{"id":"fea86baf-6864-464c-a1e7-857c154a02b0","arxiv_id":"1908.05012","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Power traces from an embedded device can be converted into code-coverage-like scores, enabling feedback for fuzzing without instrumenting the firmware.","lead":"This paper shows that the power a microcontroller uses while running code can reveal which parts of the code were executed, from which the authors compute scores similar to code coverage. If it works broadly, security testers could fuzz embedded devices that lack an operating system and cannot be instrumented.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 0.95 correlation is computed on cumulative coverage scores; for fuzzing, the per-input novelty decision is what matters, and a cumulative metric can remain high even when per-input increments are poorly predicted.","rationale":"I read the paper's central claim as narrow and plausible: power traces can provide per-input coverage-like feedback for fuzzing on OS-less embedded devices. The strongest evidence is Table 2, but the evaluation metric is mismatched to the use case. Because scores are cumulative counts of newly seen transitions, high correlation between calculated and theoretical cumulative traces can occur even when many per-input novelty decisions are wrong. This is not a question of hardware noise or reproducibility; it is an analytical gap in the argument as written. The reader's weakest assumption (branch detection and trace segmentation) is real and upstream, but the paper already reports degraded branch-detection MCC (0.78) yet claims 0.95 correlation, which suggests the cumulative metric may be masking those errors. My proposed check is a direct, artifact-free reanalysis of the existing result traces. I therefore agree partially with the reader's weakest assumption but believe the more decisive issue is the evaluation metric. The verdict should remain conditional: the idea is plausible and the AES result shows some signal, but the paper should not claim 'sufficient information for a feedback-driven fuzzing loop' without per-input transition-level metrics.","tokens_in":12782,"tokens_out":6600,"duration_ms":69291,"concrete_test":"Recompute the Table 2 evaluation on the first differences of the result traces. For each input, define delta_i = score_i - score_{i-1} for the theoretical and calculated traces, and report (a) Pearson/Spearman correlation between the delta sequences, and (b) precision/recall of the binary event 'delta_i > 0'. If the cumulative r=0.95 collapses to a low increment correlation (e.g., <0.7) or to near-random new-transition detection, the headline claim that power traces provide fuzzing-relevant per-input feedback is not supported by the reported evidence. This check requires only the already-recorded result traces and can be done without rerunning the hardware.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that power traces can estimate coverage scores for fuzzing rests on the Table 2 metric: Pearson correlation between the calculated and theoretical 'result-traces' (Section 4.2). But the score defined in Section 3.3 is cumulative: score_i is the number of newly triggered basic-block transitions seen after input i. Both the theoretical and calculated traces therefore are monotone nondecreasing sequences, and the Pearson correlation between two such sequences can be high even when the per-input decisions about whether a new transition occurred are mostly wrong. For coverage-guided fuzzing, the useful feedback is the increment at each input (or equivalently the binary 'is there a new transition?'), not the cumulative count. The paper does not report correlation on first differences, nor precision/recall of new-transition events; the 'crucial errors' metric only counts one kind of miss (score 0 when a new transition exists) and ignores false positives and wrong magnitudes. Thus the strongest quantitative evidence (r=0.95) may substantially overstate the quality of the feedback signal. The AES experiment (Section 4.6) does not rescue this: AES has no input-dependent branches, so the 38/41 detected transitions are a static characterization, not evidence of input-dependent coverage feedback.