Remote-Timer-as-a-Service: Efficient Microarchitectural Leakage in the Cloud with Remote Timers

• URL: http://arxiv.org/abs/2608.17043v1
• Date: Mon, 17 Aug 2026 18:41:36 GMT
• Title: Remote-Timer-as-a-Service: Efficient Microarchitectural Leakage in the Cloud with Remote Timers
• Abstract summary: We demonstrate a remote Spectre attack that leaks a JWT token from a co-located victim worker in the Cloudflare Workers production environment.<n>We outperform the existing attack by orders of magnitude, going from 2 bit/min to up to 12 bit/s at an accuracy of 99.16%.
• Score: 4.5846880327283595
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Edge computing solutions have become a crucial part of the industry, delivering fast, flexible and scalable applications close to the end users, with typical use cases including dynamic content creation, image resizing and chatbots. Cloudflare Workers is one such framework, which handles millions of HTTP requests per second worldwide. To reduce start-up latency, Cloudflare Workers removes process-isolation boundaries between multiple tenants and leverages language-level isolation. This architecture poses the risk of Spectre attacks. To mitigate these, Cloudflare Workers previously introduced several countermeasures such as restricted timer measurements, no shared memory, no multithreading and Dynamic Process Isolation (DyPrIs), detecting potential attacks and process-isolating potentially malicious scripts. We demonstrate that the production implementation of DyPrIs was insufficient. We adopt microarchitectural amplification techniques and discover various possibilities to measure time in the production environment of Cloudflare Workers. Given these techniques, we show that freezing and coarsening timers in the Cloudflare Workers security model is insufficient. Leveraging both timing amplification and remote timers, we demonstrate a remote Spectre attack that leaks a JWT token from a co-located victim worker in the Cloudflare Workers production environment. We outperform the existing attack by orders of magnitude, going from 2 bit/min to up to 12 bit/s at an accuracy of 99.16%, posing an immediate risk to customer data. Following our end-to-end attack, Cloudflare Workers mitigated it in a coordinated effort by integrating the V8 Sandbox limiting transient access to 64-bit pointers, improving the detection capabilities of DyPrIs, and deploying hardware-assisted MPK-based in-process isolation to confine each tenant heap under a dedicated memory-protection key.

