{"id":"98db39e2-f6f2-40db-a250-0793884d16a5","arxiv_id":"2501.09665","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"A fully synthesizable, DLL-based clock-pulse-width monitor with an automation framework detects clock glitches and voltage, EM, and temperature timing faults in 65nm silicon.","lead":"This paper reports a small, automatically generated circuit that watches a chip's clock and raises an alarm when an attacker injects timing faults by glitching the clock, power, temperature, or electromagnetic environment. The monitor is built from standard digital cells, so it can be dropped into many chip designs and placed in multiple locations to catch localized attacks.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Detection guarantee requires a coupling between DUT timing margin and replica delay/clock pulse width that the paper only asserts; localized delay attacks and slow tracked drift can bypass without alert.","rationale":"Good-faith reading: the paper makes a strong claim—one all-digital monitor plus compiler can detect all timing FIAs at any process node. It provides genuine silicon: 50 DUTs, frequency lock, measured detection of the 12 synthetic glitch waveforms, voltage pulses, EMI, and fast thermal shocks. That is independent support for the claim that the monitor detects these specific stimuli. My concern is not about the measurements but about the generality step from those stimuli to 'all timing FIA.' The monitor's physical observable is only the phase of a replica delay line relative to the clock; it is not a sensor of DUT path timing. The acceptance window and tracking FSM are designed to ignore slow changes, so the security guarantee requires a quantitative statement about the slowest malicious ramp and the spatial correlation of attacks to replica delay. Neither is provided. The paper even labels a 2 C/min temperature sweep as non-attack; an attacker who controls the sweep rate inherits this blind spot. This is a real soft spot in the central argument, not a disagreement with consensus. The concrete test distinguishes a sanitizable overclaim (revision to a bounded threat model) from a structural flaw. I therefore keep the reader's CONDITIONAL verdict, tied to the added condition that the authors bound the tracking/drift rate and scope claims to non-slow and co-located attacks unless the test shows detection.","tokens_in":18991,"tokens_out":8808,"duration_ms":105356,"concrete_test":"Use the paper's 65nm monitor (or the generated 28nm post-layout netlist) in a mixed STA/SPICE setup with a small register-to-register DUT having, say, 2% setup slack at 100MHz. Drive the clock with a linear frequency ramp whose per-cycle period decrease is below one fine-stage step (6.84ps at 250MHz; scale to 100MHz) so the tracking FSM stays locked, and continue the ramp until the DUT setup slack goes negative. Record the Glitch/RMin/RMax signals at every cycle. If Glitch remains deasserted at the first cycle where the DUT would sample a wrong value, the Section III.E tracking mode is a demonstrable bypass of the abstract's detection claim. If the chip lacks a user DUT, add the same check in post-layout simulation using the monitor netlist and a synthesized critical path.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"Section III.A asserts: 'The only possible way to bypass the monitor is to change the delay of the gates and then match that delay with the pulse width of the clock accordingly. However, since the delay and the clock match in this case, there are no timing violations in the first place.' This conflates DUT data-path delay with monitor replica delay. The alert condition (Section III.B) is RMin/RMax on the replica delayed pulses sampled at the falling clock edge; it detects only that replica delay fell outside a window relative to clock pulse width. It does not observe actual DUT setup/hold margins. A setup violation happens when data arrival exceeds period minus setup, which can occur while the replica stays locked. Two mechanisms escape: (1) a localized EM/temperature attack can change a logic path's delay without changing a non-co-located replica; no spatial sensitivity bound is supplied; (2) Section III.E's Full Range Linear Tracking intentionally follows slow clock drift, and Table II shows a 2 C/min temperature sweep raises no alert. An attacker can choose a ramp below the FSM tracking threshold and drive the DUT into timing failure with RMin/RMax normal. Measured attacks are real but do not bound these bypasses; the exhaustive coverage claim is unsupported.