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a novel fuzzing feedback mechanism for OS-less embedded devices: instead of relying on instrumentation or an OS, it measures the device's power consumption while it processes each input, extracts features from the power traces, reconstructs the control flow at the basic-block level, and computes a coverage score analogous to AFL's basic-block-transition score. The approach is evaluated on an ARM Cortex-M4 running synthetic decision-stage code and a lightweight AES implementation. The authors report a maximum correlation of 0.95 between calculated and theoretical score traces, and detection of 38 out of 41 unique basic-block transitions in the AES implementation, concluding that the power side-channel carries information relevant for fuzzing.","tokens_in":12958,"tokens_out":3009,"duration_ms":32712,"significance":"If substantiated, the proposal would be a meaningful step toward coverage-guided fuzzing of embedded devices without source code or instrumentation, an area where black-box fuzzing dominates. The paper's contribution is primarily conceptual and methodological: it connects side-channel analysis with fuzzing feedback and provides a test environment and metrics that could serve as a baseline for future work. The core result is not circular: the machine-learning classifiers are trained on separately recorded labeled traces and the computed scores are compared to independently computed theoretical scores. However, the evaluation currently does not establish that the feedback signal is useful for the per-input decisions that coverage-guided fuzzing actually makes, and the real-world experiment on AES is not an input-dependent branch scenario.","major_comments":[{"comment":"The primary quantitative claim (maximum correlation 0.95) is based on Pearson correlation between cumulative 'result-traces'. As defined in Section 3.3, each score is the cumulative number of newly triggered basic-block transitions after the current input, so both the theoretical and calculated traces are monotone nondecreasing sequences. Two such sequences can be highly correlated even when the per-input increments are predicted poorly. Coverage-guided fuzzing, however, relies on the per-input decision of whether a new transition occurred. Please report correlations on the first differences of the score traces, and the precision/recall (or a confusion matrix) for the binary event 'at least one new transition triggered by this input'. The 'crucial errors' metric only counts false negatives (score 0 when a new transition exists) and ignores false positives and wrong magnitudes, so it does not fully characterize the feedback signal.","section":"Section 3.3 and Table 2"},{"comment":"The AES experiment does not demonstrate input-dependent feedback, because the paper states that the AES implementation performs no input-dependent branches. Over 100 encryption runs with random plaintexts, the same sequence of basic-block transitions is executed each time; detecting 38 of 41 transitions is therefore a static characterization of the control flow, not evidence that power traces can distinguish whether a particular input reaches new code. To support the central claim that side-channel feedback is useful for fuzzing, an experiment on code with input-dependent branch behavior is needed, or the paper should explicitly restrict its real-world claim to static control-flow recovery.","section":"Section 4.6"},{"comment":"The evaluation uses a single batch of 100 random inputs, and Table 2 reports point estimates of MSE, correlation, and crucial errors without variance across repeated batches, random seeds, or different input distributions. The differences between preprocessing and reconstruction variants are small and may not be statistically meaningful. Please report the number of runs and confidence intervals, and at minimum state whether the 0.95 maximum correlation is stable across multiple independent batches.","section":"Section 4.4 and Table 2"},{"comment":"The claim in Section 4.7 that 'we suffer no limitations regarding transferability to other RISC-based target devices' is not supported by the presented evidence, which comes from a single DUT. Moreover, the training procedure in Section 3.1 requires an identical and programmable target device, so the cross-device transfer question is non-trivial. This statement should be softened to a conjecture or supported by experiments on at least a second device and a different firmware.","section":"Section 4.7"}],"minor_comments":[{"comment":"There is a typo: 'we payed attention' should be 'we paid attention'.","section":"Section 4.7"},{"comment":"The synthetic evaluation code is described as having 48 basic blocks and 60 possible transitions per version, with five versions totaling 300 transitions, but the paper does not report how many of these transitions are actually triggered by the 100 random inputs. A histogram of theoretical scores would make the interpretation of the crucial-errors and correlation metrics much clearer.","section":"Section 4.1"},{"comment":"The table layout with gray and white shading for majority versus non-majority vote, and the grouping of metrics, is hard to read; a separate table for each metric, or explicit row labels, would improve clarity.","section":"Table 2"},{"comment":"The number of free parameters in the pipeline (window size, peak-detection thresholds, MSE threshold, kNN k) is quite large, and the paper does not discuss