Related papers

• Autonomous Cyber Defense: Real-Time Attack Detection and Mitigation in Software-Defined Networks Using Machine Learning [78.29352305480285]
  In recent intrusions, the interval between initial access and the first lateral movement has been observed to be as short as 27 seconds.<n>This paper presents a closed-loop framework that detects and blocks attacks in software-defined networks without operator involvement.
  arXiv  Detail & Related papers  (2026-08-22T18:38:39Z)
• Speculative Interaction Agents: Building Real-Time Agents with Asynchronous I/O and Speculative Tool Calling [64.40340291543971]
  We propose Speculative Interaction Agents to enable real-time interaction with small edge-scale models.<n>We also present a clock-based training methodology that adapts the model to handle streaming inputs and asynchronous responses.<n>This approach provides 1.6-2.2$times$ speedups with the Qwen2.5-3B-Instruct and Llama-3.2-3B-Instruct models across multiple tool calling benchmarks.
  arXiv  Detail & Related papers  (2026-05-13T11:20:52Z)
• LightSplit: Practical Privacy-Preserving Split Learning via Orthogonal Projections [54.51153206716027]
  Split learning (SL) enables collaborative training by partitioning a neural network across clients and a central server.<n>We propose LightSplit, which limits information exposure and reduces communication overhead by applying a lightweight fixed random projection at the cut layer.<n>Our results show that the method retains more than 95% of the baseline accuracy at up to 32x reduction in transmitted dimensionality.
  arXiv  Detail & Related papers  (2026-05-13T09:45:49Z)
• AgentStop: Terminating Local AI Agents Early to Save Energy in Consumer Devices [9.357681245846898]
  Large language models (LLMs) are increasingly used to automate complex, multi-step tasks.<n>Remote, cloud-based agents raise privacy concerns, depend on network connectivity, and incur recurring API costs.<n>We introduce AgentStop, a lightweight efficiency supervisor that predicts and preemptively terminates trajectories unlikely to succeed.
  arXiv  Detail & Related papers  (2026-05-01T14:45:37Z)
• Speculative Policy Orchestration: A Latency-Resilient Framework for Cloud-Robotic Manipulation [6.709418204725671]
  Cloud robotics enables robots to offload high-dimensional motion planning and reasoning to remote servers.<n>For continuous manipulation tasks requiring high-frequency control, network latency and jitter can severely destabilize the system.<n>We propose Speculative Policy Orchestration (SPO), a latency-resilient cloud-edge framework.
  arXiv  Detail & Related papers  (2026-03-19T19:24:14Z)
• Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injections [57.64370755825839]
  Self-evolving agents update their internal state across sessions, often by writing and reusing long-term memory.<n>We study this risk and formalize a persistent attack we call a Zombie Agent.<n>We present a black-box attack framework that uses only indirect exposure through attacker-controlled web content.
  arXiv  Detail & Related papers  (2026-02-17T15:28:24Z)
• CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents [60.98294016925157]
  AI agents are vulnerable to prompt injection attacks, where malicious content hijacks agent behavior to steal credentials or cause financial loss.<n>We introduce Single-Shot Planning for CUAs, where a trusted planner generates a complete execution graph with conditional branches before any observation of potentially malicious content.<n>Although this architectural isolation successfully prevents instruction injections, we show that additional measures are needed to prevent Branch Steering attacks.
  arXiv  Detail & Related papers  (2026-01-14T23:06:35Z)
• One-Shot Secure Aggregation: A Hybrid Cryptographic Protocol for Private Federated Learning in IoT [0.0]
  Hyb-Agg is a lightweight and communication-efficient secure aggregation protocol.<n>It integrates Multi-Key CKKS (MK-CKKS) homomorphic encryption with Elliptic Curve Diffie-Hellman (ECDH)-based additive masking.<n>We implement and evaluate Hyb-Agg on both high-performance and resource-constrained devices, including a Raspberry Pi 4.
  arXiv  Detail & Related papers  (2025-11-28T15:01:26Z)
• ObCLIP: Oblivious CLoud-Device Hybrid Image Generation with Privacy Preservation [9.081441952478306]
  ObCLIP is a plug-and-play safeguard for oblivious cloud-device hybrid generation.<n>It provides rigorous privacy and comparable utility to cloud models with slightly increased server cost.
  arXiv  Detail & Related papers  (2025-10-05T11:09:10Z)
• ZORRO: Zero-Knowledge Robustness and Privacy for Split Learning (Full Version) [58.595691399741646]
  Split Learning (SL) is a distributed learning approach that enables resource-constrained clients to collaboratively train deep neural networks (DNNs)<n>This setup enables SL to leverage server capacities without sharing data, making it highly effective in resource-constrained environments dealing with sensitive data.<n>We present ZORRO, a private, verifiable, and robust SL defense scheme.
  arXiv  Detail & Related papers  (2025-09-11T18:44:09Z)
• Fast and Cost-effective Speculative Edge-Cloud Decoding with Early Exits [11.398891065175686]
  Large Language Models (LLMs) enable various applications on edge devices such as smartphones, wearables, and embodied robots.<n>LLMs can be deployed on-device, offering a cost-effective solution with reduced latency and improved privacy.<n>We propose a fast and cost-effective speculative edge-cloud decoding framework with a large target model on the server and a small draft model on the device.
  arXiv  Detail & Related papers  (2025-05-27T14:55:16Z)
• Overload: Latency Attacks on Object Detection for Edge Devices [47.9744734181236]
  This paper investigates latency attacks on deep learning applications. Unlike common adversarial attacks for misclassification, the goal of latency attacks is to increase the inference time. We use object detection to demonstrate how such kind of attacks work.
  arXiv  Detail & Related papers  (2023-04-11T17:24:31Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.