Compute eXpress Leak: New Cache Attacks Using CXL Devices

DDRop: Active Memory Interposer Attacks on Confidential VMs by Dropping DDR5 Writes

This work presents DDRop, a new primitive that exploits the absence of cryptographic freshness to break the integrity of Intel TDX, Scalable SGX, and AMD SEV-SNP and demonstrates end-to-end attacks on an up-to-date TDX platform.

User Privacy Attacks through Self-Modifying Code Conflicts

This paper systematically analyze a set of x86 instructions that directly or indirectly invalidate instruction cache lines, revealing measurable timing asymmetries between cache hits and misses, and shows that these SMC-induced timing artifacts can be leveraged to mount high-resolution cache attacks that are both steal...

Full Key Recovery of Masked PRESENT on an Out-of-Order RISC-V Processor: A First Reported Case Study

JITterFlip: Uncovering Fault Attack Surfaces in JIT-Compiled LLM Serving

JITterFlip is presented, the first BFA targeting the host-side JIT serving control plane of GPU-based LLM inference, and develops a decision-guided fault-vulnerable code analysis that enables both gibberish output generation and a correct-output sponge attack.

Governing the KV Cache: Preventing Timing Side-Channel Leakage in Multi-Tenant LLM Inference

KVGov, a governance layer addressing all three attack families' prefix-cache paths under one mechanism, is presented, giving an evolutionary stability analysis giving a 31.6% adversary-prevalence tipping point below which global caching remains stable.

Exploiting Software-level Abstractions To Support Practical Hardware Trojan Attacks

Hardware trojan (HT) attacks against CPUs typically assume threat scenarios where an attacker targeting a system with a trojanized CPU is able to execute arbitrary code (i.e. machine-level instructions) to reliably interact with the implanted trojan. On end-user devices (i.e., mobiles, laptops), achieving arbitrary cod...