sensitivity of the final scores to these parameters. A brief robustness discussion or a sensitivity analysis would strengthen the practical applicability of the method.","section":"Section 3.1"}],"recommendation":"major_revision","confidential_remarks":"The paper is within scope for a security or software-testing venue and the core idea is worth pursuing. My main concern is that the evaluation metric currently used to justify the headline result can inflate the apparent quality of the feedback signal; the first-difference analysis and a more honest treatment of the AES experiment should be addressed before the paper is accepted. I would not support rejection because the central claim is testable and the presented evidence, while incomplete, does not contradict the possibility that the approach works."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe one thing to know: this is a real novelty. Power traces as feedback for coverage-guided fuzzing on OS-less embedded devices is a new idea, and the paper shows a plausible proof of concept on an ARM Cortex-M4. The central claim — that the power side-channel carries fuzzing-relevant information — is supported about as well as a first demonstration can be. But this is feedback extraction, not a closed fuzzing loop, and the evaluation has gaps that matter.\n\nWhat's new: prior side-channel work (Callan, Han, van Aubel) targeted profiling or intrusion detection, not fuzzing. This paper's twist is to compute AFL-like per-input coverage scores from power traces, and the synthetic testbed with known theoretical scores is a useful step. The two CFG reconstruction routes (branch-distance and basic-block-fingerprint) are sensibly designed, and the preprocessing comparison (mean/sweep/majority vote) is a nice practical touch. The related work is well chosen and the authors properly credit the key prior work.\n\nWhere it's soft: no code or data released, so the results aren't independently checkable. No error bars or confidence intervals in Table 2. No baseline comparison (e.g., random input selection or a simpler power-difference heuristic). The AES experiment — 38/41 transitions detected over 100 runs — uses code with no input-dependent branches, so it only demonstrates static block coverage, not input-dependent coverage feedback. And the paper never actually runs a fuzzer; it computes scores in a batch. That's fine, but the title and abstract overstate what was tested.\n\nOne stress-test worry I saw — that the 0.95 correlation is on cumulative scores and therefore trivially high — does not hold up on reading. Section 3.3 defines the score as the number of newly triggered transitions per input, which is an increment, not a cumulative sum. So the correlation is on per-input scores. That said, the paper only reports correlation and \"crucial errors\" (false negatives); it does not report false-positive rate or per-input precision/recall of novelty detection, which is exactly what fuzzing needs.\n\nBottom line: this deserves a serious referee. It's a legitimate first step on a useful problem, and the authors are honest about the limitations. It needs artifacts, error bars, a baseline, and a real fuzzing loop before the claim is fully earned. I'd send it to review with the expectation of significant revision.","headline":"A genuinely new idea — using power side-channel traces as AFL-style coverage feedback for OS-less embedded devices — with a plausible but thin proof of concept that needs a stronger evaluation before the fuzzing claim is fully earned.","tokens_in":13560,"tokens_out":4302,"would_cite":true,"duration_ms":41503,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Power traces alone can feed fuzzing on OS-less embedded chips.","keywords":["side-channel analysis","fuzzing","embedded systems security","power traces","control flow reconstruction","code coverage","branch detection","machine learning"],"falsifier":"Rerun the same STM32F417 test software with the CPU clock set to a different frequency, such as 72 MHz instead of 84 MHz, feeding the original trained branch-detection and distance models without retraining. If the correlation between computed and true coverage scores drops well below 0.95 or the branch-detection MCC collapses, the fixed-window alignment and the transferability of the supervised models are load-bearing.","tokens_in":12502,"feed_emoji":"?","tokens_out":6558,"duration_ms":64936,"temperature":0.7,"pith_summary":"Embedded devices without an operating system cannot easily report which code paths an input exercised, so fuzzers run blind. This paper claims that the power consumption of the chip itself can replace that missing feedback: by watching power traces while inputs are processed, a machine-learning pipeline can detect branch instructions, reconstruct the control-flow graph, and assign each input a coverage score