More Like this

1. Hierarchical EMFI Analysis on a RISC-V SoC

   Shanmugam, Dillibabu; Liu, Zhenyuan; Schaumont, Patrick (May 2026, IEEE)

   Electromagnetic fault injection (EMFI) induces transient faults in SoCs, yet limited hardware observability impedes root-cause analysis. We present a scan-chain-assisted EMFI framework on CAPRI1, a custom RISC-V SoC whose 12 756 scan-accessible flip-flops provide cycle-resolved, bit-level visibility after each injection on fabricated silicon. Unlike simulation based fault injection with predetermined fault models, post silicon scan capture reveals actual physical fault manifestations, including spatially correlated multi-bit upsets and PDN-mediated coupling effects. We apply hierarchical fault analysis to two PIN verification firmware workloads, tracing fault propagation from initial bit-flips through microarchitectural blocks to software level outcomes. A direction-aware PDN loop coupling model predicts EMFI-susceptible die regions from pre-silicon layout data; the predicted map aligns with scan-localized first-flip clustering (70.6% within the top-20% predicted region, 𝑝 < 10−5), establishing a pre-silicon-to-post-silicon vulnerability assessment workflow. 

   more » « less
2. GlitchGlück: Enabling Software Vulnerabilities through Guided Hardware Fault Injection

   Liu, Zhenyuan; Shanmugam, Dillibabu; Schaumont, Patrick (August 2025, USENIX Association)

   While many software vulnerabilities are blamed on software bugs, they can also be caused by hardware fault injection. Traditional fault injection methods rely on blind attacks based on simplified fault models, such as instruction skipping. These attacks require exhaustive experimentation across a wide range of fault parameters, with the methodology inferred solely from faulty outcomes, resulting in limited insight into fault impact and an overall inefficient approach. We present GLITCHGLÜCK, a novel approach that combines a tool for simulating hardware-software interactions with a methodology for guiding fault injection. The tool observes the system via scan-chain-accessible states and constructs the Dynamic State Transition Graph (DSTG), a temporal representation of how software instructions trigger interactions with hardware components. By analyzing the DSTG, GLITCHGLÜCK pinpoints fault injection parameters – such as when, where, and what to fault without relying on predefined fault models – thus avoiding the need for an exhaustive fault parameter search. This targeted, data-driven method bridges the gap between simulation and physical fault observation by using scan-chain. GLITCHGLÜCK is demonstrated on a physical OpenMSP430 ASIC chip with scan-chain support, and validated in simulation on PicoRV32 (RV32I) and IBEX (RV32IM) to confirm its applicability across different instruction set architectures and microarchitectures. We assess the effectiveness of several software countermeasures, such as instruction duplication and pin verification, using layout-aware fault simulations to guide fault attacks via clock glitching and laser-induced faults. 

   more » « less
3. $$\mu $$ Scan: Deep Learning Detection of Faulty Micro-architecture States and Patterns from Scan-Chain Data

   https://doi.org/10.1007/978-3-032-01799-4_8  

   Shanmugam, Dillibabu; Liu, Zhenyuan; Malnicof, Andrew; Schaumont, Patrick (October 2025, Springer Nature Switzerland)

   Hardware Fault injection can leave processors in weird micro-architecture states that evade detection by conventional software-level monitors, jeopardizing system reliability. We propose μScan, a deep learning framework that leverages scan-chain observability to detect such anomalous states. μScan fine-tunes a large language model (LLM) to clas-sify single-cycle processor states as weird or sane, achieving an average clas-sification accuracy of 92% and maintaining robust performance across dif-ferent CPU architectures (MSP430, PICO (RV32IC), IBEX (RV32IMC)). We further refine this LLM classifier with reinforcement learning, which sharpens its decision boundaries and improves detection of borderline anomalies. μScan also employs a graph neural network (GNN) to ana-lyze multi-cycle fault patterns, capturing complex temporal dependencies that single-cycle analysis might miss. This GNN-based analysis success-fully identifies recurring fault sequences and maps them to known Common Weakness Enumeration (CWE) vulnerability classes, revealing potential hardware design flaws. μScan demonstrates scalability and generalization on multiple processor architectures (including micro-coded and pipelined cores) and is evaluated with both pre-silicon simulation data and a post-silicon prototype. Our results show that μScan enables early detection of micro-architecture vulnerabilities in the design phase and provides a robust post-silicon anomaly detection mechanism. 