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This manuscript proposes a fully synthesizable, standard-cell-only timing fault-injection monitor based on a delayed-lock loop that locks to the clock pulse width and raises an alert when the delayed replica falls outside a programmable acceptance window. It also presents an automated design framework that generates and optimizes the monitor from PDK/library inputs, and reports silicon results from a 65 nm test chip (50 DUTs; 2 MHz to 1.26 GHz locking range; 12 on-chip-injected glitch types; voltage, EMI, and temperature injection experiments) as well as two generated 28 nm designs. The central security claim is that the monitor detects all possible clock glitches and all timing FIAs launched through supply voltage, EM, and temperature, provided the acceptance window is set appropriately; the authors acknowledge that the window must be 'reasonable' but do not provide a quantitative method for choosing it in a real deployment.","tokens_in":19092,"tokens_out":7284,"duration_ms":77979,"significance":"If the detection guarantees hold, the work is significant: it offers a small (1500 um2, 0.355 MF2 in 65 nm), low-power (0.487 mW at 250 MHz) standard-cell monitor that is design-agnostic, synthesizable, and automatically instantiated by a toolchain. The silicon validation is unusually extensive for this class of work, including 50 DUTs, the automotive temperature range, 0.5 to 1.4 V supply sweeps, on-chip arbitrary glitch injection at 100 to 500 ps widths, and voltage, EMI, and temperature attack experiments. The end-to-end automation framework, with its delay-line optimization and post-layout verification loop, is a practical contribution. Notably, detection performance is measured against physically injected glitches and attacks rather than derived from the calibration itself, so the central empirical claim is not circular; however, the coverage arguments are incomplete in the ways detailed below. The significance is conditional on clarifying what the monitor actually observes (clock and replica-delay timing, not DUT data-path margins) and on bounding the attack rates and spatial scales to which the alarm is guaranteed.","major_comments":[{"comment":"Section III.A states that 'the only possible way to bypass the monitor is to change the delay of the gates and then match that delay with the pulse width of the clock accordingly,' and concludes that no timing violation exists in that case. This is not implied by the monitor's alert condition. The alert condition in Section III.B samples RMin and RMax from the replica delay line at the falling clock edge; it compares the replica delay with the clock pulse width, not with the actual setup/hold margins of the protected data paths. A localized EM or temperature event can slow a critical data path without changing the delay of a non-co-located replica, producing a setup violation while RMin and RMax remain normal. The paper offers only a qualitative 'checkerboard' placement suggestion in Section III.B and no spatial sensitivity bound. Please provide a quantitative coverage model (for example, the maximum allowed distance between a monitor and the paths it protects, or a bound on how much faster a local attack can move a data path than the replica), or restrict the security claim to attacks that uniformly affect the replica and the clock.","section":"Section III.A and III.B"},{"comment":"Section III.E implements a Full Range Linear Tracking mode with temporal majority voting whose purpose is to follow slow clock drift, and Table II reports that a 2 degC/min temperature drift is treated as 'no glitch.' The same mechanism gives an attacker a slow-ramp bypass: by changing supply voltage or temperature at a rate below the FSM's tracking threshold, the attacker can gradually push the DUT into a timing violation while RL remains locked and no alert is raised. The manuscript does not report the maximum slew rate the tracking loop can follow, nor does it argue that all realistic attack ramps exceed that rate. Please bound this rate (for example, in ppm/s of clock period or in V/s of supply voltage) and demonstrate that the measured voltage, EM, and temperature attacks, or any adversary within the stated threat model, are outside the tracked envelope.","section":"Section III.E and Table II"},{"comment":"Fig. 19b shows that the 'all 12 types' detection is achieved only for acceptance windows of 400 ps or smaller at the tested 250 MHz clock; at 500 ps, types T5 through T12 are missed. The acceptance window width is a free design parameter (Section III.A), and no method is given for choosing it from the known clock jitter, the required false-alert rate, and the attack profile. The abstract and conclusion state unqualified detection of 'all twelve types of possible clock glitches,' so the claim should either be qualified by the window setting or accompanied by a design-time procedure that selects the window and proves the selected value covers the intended threat model. In addition, the completeness of the T1-T12 taxonomy is asserted in Section II.A and Fig. 2 rather than demonstrated; the paper should define the class of waveforms it claims to cover or prove that arbitrary glitch waveforms reduce to detectable combinations of the listed types.","section":"Section V.C, Fig. 19b, and Section II.A"}],"minor_comments":[{"comment":"Please clarify how the 100 trials were distributed across glitch types and acceptance-window settings, and report the false-alert rate at each setting in addition to the miss rate, since the distinction between detection and false positive is central to the 'reasonable acceptance window' discussion.","section":"Fig. 19b and Section V.C"},{"comment":"The voltage-glitch experiment injects a supply disturbance but does not state whether the DUT actually produced a faulty output; please state explicitly whether the monitored metric is attack detection or fault detection, and whether the two are distinguished in the measurements.","section":"Section V.D and Fig. 21"},{"comment":"The 'Temperature Drift' row