SLAC: Access-Driven CPU-to-GPU Side-channel Attacks via System-Level Cache on Apple Silicon

2026-08-09

AI Summary

This work addresses the cross-domain side-channel risks introduced by the shared system-level cache (SLC) between CPU and GPU in Apple Silicon, where existing techniques struggle to achieve fine-grained, high-precision monitoring without GPU co-residency. The paper presents the first CPU-to-GPU fine-grained access-driven side-channel attack framework that operates without requiring GPU co-location. By reverse-engineering the SLC set-indexing function and cache interaction mechanisms of the M1 chip, the authors devise two novel SLC probing techniques—CPrime+CProbe and GPrime+CProbe—and leverage GPU-accelerated cache filling to significantly boost throughput. Experimental evaluation demonstrates 90% accuracy in edge reconstruction for graph neural networks, 94.8% and 88.9% accuracy in recovering input keywords and responses from large language models, respectively, and a 6.4× increase in covert channel throughput.

Abstract

Modern heterogeneous System-on-Chip designs integrate CPU cores and a GPU that share a last-level cache (LLC) or system-level cache (SLC). This sharing exposes a new cross-domain attack surface, and existing attacks on integrated platforms either exploit coarse-grained cache-occupancy contention or require the adversary to co-reside on the GPU with the victim to obtain accurate timing measurements. In this work, we target Apple Silicon heterogeneous SoCs and discover that GPU memory accesses leave set-level footprints in the shared SLC, observable to an unprivileged CPU process. This keen observation enables the first fine-grained, access-driven, Prime+Probe-style CPU-to-GPU cache side-channel attacks against GPU workloads. We first reverse-engineer the Apple M1 SLC set-indexing functions and the interactions between local private caches and the SLC. Building on these findings, we construct the CPrime+CProbe SLC side-channel technique, which monitors GPU victim activity from the CPU at cache-set granularity. We then introduce an accelerated variant, GPrime+CProbe, in which an adversary leverages the GPU for faster SLC priming, yielding a 6.4x increase in the covert-channel throughput. Lastly, we demonstrate two end-to-end privacy attacks using the new side-channels: a graph-edge reconstruction attack on Graph Neural Networks (GNNs) that achieves 90% edge accuracy across five datasets, and an LLM privacy attack that recovers input keywords with up to 94.8% accuracy and model responses with up to 88.9% accuracy across TinyLlama and GPT-2 Medium models. Our results reveal a new class of microarchitectural vulnerabilities in Apple Silicon and call for secure system cache designs for heterogeneous SoCs.

Problem

• side-channel attack
• system-level cache
• heterogeneous SoC
• GPU privacy
• cache contention

Innovation

• side-channel attack
• system-level cache
• Apple Silicon
• GPU memory access
• Prime+Probe