power analysis.IEICE Transactions on Fun- damentals of Electronics, Communications and Compu...

    2021

  117. [127]

    2014.{FLUSH+ RELOAD}: A high resolution, low noise, l3 cache{Side-Channel} attack

    Yuval Yarom and Katrina Falkner. 2014.{FLUSH+ RELOAD}: A high resolution, low noise, l3 cache{Side-Channel} attack. In23rd USENIX security symposium (USENIX security 14). 719–732. CCS ’25, October 13–17, 2025, Taipei, Taiwan. Guo et al

    2014

  118. [128]

    Mark Zhao, Mingyu Gao, and Christos Kozyrakis. 2022. Shef: Shielded enclaves for cloud fpgas. InProceedings of the 27th ACM International Conference on Architectural Support for Programming Languages and Operating Systems. 1070– 1085

    2022

  119. [129]

    Mark Zhao and G Edward Suh. 2018. FPGA-based remote power side-channel attacks. In2018 IEEE symposium on security and privacy (SP). IEEE, 229–244

    2018

  120. [130]

    Leqian Zheng, Zheng Zhang, Wentao Dong, Yao Zhang, Ye Wu, and Cong Wang

  121. [131]

    Tao Zhang, Jian Wang, Shize Guo, and Zhe Chen. 2019. A comprehensive FPGA reverse engineering tool-chain: From bitstream to RTL code.IEEE Access7 (2019), 38379–38389

    2019

  122. [136]

    load key

    Pengfei Zuo, Yu Hua, Ling Liang, Xinfeng Xie, Xing Hu, and Yuan Xie. 2020. Sealing neural network models in secure deep learning accelerators.arXiv preprint arXiv:2008.03752(2020). A Evaluation continued A.1 Testbed and Prototype We provide additional information about our tes...

    2020 arXiv

  123. [2020]

    In29th USENIX Security Symposium (USENIX Security 20)

    An{Off-Chip} attack on hardware enclaves via the memory bus. In29th USENIX Security Symposium (USENIX Security 20)

  124. [2021]

    Efficient oblivious query processing for range and knn queries.IEEE Transactions on Knowledge and Data Engineering34, 12 (2021), 5741–5754

    2021

  125. [2022]

    InCryptographers’ Track at the RSA Conference

    Side-channeling the Kalyna key expansion. InCryptographers’ Track at the RSA Conference. Springer, 272–296

  126. [2024]

    H _2O _2RAM: A High-Performance Hierarchical Doubly Oblivious RAM.arXiv preprint arXiv:2409.07167(2024)

    2024 arXiv

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.