says 'No glitch'; please clarify that this means no false alert was raised during a non-attack drift, rather than that a glitch went undetected.","section":"Table II"},{"comment":"The 28 nm rows in Table I are described as post-layout evaluation, but the text should state explicitly near the table that no 28 nm silicon was measured, to avoid the impression that the 28 nm results are as experimentally validated as the 65 nm results.","section":"Section VI and Table I"},{"comment":"The phrase 'validated under a versatile of voltages' should read 'validated under a variety of voltages.'","section":"Section V.E"}],"recommendation":"major_revision","confidential_remarks":"The stress-test concern about the security guarantee is valid and is reflected in Major Comments 1 and 2: the monitor observes clock pulse width and replica delay, not the protected data-path margins, and the slow-drift tracking mode is an unquantified bypass. I am not recommending rejection, because the silicon results are strong, the automation framework is a real contribution, and the central claims are defensible once qualified and quantified. Please also ask the authors to state clearly in the introduction what this journal paper adds over their ISSCC paper [9], since the core monitor appears in that prior work and the present contribution is primarily the automation framework, the extended silicon validation, and the additional physical attack experiments."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The silicon validation is the real strength here; the security coverage claim is looser than the abstract implies. The genuinely new part is the end-to-end automation framework that generates a placed-and-routed monitor from a PDK and a standard-cell library, with 28nm generated designs to show it ports. The core DLL-based pulse-width monitor is from the authors' ISSCC 2024 paper, and they cite that openly; this journal version adds the compiler, the 28nm demonstration, and a more thorough 65nm characterization.\n\nThe measurements are extensive and credible: 50 DUTs for locking frequency and power, voltage sweeps from 0.5 to 1.4V, temperature across the automotive range, on-chip injection of all 12 glitch types with miss rates tabulated across acceptance-window settings, voltage glitches down to 120mV, EM injection at 60mVpp, and freeze/hot-air temperature attacks. The paper is honest about the acceptance-window tradeoff: at 500ps window, several glitch types are no longer detected. The automation framework is a real engineering contribution, and the post-layout verification loop with area optimization is sensible.\n\nThe soft spot is in the security argument, not in the measurements. Section III.A asserts that the only way to bypass the monitor is to change gate delay and clock pulse width together, but that conflates the DUT's data-path delay with the replica delay line. A localized EM or temperature event can change a critical path's delay while the replica, if not co-located, stays locked; the paper gives no spatial sensitivity bound. Likewise, the Full Range Linear Tracking mode intentionally follows slow drift, and the 2C/min temperature ramp test shows no alert; an attacker who ramps slowly enough could drive the DUT into a timing violation while the monitor tracks. These gaps don't invalidate the measured results, but they mean the 'detects all timing FIAs' framing is too strong. The paper should qualify the coverage claim or argue why distributed placement closes the gap.\n\nThe citation pattern is fine; the self-citation to [9] is proper. No code or data is released, which limits reproducing the automation flow, but the silicon data is the main evidence anyway.\n\nThis is a solid JSSC-level hardware security paper with a genuine engineering contribution and unusually thorough silicon validation. The coverage guarantee needs tightening, but the work deserves a serious referee. I'd send it out.","headline":"Strong silicon validation and a real automation contribution, but the security coverage claim overreaches relative to the attack model.","tokens_in":19742,"tokens_out":3490,"would_cite":true,"duration_ms":35124,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that a standard-cell-only clock-pulse-width monitor, generated automatically and distributable across a chip, can detect all twelve clock glitch types and timing fault injections via voltage, electromagnetic interference…","keywords":["timing fault injection attack","clock glitching","delay-locked loop","fault injection monitor","hardware security","standard-cell design","design automation","supply voltage glitch"],"falsifier":"Inject a fast, localized disturbance, for example a roughly 1 ns supply droop covering only a register's data path while leaving the monitor's replica delay line unaffected, with a clean clock, and observe whether a register samples a wrong value while no alert is raised. If such an experiment produces an undetected timing fault, the claim that the monitor detects timing FIAs via voltage, EM, and temperature as stated is falsified.","tokens_in":18636,"feed_emoji":"🛡️","tokens_out":5417,"duration_ms":55856,"temperature":0.7,"pith_summary":"The paper tries to establish that a single design-agnostic, fully synthesizable monitor can defend arbitrary digital chips against timing fault