GlitchLab: A Hardware-in-the-Loop Optimizer for Physical Fault Injection

2026-08-31

AI Summary

为解决物理故障注入中有效故障难以发现的问题，GlitchLab平台通过硬件在线优化和强化学习方法提高了故障搜索效率。

Abstract

Physical fault injection can turn brief hardware disturbances into security failures such as key recovery, authentication bypass, and unintended control flow. Finding effective faults is difficult because many interacting parameters create a large search space, successful settings are sparse and target-dependent, and each hardware attempt provides limited feedback. Under fixed testing time, efficient search is therefore critical for assessing fault sensitivity. We present GlitchLab, an online hardware-in-the-loop platform that treats delay as a timing gate, voltage and pulse duration as severity controls, and hardware outcomes as structured feedback. It implements RL-Q (Q-learning-based reinforcement learning), a structured bandit for discovery, and Structured-Outcome-Based Adaptive Search (SOBAS), a model-based policy for fault reproduction. Both policies find a target fault in every AES, password, and control-flow campaign. On AES and control flow, they require 2-85x fewer attempts and 26-1,237x less time than the baselines; on password, both succeed while the baselines fail within 5,000 attempts. After discovery, SOBAS reproduces faults 7.3-21x more often, while RL-Q identifies 30% more distinct AES settings.

Problem

• Physical Fault Injection
• Security Failures
• Large Search Space
• Hardware Feedback
• Efficient Search

Innovation

• hardware-in-the-loop
• reinforcement learning
• structured bandit
• adaptive search
• fault injection