proportional to the number of newly executed basic-block transitions. The authors build a proof of concept on an ARM Cortex-M4, fuzzing synthetic decision-stage software and an AES implementation, and report a maximum correlation of 0.95 between their calculated scores and the true coverage scores. If the claim holds, fuzzing of OS-less embedded firmware no longer has to be purely black-box, because the device's own power draw supplies the coverage signal.","feed_headline":"Power traces alone can steer fuzzing on OS-less chips","feed_subtitle":"Branch detection on power traces reconstructs control flow; scores match true coverage up to 0.95.","key_machinery":"The load-bearing mechanism is a three-stage pipeline on measured power traces. In stage one, each trace is split into fixed windows aligned to potential branch-instruction starts; a binary classifier (k-nearest neighbours, k=3) decides which windows contain a branch instruction, and a second supervised model estimates the branch's skip distance. Stage two reconstructs the control flow by one of two routes: CFG-RI stacks for each branch a two-dimensional vector of the branch's code offset and the length of the following basic block, while CFG-RII fingerprints each basic block from four features of its trace slice—length, number of peaks, mean, and skewness. Stage three converts the reconstructed transition sequence into a score by counting how many neighbouring basic-block pairs are new, using the same coverage notion as the fuzzer whose metric the paper adopts. The CFG-RI route is precise but propagates errors from a single misclassified distance; CFG-RII is more robust but can suffer fingerprint collisions.","core_discovery":"The central discovery, on the paper's own terms, is that the power side-channel of an embedded processor carries enough information to drive a feedback-based fuzzing loop. Branch instructions mark the borders between basic blocks, and the paper shows experimentally that these branch moments are detectable in power traces with a k-nearest-neighbour classifier, that the distance a branch skips is also leaked through power, and that either branch-distance vectors or fingerprint vectors of the trace segments between branches suffice to reconstruct the executed control flow. From that reconstruction the paper computes for each input a score equal to the number of newly triggered basic-block transitions, mirroring the coverage metric used by a standard coverage-guided fuzzer. The reported proof of concept achieves a maximum correlation coefficient of 0.95 between the computed result trace and the true coverage trace, and on a lightweight AES implementation it detects on average 38 of 41 unique basic-block transitions across 100 encryption runs.","pith_inferences":["A natural extension the paper leaves implicit is to test the same windowing and kNN approach on 8-bit or 16-bit microcontrollers, where smaller instruction sets might produce even more separable power signatures; this is testable without new theory.","The fixed-window assumption suggests a concrete stress test: introduce clock jitter or an interrupt during measurement. If alignment drifts, both branch detection and distance classification should degrade, and the reported proof-of-concept MCC of 0.78 already leaves headroom for such disturbances.","The reliance on a supervised training phase on an identical programmable device implies each target board needs a training twin; whether the learned branch model transfers across boards of the same model with different electrical noise is an open question the paper's transferability discussion leaves to future work.","The score metric counts new basic-block transitions, not crash detection, and the authors note that fault detection remains unsolved; a next step would be to extend the same power-trace analysis to recognize reboot sequences as crash signals."],"forward_implications":["On OS-less embedded devices, fuzzing feedback can be obtained without instrumentation, recompilation, or an operating system, closing the feedback gap that currently forces black-box fuzzing.","Coverage scores computed from power traces can be handed to a standard coverage-guided fuzzer, which then prioritizes and mutates the promising inputs to close the fuzzing loop.","The branch-distance and fingerprint reconstruction paths give two complementary trade-offs: precise reconstruction with error propagation versus collision-prone but robust fingerprints.","The same pipeline applies to real-world code with input-independent control flow such as AES: the framework recovered 38 of 41 static basic-block transitions over 100 encryption runs.","Noise-averaging preprocessing through mean or sweep traces consistently improves score quality over single traces, so measurement redundancy is part of the method rather than an optional