injection attacks (FIAs), the low-cost attack class that glitches the clock or disturbs voltage, electromagnetic, or temperature conditions to make registers sample wrong values. The monitor builds a digital replica of the clock's pulse width, locks to the legitimate clock automatically after power-up, and compares every later clock edge against a programmable acceptance window. Any pulse width that falls outside that window raises an alert in the same cycle. A 65 nm prototype occupies 1500 µm², locks from 2 MHz to 1.26 GHz, detects all twelve enumerated clock glitches when two monitors are used, and detects voltage, EMI, and temperature injections. An accompanying automation flow turns a standard-cell library plus frequency and resolution requirements into place-and-route-ready monitor netlists, with 28 nm demonstrations, so timing-FIA protection becomes a drop-in digital IP rather than a custom design effort.","feed_headline":"Tiny clock-pulse monitor catches all 12 glitch attacks","feed_subtitle":"Standard-cell monitor plus design compiler catches clock, voltage, EM, and temperature fault attacks.","key_machinery":"The load-bearing object is the configurable delay line together with the locking FSM and the acceptance window. The delay line produces three pulses—PMin, PL, and PMax—that set the minimum acceptable delay, the locked replica of the clock's pulse width, and the maximum acceptable delay. At the falling clock edge, the monitor samples whether the replica has already fired and whether it has not yet exceeded the window; any sample pattern other than RMin = 0 and RMax = 1 raises a glitch alert in the same cycle. The automation framework's core mechanism is the delay-line compiler, which simulates candidate standard-cell delay cells, optimizes the coarse, medium, and fine stage sizes against an area model that balances counter area against medium-stage area, runs automatic place and route, verifies post-layout tuning range and resolution, and returns the smallest monitor that satisfies the requested frequency range and resolution.","core_discovery":"The central claim is that tracking the clock's positive pulse width with a delay-locked replica catches both entry points of a timing FIA: hijacking the clock changes the pulse width directly, and delay-manipulation attacks change the replica delay relative to the clock, causing the sampled window bits to deviate from the expected pattern. The paper enumerates twelve clock glitch types, shows that one monitor catches nine and a second monitor tracking the negative phase catches the rest, and reports that with an acceptance window of 400 ps or less all twelve are detected at a 250 MHz clock. Voltage glitches down to 120 mV, a 60 mV EMI disturbance, and fast heating or freezing attacks are all detected, while slow temperature drift over the automotive range does not trigger false alerts. The monitor is built entirely from standard cells using a coarse ring-oscillator-counting stage, a thermometer-coded medium stage, and a fine varactor-like stage, with an on-chip finite-state machine that locks in 7 to 26 clock cycles. The only bypass the paper acknowledges is an attack that changes gate delay and then matches the clock pulse width to the new delay, in which case no timing violation exists at the register.","pith_inferences":["A residual gap not quantified in the paper is a spatially mismatched attack: if a voltage, EM, or temperature disturbance changes the guarded data path's delay more than it changes the replica delay, the monitor could in principle miss a timing fault that actually corrupts a register; mapping that spatial sensitivity would sharpen the coverage claim.","The detection guarantee is conditional on acceptance-window sizing, since the paper shows 400 ps catches all twelve glitch types at 250 MHz while wider windows sacrifice detection of short T5-T12-type events; a designer trading yield against security needs a quantitative window-selection rule.","The same architecture could serve as an on-chip clock-integrity sensor for safety-critical control logic, flagging excessive jitter, supply droop, or aging-induced delay drift even when no adversary is present.","A testable extension is to place the monitor at increasing distances from the protected logic and repeat the voltage and EM experiments, producing a coverage map that tells designers how densely the monitors must be distributed for a given attack localization."],"forward_implications":["A digital design team can insert timing-FIA protection by running the compiler and instantiating the generated monitor as standard-cell IP, with no analog design, manual layout, or post-silicon calibration.","Distributing monitors across the chip in a checkerboard of positive-phase and negative-phase units covers all twelve clock-glitch types and localized voltage, EM, and temperature attacks.","Because the monitor slow-tracks clock drift, normal environmental changes such as a -40 to 125 °C temperature ramp do not raise false alerts, while fast heating or freezing attacks do.","The same monitor IP scales to other process nodes: the 28 nm runs produce smaller footprints and higher locking frequencies than the measured 65 nm results.","The measured power and area overheads, 0.2 to 1.12 mW and 1500 µm² in 65 nm, are small enough that the monitor