FAARM: Firmware Attestation and Authentication Framework for Mali GPUs

• URL: http://arxiv.org/abs/2510.22566v1
• Date: Sun, 26 Oct 2025 07:46:27 GMT
• Title: FAARM: Firmware Attestation and Authentication Framework for Mali GPUs
• Abstract summary: Recent work has revealed MOLE, the first practical attack to compromise GPU Trusted Execution Environments (TEEs)<n>This paper presents FAARM, a lightweight and cryptographic framework that prevents MOLE-style firmware subversion.<n>FAARM reliably detects and blocks malicious firmware injections, rejecting tampered images before use and denying attempts after attestation.
• Score: 0.463928297802265
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Recent work has revealed MOLE, the first practical attack to compromise GPU Trusted Execution Environments (TEEs), by injecting malicious firmware into the embedded Microcontroller Unit (MCU) of Arm Mali GPUs. By exploiting the absence of cryptographic verification during initialization, adversaries with kernel privileges can bypass memory protections, exfiltrate sensitive data at over 40 MB/s, and tamper with inference results, all with negligible runtime overhead. This attack surface affects commodity mobile SoCs and cloud accelerators, exposing a critical firmware-level trust gap in existing GPU TEE designs. To address this gap, this paper presents FAARM, a lightweight Firmware Attestation and Authentication framework that prevents MOLE-style firmware subversion. FAARM integrates digital signature verification at the EL3 secure monitor using vendor-signed firmware bundles and an on-device public key anchor. At boot, EL3 verifies firmware integrity and authenticity, enforces version checks, and locks the firmware region, eliminating both pre-verification and time-of-check-to-time-of-use (TOCTOU) attack vectors. We implement FAARM as a software-only prototype on a Mali GPU testbed, using a Google Colab-based emulation framework that models the firmware signing process, the EL1 to EL3 load path, and secure memory configuration. FAARM reliably detects and blocks malicious firmware injections, rejecting tampered images before use and denying overwrite attempts after attestation. Firmware verification incurs only 1.34 ms latency on average, demonstrating that strong security can be achieved with negligible overhead. FAARM thus closes a fundamental gap in shim-based GPU TEEs, providing a practical, deployable defense that raises the security baseline for both mobile and cloud GPU deployments.

Related papers

• FIDEM: A Standard-Compliant Framework for Secure Binding of MUD Profiles to IoT Devices [90.91375734523943]
  FIDEM is a standard-compliant framework for securing DHCP-based MUD URL issuance.<n>It provides cryptographic binding between IoT devices and their MUD profiles by leveraging Zero-Knowledge-Proof authentication.
  arXiv  Detail & Related papers  (2026-05-28T09:16:50Z)
• Insecure Despite Proven Updated: Extracting the Root VCEK Seed on EPYC Milan via a Software-Only Attack [4.709588811674974]
  AMD emphasizes the capability to prevent Trusted Computing Base rollback attacks.<n>In this architecture, safeguarding the hardware root seed is the ultimate line of defense.<n>We introduce MilanLaunchy attack, an exploit that achieves code execution on the AMD secure processor.<n>We develop BadFuse attack, which extracts the hardware root seed by exploiting a lack of write restrictions in the fuse controller.
  arXiv  Detail & Related papers  (2026-05-13T04:40:23Z)
• A Multi-Interface Firmware Acquisition and Validation Methodology for Low-Cost Consumer Drones: A Case Study on Three Holy Stone Platforms [0.0]
  This paper presents a study of firmware extraction and validation applied to three Holy Stone consumer drone models: the HSD175, HS720, and360360.<n>Rather than pursuing reverse-cost outcomes, the study focuses on obtaining reliable, ground-truth firmware images using only commercially available low-cost tooling.
  arXiv  Detail & Related papers  (2026-05-11T05:28:38Z)
• LiteAtt: Secure and Seamless IoT Services Using TinyML-based Self-Attestation as a Primitive [8.605599020846485]
  LiteAtt is a verifier-less, hybrid Self-Attestation framework based on TinyML execution in the Arm TrustZone of an IoT MCU.<n>LiteAtt achieves an average accuracy of 98.7%, F1 score of 99.33%, TPR of 98.72%, and TNR of 97.45% on impersonation datasets collected from real devices.
