SPOILER-GUARD: Gating Latency Effects of Memory Accesses through Randomized Dependency Prediction

2026-01-29

AI Summary

This work addresses the SPOILER attack, which exploits partial address aliasing to induce incorrect load-store dependencies, triggering speculative retries and timing-channel vulnerabilities through delay amplification. To mitigate this threat, the authors propose a hardware-level defense that dynamically randomizes the physical address bits used for dependency prediction and tags store entries to obfuscate dependency resolution during speculation. Evaluated on the gem5 simulator and validated via 14nm HDL synthesis, the mechanism reduces misprediction rates to 0.0004% on SPEC CPU 2017, while improving integer and floating-point performance by 2.12% and 2.87%, respectively. The design incurs minimal hardware overhead—adding only 69 ps to the critical path, 0.064 mm² in area, and 5.863 mW in power—effectively balancing security and performance.

Technology Category

• Machine Learning: Hardware-aware ML
• Planning, Routing, and Scheduling: Optimization of Spatio-temporal Systems
• Cognitive Modeling & Cognitive Systems: Neural Spike Coding

Application Category

• Security and Privacy: Large-scale security measurements
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Responsible Web: Measurement, analysis, and circumvention of Web censorship

Abstract

Modern microprocessors depend on speculative execution, creating vulnerabilities that enable transient execution attacks. Prior defenses target speculative data leakage but overlook false dependencies from partial address aliasing, where repeated squash and reissue events increase the load-store latency, which is exploited by the SPOILER attack. We present SPOILER-GUARD, a hardware defense that obfuscates speculative dependency resolution by dynamically randomizing the physical address bits used for load-store comparisons and tagging store entries to prevent latency-amplifying misspeculations. Implemented in gem5 and evaluated with SPEC 2017, SPOILER-GUARD reduces misspeculation to 0.0004 percent and improves integer and floating-point performance by 2.12 and 2.87 percent. HDL synthesis with Synopsys Design Compiler at 14 nm node demonstrates minimal overheads - 69 ps latency in critical path, 0.064 square millimeter in area, and 5.863 mW in power.

Problem

• speculative execution
• transient execution attacks
• false dependencies
• partial address aliasing
• SPOILER attack

Innovation

• speculative execution
• transient execution attacks
• dependency prediction
• memory access latency
• hardware defense