WarpGuard: Towards Control-Flow Attestation for Heterogeneous CPU-GPU Execution

2026-07-15

AI Summary

This work addresses the lack of effective defenses against control-flow attacks in CPU-GPU heterogeneous systems, particularly within GPU kernels and across device interaction boundaries. To this end, we propose WarpGuard—the first composite control-flow integrity framework tailored for such systems. WarpGuard constructs and tracks a unified CPU-GPU control-flow graph via software instrumentation, enabling runtime control-flow attestation for GPU kernels for the first time. It also introduces a call-site policy to detect cross-boundary violations without requiring specialized hardware or binary modifications. Evaluation on an NVIDIA Jetson Orin Nano demonstrates that WarpGuard effectively captures both GPU-local and cross-device attacks, incurring only moderate performance overhead under real-world workloads such as TensorRT.

Abstract

Heterogeneous CPU-GPU workloads are increasingly used in safety-critical embedded systems, yet no existing approach provides joint attestation of their execution. Prior Control-Flow Attestation (CFA) techniques focus on CPU-side CFA, while GPU attestation is limited to static, load-time verification and does not provide runtime guarantees. As a result, runtime attacks on GPU kernels and violations of the CPU-GPU interaction contract remain unaddressed. We present WarpGuard, the first composite CFA framework for heterogeneous CPU-GPU workloads. WarpGuard verifies execution against a unified control-flow graph (CFG) that captures both CPU and GPU components. It extends prior CFA techniques in two ways: it enables runtime CFA of GPU kernels by tracing their execution against kernel-specific CFGs, and it monitors kernel launch events and enforces per-call site policies to detect violations at the CPU-GPU boundary. These extensions address challenges arising from GPU parallelism and cross-device interactions. We implement WarpGuard using software-based instrumentation, requiring no specialized hardware or binary modifications. Our evaluation on an NVIDIA Jetson Orin Nano shows that WarpGuard detects GPU-side control-flow and cross-boundary attacks. Across microbenchmarks, SPECAccel, and eight TensorRT inference workloads, WarpGuard incurs moderate overheads, suggesting practicality for embedded safety-critical settings.

Problem

• Control-Flow Attestation
• CPU-GPU Heterogeneity
• Runtime Security
• Embedded Systems
• Warp Execution

Innovation

• Control-Flow Attestation
• CPU-GPU Heterogeneity
• Runtime GPU Verification
• Cross-Device Security
• Software Instrumentation