can be distributed densely rather than placed once per chip."],"supporting_citations":[{"why":"The prior ISSCC version that introduced the monitor architecture and whose measurements this article extends with the automation framework.","marker":"[9]"},{"why":"Argues that tunable replica circuits can be reused as timing FIA monitors, the direct predecessor that this work builds on while removing post-silicon calibration.","marker":"[28]"},{"why":"The FLL-based clock glitch detector used as the state-of-the-art comparison; the paper claims its large area and power prevent dense distribution, motivating the compact DLL approach.","marker":"[29]"},{"why":"Supplies the thermometer-coded path-selection delay-line structure used for the medium tuning stage.","marker":"[32]"},{"why":"Defines the 90 mV IEMI attack that the paper's EM test reproduces with an even smaller 60 mV disturbance, providing the attack baseline for EM detection.","marker":"[18]"},{"why":"The ChipWhisperer open-source toolchain used for voltage glitching attacks, grounding the voltage-attack threat model.","marker":"[15]"},{"why":"Represents Razor as a register-level adaptive error-detection technique that the paper explains cannot cover all twelve clock glitch types.","marker":"[22]"}],"fun_headline_variants":["Design-agnostic monitor auto-maps, catches all 12 glitches","Automated FIA monitor: 12 glitch types caught","Tiny 1500 µm² monitor catches 12 clock glitches","Automated design flow places FIA monitors, all glitches caught","DLL-based pulse monitor detects all 12 timing fault types"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The security claim rests on the assumption that any timing fault injection that actually corrupts a register will change either the clock pulse width or the replica delay enough to fall outside the monitor's acceptance window, and that the monitor's slow-drift tracking will not follow an attack-induced change.","fun_headline_variants_meta":{"raw":{"variants":["Design-agnostic monitor auto-maps, catches all 12 glitches","Automated FIA monitor: 12 glitch types caught","Tiny 1500 µm² monitor catches 12 clock glitches","Automated design flow places FIA monitors, all glitches caught","DLL-based pulse monitor detects all 12 timing fault types"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000969,"raw_usage":{"total_tokens":4127,"prompt_tokens":954,"completion_tokens":3173,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":570,"completion_tokens_details":{"reasoning_tokens":3081}},"tokens_in":570,"tokens_out":3173,"duration_ms":24745,"temperature":1.0,"reasoning_tokens":3081,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T19:47:04.767641+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Inject a fast, localized disturbance, for example a roughly 1 ns supply droop covering only a register's data path while leaving the monitor's replica delay line unaffected, with a clean clock, and observe whether a register samples a wrong value while no alert is raised. If such an experiment produces an undetected timing fault, the claim that the monitor detects timing FIAs via voltage, EM, and temperature as stated is falsified.","supporting_citations":[{"cited_title":"A Synthesizable Design-Agnostic Timing Fault Injection Monitor Covering 2MHz to 1.26GHz Clocks in 65nm CMOS,","cited_arxiv_id":null,"evidence_quote":"The prior ISSCC version that introduced the monitor architecture and whose measurements this article extends with the automation framework."},{"cited_title":"Fault-Injection Detection Circuits: Design, Calibration, Validation and Tuning,","cited_arxiv_id":null,"evidence_quote":"Argues that tunable replica circuits can be reused as timing FIA monitors, the direct predecessor that this work builds on while removing post-silicon calibration."},{"cited_title":"An FLL-Based Clock Glitch Detector for Security Circuits in a 5nm FINFET Process,","cited_arxiv_id":null,"evidence_quote":"The FLL-based clock glitch detector used as the state-of-the-art comparison; the paper claims its large area and power prevent dense distribution, motivating the compact DLL approach."},{"cited_title":"A Fully Synthesizable Fractional-N MDLL With Zero- Order Interpolation-Based DTC Nonlinearity Calibration and Two-Step Hybrid Phase Offset Calibration,","cited_arxiv_id":null,"evidence_quote":"Supplies the thermometer-coded path-selection delay-line structure used for the medium tuning stage."},{"cited_title":"Detection of IEMI fault injection using voltage moni- tor constructed with fully digital circuit,","cited_arxiv_id":null,"evidence_quote":"Defines the 90 mV IEMI attack that the paper's EM test reproduces with an even smaller 60 mV disturbance, providing the attack baseline for EM detection."},{"cited_title":"ChipWhisperer - the complete open-source toolchain for side- channel power analysis and glitching attacks","cited_arxiv_id":null,"evidence_quote":"The ChipWhisperer open-source toolchain used for voltage glitching attacks, grounding the voltage-attack threat model."},{"cited_title":"Razor: a low-power pipeline based on circuit-level timing speculation,","cited_arxiv_id":null,"evidence_quote":"Represents Razor as a register-level adaptive error-detection technique that the paper explains cannot cover all twelve clock glitch types."}],"review_version":1}