ANTMAN: An Efficient and Interpretable RTL-Level Run-Time Detection Framework for Stealthy Branch Predictor Attacks on BOOM
2026-08-10 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors focus on detecting sneaky attacks in RISC-V processors that exploit branch predictors, which are parts of the CPU that guess the next instruction to execute. These attacks are hard to spot because they avoid usual detection methods and use internal history tables. The authors create a new hardware-based method that monitors rules learned beforehand to catch these attacks as they happen, without slowing down the processor or causing false alarms. Their solution works well with different types of branch predictors and can even detect new variants of these attacks.
RISC-Vbranch predictorside channel attackhardware performance countersruntime detectionBOOM processorNext-Line PredictorTAGE predictorRTL-level designassociation rules
Authors
Muhammad Hassan, Maria Mushtaq, Jaan Raik, Tara Ghasempouri
Abstract
Runtime detection of microarchitectural side channel attacks remains significantly underexplored in RISCV compared with x86 and ARM ISAs, posing a serious threat to critical applications. State-of-the-art branch predictor attacks bypass traditional data and instruction caches by directly exploiting the state of internal history tables, making them inherently stealthy. Recent research has explored offline detection of microarchitectural attacks on RISC-V; however, efficient runtime detection of microarchitectural attacks on RISC-V hardware remains significantly unaddressed. State-of-the-art hardware-based runtime detection solutions leverage hardware performance counters (HPCs) but suffer from a restricted set of counter registers and tradeoffs between detection accuracy, detection speed, and sampling granularity, making them impractical for stealthy attacks. Moreover, sampling HPCs after distinct intervals leaves intermediate relationships between different microarchitectural blocks unobserved. Additionally, proprietary x86 and ARM ISAs constrain researchers from modifying processor microarchitectural designs. To address these limitations, we propose the first secure-by-design, highly interpretable, non-intrusive, RTL-level runtime detection solution for stealthy branch predictor attacks on BOOM RISC-V, evaluated under both simplified Next-Line Predictor (NLP) and complex TAGE predictor configurations. The attack detection relies on association rules extracted offline and embedded in hardware as a non-intrusive rule monitor that enables runtime detection. The proposed approach achieves excellent detection speed, terminates execution before secret disclosure, and produces zero false positives while remaining flexible for detecting previously unseen variants within the same family of branch predictor attacks.