   more » « less
4. Analyzing the Fault Injection Sensitivity of Secure Embedded Software

   https://doi.org/10.1145/3063311  

   Yuce, Bilgiday; Ghalaty, Nahid Farhady; Deshpande, Chinmay; Santapuri, Harika; Patrick, Conor; Nazhandali, Leyla; Schaumont, Patrick (November 2017, ACM Transactions on Embedded Computing Systems)

   Fault attacks on cryptographic software use faulty ciphertext to reverse engineer the secret encryption key. Although modern fault analysis algorithms are quite efficient, their practical implementation is complicated because of the uncertainty that comes with the fault injection process. First, the intended fault effect may not match the actual fault obtained after fault injection. Second, the logic target of the fault attack, the cryptographic software, is above the abstraction level of physical faults. The resulting uncertainty with respect to the fault effects in the software may degrade the efficiency of the fault attack, resulting in many more trial fault injections than the amount predicted by the theoretical fault attack. In this contribution, we highlight the important role played by the processor microarchitecture in the development of a fault attack. We introduce the microprocessor fault sensitivity model to systematically capture the fault response of a microprocessor pipeline. We also propose Microarchitecture-Aware Fault Injection Attack (MAFIA). MAFIA uses the fault sensitivity model to guide the fault injection and to predict the fault response. We describe two applications for MAFIA. First, we demonstrate a biased fault attack on an unprotected Advanced Encryption Standard (AES) software program executing on a seven-stage pipelined Reduced Instruction Set Computer (RISC) processor. The use of the microprocessor fault sensitivity model to guide the attack leads to an order of magnitude fewer fault injections compared to a traditional, blind fault injection method. Second, MAFIA can be used to break known software countermeasures against fault injection. We demonstrate this by systematically breaking a collection of state-of-the-art software fault countermeasures. These two examples lead to the key conclusion of this work, namely that software fault attacks become much more harmful and effective when an appropriate microprocessor fault sensitivity model is used. This, in turn, highlights the need for better fault countermeasures for software. 

   more » « less
5. Pre-Silicon Hierarchical Root-Cause Analysis of Side-Channel and Fault Vulnerabilities in System-on-Chip Designs

   Liu, Zhenyuan (December 2025, Worcester Polytechnic Institute ETD)

   The growing complexity of modern System-on-Chip (SoC) designs has made analyzing security vulnerabilities, such as side-channel leakage and fault effects, increasingly challenging. Traditionally, vulnerability assessment is performed only after design fabrication. This post-silicon black-box approach provides limited insight into design details, identifying weaknesses without explaining their root causes and resulting in both challenging countermeasure design and costly refabrication. This dissertation argues that vulnerability assessment can be supported to an earlier (pre-silicon) stage, where full access to the internal design enables root-cause analysis and allows the development of more effective mitigations. The key lies in the hierarchical evaluation of vulnerabilities, which bridges software and hardware layers to capture how weaknesses propagate through the design hierarchy. We propose two primary contributions. First, sidechannel leakage can be addressed through a top-down analysis that traces how sensitive, software-defined asset (e.g., cryptographic key or nonce) influence lower hardware layers, enabling early detection and mitigation of leakage sources. Second, fault effects can be examined through a bottom-up analysis that tracks how hardware disturbances propagate to software outputs, revealing critical fault paths and guiding the design of effective mitigation. 

   more » « less