  arXiv  Detail & Related papers  (2026-03-20T08:10:14Z)
• Decentralized Firmware Integrity Verification for Cyber-Physical Systems Using Ethereum Blockchain [0.42970700836450487]
  We propose a decentralized firmware integrity verification framework built on the blockchain.<n>Our system stores SHA-256 hashes of firmware binaries within smart contracts deployed on the Sepolia testnet.<n>A Python-based client tool computes firmware hashes and communicates with the blockchain to register and verify firmware authenticity.
  arXiv  Detail & Related papers  (2026-01-13T00:19:20Z)
• ALERT: Zero-shot LLM Jailbreak Detection via Internal Discrepancy Amplification [47.135407245022115]
  Existing detection methods mainly detect jailbreak status relying on jailbreak templates present in the training data.<n>We propose a layer-wise, module-wise, and token-wise amplification framework that progressively magnifies internal feature discrepancies between benign and jailbreak prompts.<n>Building upon these insights, we introduce ALERT, an efficient and effective zero-shot jailbreak detector.
  arXiv  Detail & Related papers  (2026-01-07T05:30:53Z)
• aLEAKator: HDL Mixed-Domain Simulation for Masked Hardware \& Software Formal Verification [0.0]
  We present aLEAKator, an open-source framework for the automated formal verification of cryptographic accelerators and software running on CPUs.<n>Our method introduces mixed-domain simulation, enabling precise modeling and verification under various (including robust and relaxed) 1-probing leakage models.<n>Our approach is validated against existing tools and real-world measurements while providing innovative results such as the verification of a full, first-order masked AES on various CPUs.
  arXiv  Detail & Related papers  (2025-12-08T12:58:35Z)
• Beyond Model Jailbreak: Systematic Dissection of the "Ten DeadlySins" in Embodied Intelligence [36.972586142931256]
  Embodied AI systems integrate language models with real world sensing, mobility, and cloud connected mobile apps.<n>We conduct the first holistic security analysis of the Unitree Go2 platform.<n>We uncover ten cross layer vulnerabilities the "Ten Sins of Embodied AI Security"
  arXiv  Detail & Related papers  (2025-12-06T10:38:00Z)
• TRUSTCHECKPOINTS: Time Betrays Malware for Unconditional Software Root of Trust [0.0]
  Current approaches to establish a root of trust depend on secret keys and/or specialized secure hardware.<n> TRUSTCHECKPOINTS is the first system to establish an unconditional software root of trust based on a formal model.
  arXiv  Detail & Related papers  (2025-09-26T14:27:48Z)
• LLM Jailbreak Detection for (Almost) Free! [62.466970731998714]
  Large language models (LLMs) enhance security through alignment when widely used, but remain susceptible to jailbreak attacks.<n>Jailbreak detection methods show promise in mitigating jailbreak attacks through the assistance of other models or multiple model inferences.<n>We propose a Free Jailbreak Detection (FJD) which prepends an affirmative instruction to the input and scales the logits by temperature to further distinguish between jailbreak and benign prompts.
  arXiv  Detail & Related papers  (2025-09-18T02:42:52Z)
• Empowering IoT Firmware Secure Update with Customization Rights [15.500229921783257]
  We conduct a pilot study on the update of 200 Linux-based IoT devices across 23 vendors.<n>A broader analysis of update-related CVEs from 2020 to 2024 reveals that over half originate from customization-induced issues.<n>We propose IMUP, the first framework to address two key challenges: constructing a trustworthy cross-module integrity chain and scaling update performance under mass customization.
  arXiv  Detail & Related papers  (2025-07-25T15:17:29Z)
• The Devil behind the mask: An emergent safety vulnerability of Diffusion LLMs [39.85609149662187]
  We present DIJA, the first systematic study and jailbreak attack framework that exploits unique safety weaknesses of dLLMs.<n>Our proposed DIJA constructs adversarial interleaved mask-text prompts that exploit the text generation mechanisms of dLLMs.<n>Our findings underscore the urgent need for rethinking safety alignment in this emerging class of language models.