extra."],"supporting_citations":[{"why":"Shows that EM emanations can be used to identify the executed program path, establishing the side-channel-to-control-flow premise this paper adapts to power traces.","marker":"[4]"},{"why":"Demonstrates control-flow identification from electromagnetic emanations, supporting the idea that side-channel information can reveal which code ran.","marker":"[9]"},{"why":"Introduces differential power analysis and establishes that power consumption leaks data-dependent information, the physical basis for branch-distance leakage.","marker":"[12]"},{"why":"Uses k-nearest-neighbour classification of power traces for instruction-level recognition, directly motivating the paper's machine-learning branch detector.","marker":"[17]"},{"why":"Defines the three challenges of fuzzing embedded devices (fault detection, throughput, instrumentation) that motivate the need for a new feedback channel.","marker":"[18]"},{"why":"Reconstructs assembly code from electromagnetic emanations, demonstrating that instruction-level side-channel recognition is feasible and supplies a baseline for branch detection accuracy.","marker":"[24]"},{"why":"Provides the coverage metric of newly executed basic-block transitions that the paper adopts when computing per-input scores.","marker":"[27]"}],"fun_headline_variants":["Power side channels guide fuzzing on OS-less microcontrollers","Fuzzing embedded chips with power-trace feedback","Branch detection from power traces steers embedded fuzzing","Power-leak fuzzing hits 0.95 coverage correlation on ARM","No OS? Power traces still enable coverage-guided fuzzing"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The approach assumes that each branch instruction leaves a separable, learnable signature in the power trace and that the fixed trace windows stay aligned to instruction boundaries; if either fails, neither control-flow reconstruction nor coverage scores can be trusted.","fun_headline_variants_meta":{"raw":{"variants":["Power side channels guide fuzzing on OS-less microcontrollers","Fuzzing embedded chips with power-trace feedback","Branch detection from power traces steers embedded fuzzing","Power-leak fuzzing hits 0.95 coverage correlation on ARM","No OS? Power traces still enable coverage-guided fuzzing"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000287,"raw_usage":{"total_tokens":1696,"prompt_tokens":967,"completion_tokens":729,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":583,"completion_tokens_details":{"reasoning_tokens":643}},"tokens_in":583,"tokens_out":729,"duration_ms":6866,"temperature":1.0,"reasoning_tokens":643,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T13:25:55.542479+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Rerun the same STM32F417 test software with the CPU clock set to a different frequency, such as 72 MHz instead of 84 MHz, feeding the original trained branch-detection and distance models without retraining. If the correlation between computed and true coverage scores drops well below 0.95 or the branch-detection MCC collapses, the fixed-window alignment and the transferability of the supervised models are load-bearing.","supporting_citations":[{"cited_title":"In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communi- cations Security","cited_arxiv_id":null,"evidence_quote":"Demonstrates control-flow identification from electromagnetic emanations, supporting the idea that side-channel information can reveal which code ran."},{"cited_title":"In: Proceedings of the 19th Annual International Cryptology Conference on Advances in Cryptology","cited_arxiv_id":null,"evidence_quote":"Introduces differential power analysis and establishes that power consumption leaks data-dependent information, the physical basis for branch-distance leakage."},{"cited_title":"In: Huang, X., Zhou, J","cited_arxiv_id":null,"evidence_quote":"Uses k-nearest-neighbour classification of power traces for instruction-level recognition, directly motivating the paper's machine-learning branch detector."},{"cited_title":"In: Network and Distributed System Security (NDSS) Symposium","cited_arxiv_id":null,"evidence_quote":"Defines the three challenges of fuzzing embedded devices (fault detection, throughput, instrumentation) that motivate the need for a new feedback channel."},{"cited_title":"In: 2015 Design, Automation Test in Europe Conference Exhibition (DATE)","cited_arxiv_id":null,"evidence_quote":"Reconstructs assembly code from electromagnetic emanations, demonstrating that instruction-level side-channel recognition is feasible and supplies a baseline for branch detection accuracy."},{"cited_title":"http://lcamtuf.coredump.cx/afl/","cited_arxiv_id":null,"evidence_quote":"Provides the coverage metric of newly executed basic-block transitions that the paper adopts when computing per-input scores."}],"review_version":1}