Automated Template-free Synthesis of Instruction-Centric Leakage Contracts for Black-Box CPUs

2026-07-16

AI Summary

Modern CPU microarchitectures are highly complex and lack formal security abstractions—specifically, instruction-level side-channel leakage contracts—while manual construction of such contracts is prohibitively costly and heavily reliant on expert knowledge. This work proposes the first fully automated, template-free approach that synthesizes precise, complete, and formally reliable leakage contracts by combining black-box observations with automated reasoning to capture microarchitectural behavioral differences across instruction executions. Evaluated on both x86 and ARM processors, the method successfully generates high-fidelity contracts, achieving the first fully automated black-box synthesis of leakage contracts. This breakthrough overcomes the longstanding bottleneck of manual modeling and demonstrates the feasibility of automatically learning security contracts directly from black-box CPUs.

Abstract

Side-channel attacks pose a significant security threat for modern computing platforms, because they exploit subtle discrepancies in CPU behaviors to leak sensitive information. To model the information leaked by a CPU via microarchitectural side-channels, recent work proposed leakage contracts: an ISA-level security abstraction that provides the foundations for secure CPU programming. Unfortunately, due to the complexity of current microarchitectures, devising a leakage contract for a CPU requires extensive manual effort and thus modern CPUs lack dedicated leakage contracts. We present a methodology to extract instruction-centric leakage contracts for major CPU architectures with minimal manual intervention. We implemented this technique in malcos, the first template-free tool that automates the synthesis of leakage contracts for black-box CPUs. We evaluate malcos on x86 and ARM CPUs, and show that the contracts it synthesizes are precise and sound with respect to all leaks observed during synthesis. Our results demonstrate that learning leakage contracts from black-box CPUs is feasible.

Problem

• side-channel attacks
• leakage contracts
• black-box CPUs
• microarchitectural side-channels
• instruction-centric

Innovation

• leakage contracts
• side-channel attacks
• black-box CPU
• automated synthesis
• instruction-centric