  arXiv  Detail & Related papers  (2025-07-15T08:44:46Z)
• ARMOR: Aligning Secure and Safe Large Language Models via Meticulous Reasoning [64.32925552574115]
  ARMOR is a large language model that analyzes jailbreak strategies and extracts the core intent.<n> ARMOR achieves state-of-the-art safety performance, with an average harmful rate of 0.002 and an attack success rate of 0.06 against advanced optimization-based jailbreaks.
  arXiv  Detail & Related papers  (2025-07-14T09:05:54Z)
• Attention Slipping: A Mechanistic Understanding of Jailbreak Attacks and Defenses in LLMs [61.916827858666906]
  We reveal a universal phenomenon that occurs during jailbreak attacks: Attention Slipping.<n>We show Attention Slipping is consistent across various jailbreak methods, including gradient-based token replacement, prompt-level template refinement, and in-context learning.<n>We propose Attention Sharpening, a new defense that directly counters Attention Slipping by sharpening the attention score distribution using temperature scaling.
  arXiv  Detail & Related papers  (2025-07-06T12:19:04Z)
• Keep Me Updated: An Empirical Study of Proprietary Vendor Blobs in Android Firmware [2.124303952404961]
  We examine over 13,000 Android firmware releases between January 2018 and April 2024. About 82% of firmware releases contain outdated GPU blobs (up to 1,281 days) A significant number of blobs also rely on obsolete LLVM core libraries released more than 15 years ago.
  arXiv  Detail & Related papers  (2024-10-14T20:36:12Z)
• JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models [123.66104233291065]
  Jailbreak attacks cause large language models (LLMs) to generate harmful, unethical, or otherwise objectionable content. evaluating these attacks presents a number of challenges, which the current collection of benchmarks and evaluation techniques do not adequately address. JailbreakBench is an open-sourced benchmark with the following components.
  arXiv  Detail & Related papers  (2024-03-28T02:44:02Z)
• Tamper-Evident Pairing [55.2480439325792]
  Tamper-Evident Pairing (TEP) is an improvement of the Push-Button configuration (PBC) standard. TEP relies on the Tamper-Evident Announcement (TEA), which guarantees that an adversary can neither tamper a transmitted message without being detected, nor hide the fact that the message has been sent. This paper provides a comprehensive overview of the TEP protocol, including all information needed to understand how it works.
  arXiv  Detail & Related papers  (2023-11-24T18:54:00Z)
• SyzTrust: State-aware Fuzzing on Trusted OS Designed for IoT Devices [67.65883495888258]
  We present SyzTrust, the first state-aware fuzzing framework for vetting the security of resource-limited Trusted OSes. SyzTrust adopts a hardware-assisted framework to enable fuzzing Trusted OSes directly on IoT devices. We evaluate SyzTrust on Trusted OSes from three major vendors: Samsung, Tsinglink Cloud, and Ali Cloud.
  arXiv  Detail & Related papers  (2023-09-26T08:11:38Z)
• DRSM: De-Randomized Smoothing on Malware Classifier Providing Certified Robustness [58.23214712926585]
  We develop a certified defense, DRSM (De-Randomized Smoothed MalConv), by redesigning the de-randomized smoothing technique for the domain of malware detection. Specifically, we propose a window ablation scheme to provably limit the impact of adversarial bytes while maximally preserving local structures of the executables. We are the first to offer certified robustness in the realm of static detection of malware executables.
  arXiv  Detail & Related papers  (2023-03-20T17:25:22Z)
• A Survey of Machine Learning Algorithms for Detecting Malware in IoT Firmware [0.0]
  This paper employs a number of machine learning algorithms to classify IoT firmware and the best performing models are reported. Deep learning approaches including Convolutional and Fully Connected Neural Networks are also explored.
  arXiv  Detail & Related papers  (2021-11-03T17:55:51Z)
• SEDAT:Security Enhanced Device Attestation with TPM2.0 [0.3007949058551534]
  This paper presents SE DAT, a novel methodology for remote attestation of the device via a security enhanced communication channel. SE DAT provides a way for verifier to get on-demand device integrity and authenticity status via a secure channel. It also enables the verifier to detect counterfeit hardware, change in firmware, and software code on the device.
  arXiv  Detail & Related papers  (2021-01-16T03:41:01Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.