dfence: Fine-Grained Speculation Barriers for Efficient and Effective Hardware-Software Protection in the Spectre Era (Extended Version)

• URL: http://arxiv.org/abs/2608.06124v1
• Date: Thu, 06 Aug 2026 14:55:00 GMT
• Title: dfence: Fine-Grained Speculation Barriers for Efficient and Effective Hardware-Software Protection in the Spectre Era (Extended Version)
• Abstract summary: We introduce dfence, a new CPU instruction that generalizes Speculative Load Hardening (SLH) to mitigate both Spectre-PHT and Spectre-STL with minimal hardware support.<n>We implement dfence in the Proteus CPU and evaluate its security and performance, demonstrating less than 1% average performance overhead for our benchmarks.
• Score: 15.008218573729335
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Speculative execution attacks such as Spectre-PHT and Spectre-STL remain a critical security concern in modern processors. While software-based mitigations like Speculative Load Hardening (SLH) offer effective protection against Spectre-PHT, they are limited in scope and require software-managed speculative masks, which can be error-prone and costly. Defenses against Spectre-STL, such as the Speculative Store Bypass Disable bit (SSBD), incur additional performance overhead and lack fine-grained control. In this work, we introduce dfence, a new CPU instruction that generalizes SLH to mitigate both Spectre-PHT and Spectre-STL with minimal hardware support. dfence enables developers to annotate sensitive registers, with the hardware ensuring that these values do not leak transiently. We implement dfence in the Proteus CPU and evaluate its security and performance, demonstrating less than 1% average performance overhead for our benchmarks. In addition, to support easy and secure adoption, we design a type system that statically verifies the correct placement of dfence instructions in code.

Related papers

• Boosting Device Utilization in Control Flow Auditing [47.36491265793223]
  Control Flow (CFAud) is a mechanism wherein a remote verifier (Vrf) is guaranteed to received evidence about the control flow path taken on a prover (Prv) MCU, even when Prv software is compromised.<n>Current CFAud requires a busy-wait'' phase where root-of-anchored root-of-RoT in Prv retains execution to ensure delivery of flow evidence to Vrf.<n>CARAMEL is a hardware RoT co-design that enables Prv to resume while control flow evidence is transmitted to Vrf.
  arXiv  Detail & Related papers  (2026-03-02T18:26:17Z)
• SpecIBT: Formally Verified Protection Against Speculative Control-Flow Hijacking [2.684996629761352]
  SpecIBT is a formally verified defense against Spectre BTB, RSB, and PHT.<n>It combines CET-style hardware-assisted control-flow integrity with compiler-inserted speculative load hardening.
  arXiv  Detail & Related papers  (2026-01-30T13:42:43Z)
• Contrastive Spectral Rectification: Test-Time Defense towards Zero-shot Adversarial Robustness of CLIP [68.44229678548298]
  Contrastive Spectral Rectification (CSR) is an efficient test-time defense against adversarial examples.<n>CSR outperforms the SOTA by an average of 18.1% against strong AutoAttack.<n>CSR exhibits broad applicability across diverse visual tasks.
  arXiv  Detail & Related papers  (2026-01-27T05:24:45Z)
• Variable Record Table: A Unified Hardware-Assisted Framework for Runtime Security [0.0]
  This paper presents a Variable Record Table (VRT) with a unified hardware- assisted framework.<n>VRT enforces spatial memory safety against buffer overflows, back-edge control-flow integrity (CFI), and speculative execution attack detection.
  arXiv  Detail & Related papers  (2025-12-14T07:04:49Z)
• Performance and Storage Analysis of CRYSTALS Kyber as a Post Quantum Replacement for RSA and ECC [45.88028371034407]
  CRYSTALS-Kyber is a post-quantum cryptographic solution standardized by NIST in 2022.<n>This study evaluates Kyber's practical viability through performance testing across various implementation schemes.
  arXiv  Detail & Related papers  (2025-08-03T09:53:45Z)
• Detecting Hardware Trojans in Microprocessors via Hardware Error Correction Code-based Modules [49.1574468325115]
  Hardware Trojans (HTs) enable attackers to execute unauthorized software or gain illicit access to privileged operations.<n>This manuscript introduces a hardware-based methodology for detecting runtime HT activations using Error Correction Codes (ECCs) on a RISC-V microprocessor.
  arXiv  Detail & Related papers  (2025-06-18T12:37:14Z)
• Exploiting Inaccurate Branch History in Side-Channel Attacks [54.218160467764086]
  This paper examines how resource sharing and contention affect two widely implemented but underdocumented features: Bias-Free Branch Prediction and Branch History Speculation.<n>We show that these features can inadvertently modify the Branch History Buffer (BHB) update behavior and create new primitives that trigger malicious mis-speculations.<n>We present three novel attack primitives: two Spectre attacks, namely Spectre-BSE and Spectre-BHS, and a cross-privilege control flow side-channel attack called BiasScope.
  arXiv  Detail & Related papers  (2025-06-08T19:46:43Z)
• CoreGuard: Safeguarding Foundational Capabilities of LLMs Against Model Stealing in Edge Deployment [66.72332011814183]
  CoreGuard is a computation- and communication-efficient protection method for proprietary large language models (LLMs) deployed on edge devices.<n> CoreGuard employs an efficient protection protocol to reduce computational overhead and minimize communication overhead via a propagation protocol.
  arXiv  Detail & Related papers  (2024-10-16T08:14:24Z)
• Place Protections at the Right Place: Targeted Hardening for Cryptographic Code against Spectre v1 [14.99532960317865]
  We propose an analysis framework that employs a novel fixpoint algorithm to detect Spectre vulnerabilities and apply targeted hardening.<n>We instantiate the framework as LightSLH, which hardens program with provable security.
  arXiv  Detail & Related papers  (2024-08-29T02:31:28Z)
• Beyond Over-Protection: A Targeted Approach to Spectre Mitigation and Performance Optimization [3.4439829486606737]
  Speculative load hardening in LLVM protects against leaks by tracking the speculation state and masking values during misspeculation. We extend an existing side-channel model validation framework, Scam-V, to check the vulnerability of programs to Spectre-PHT attacks and optimize the protection of programs using the slh approach.
  arXiv  Detail & Related papers  (2023-12-15T13:16:50Z)
• Okapi: Efficiently Safeguarding Speculative Data Accesses in Sandboxed Environments [6.365587458495358]
  Okapi is a new hardware/software cross-layer architecture designed to mitigate Transient Execution Side Channel attacks.<n>At its core, Okapi allows for speculative data accesses to a memory page only after the page has been accessed non-speculatively by the current trust domain.<n>For environments with less stringent security needs, the features can be deactivated to remove all performance overhead.
  arXiv  Detail & Related papers  (2023-12-13T14:10:12Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.