{"id":"53783327-dbc3-434a-9283-4c02986549e9","arxiv_id":"2501.18861","paper_version":5,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"QPRAC makes the JEDEC PRAC Rowhammer defense secure and practical using a five-entry priority-based service queue per bank, claiming deterministic security down to a Rowhammer threshold of 22 and 0.8% slowdown at threshold 71.","lead":"A new memory-chip design called QPRAC uses a tiny priority queue in each DRAM bank to pick which rows to refresh first when Rowhammer attacks cause rapid row activations. It aims to make the JEDEC PRAC mitigation framework both secure and practical at very low thresholds, with near-zero slowdown for ordinary workloads.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Security bound rests on an unproven worst-case attack assumption: the wave/feinting recurrence (Eq. 3) is not shown to dominate all PSQ-aware schedules, so the sub-100 TRH figures may be optimistic.","rationale":"The paper is a strong systems contribution: the PSQ design is novel, the performance claims are backed by Ramulator2 simulations over 57 workloads, and the artifact is publicly available and reasonably documented. The reader's CONDITIONAL verdict is appropriate. The single most load-bearing concern is the security proof's reliance on the wave/feinting attack being worst case. The derivation of Eq. (3) is specific to that attack's uniform round-robin schedule, and the extension to QPRAC in Section IV.B is an informal argument rather than a rigorous invariant or a search over adversarial schedules. The reader's weakest-assumption analysis identifies exactly this point, and I agree with it. I do not claim the paper is wrong: the PSQ design plausibly closes the FIFO-bypass attacks, and the artifact's simulations of the wave attack match the analytic model within 1%. However, for a deterministic security guarantee at sub-100 TRH, the absence of a proof that no other schedule can accumulate more unmitigated activations leaves the headline numbers conditional. The proposed exhaustive-search test is a practical way to settle the concern: it is small enough to run completely for reduced parameters and would either produce a concrete counterexample or substantially increase confidence in the worst-case model. Because the reader already issued CONDITIONAL and this concern does not change that verdict, no adjustment is recommended.","tokens_in":4,"tokens_out":17281,"duration_ms":266341,"concrete_test":"Run a bounded exhaustive search (or SMT/model-checking, e.g., NuSMV/TLA+) over the QPRAC state machine: per-row counters, PSQ insertion/eviction, Alert/ABOACT/ABODelay/RFM transitions, for small parameters such as PSQ size 2, Nmit=1, ABOACT=3, ABODelay=1, NBO=8, and 6-8 rows. Enumerate all activation schedules over a horizon covering several Alert cycles and compute the maximum activation count any row reaches before its first mitigation. Compare this maximum against the bound from Eqs. (1) and (3) at the same NBO. If any schedule exceeds the bound, the wave-attack worst-case assumption fails and the minimum TRH must be revised upward; if no schedule exceeds it, the PSQ-equivalence claim gains the missing supporting evidence.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central deterministic-security claim (Section III.C.3 and Figure 13) depends on two optimality assertions that are argued, not proved: (a) the wave/feinting attack is the worst case for an ideal PRAC implementation, and (b) under QPRAC, any attack that forces mitigations on locally rather than globally maximum rows is sub-optimal (Section IV.B). Claim (b) is supported only by the informal two-case argument in Figure 10 and by simulations of the wave attack; it does not formally rule out multi-cycle schedules that use the non-blocking ABOACT window to increment a target row outside the PSQ while sacrificial PSQ entries are boosted above it, leaving the target unmitigated above NBO after the RFM. Section IV.B states that a global maximum 'cannot increase its activation outside the PSQ,' but an activation issued during ABOACT can be hidden in exactly this window, and the argument does not bound the cumulative effect of such increments across successive Alert cycles. Because Eq. (3) is derived from the specific uniform wave schedule rather than from a game-theoretic or invariant-based analysis, any schedule that beats Eq. (1) would invalidate the headline TRH values (22, 71, etc.). The provided security-analysis scripts evaluate Eqs. (2)-(3) for the wave attack only; they do not search the space of adversarial schedules, so they cannot validate the worst-case assumption.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes QPRAC, an implementation of the JEDEC PRAC framework for DDR5 that uses a small per-bank priority-based service queue (PSQ) to track the most activated rows and issue Rowhammer mitigations on Alert Back-Off (ABO) events. The authors argue that FIFO-based PRAC implementations such as Panopticon are insecure under the non-blocking ABO protocol, and that queue-free designs such as UPRAC are impractical. QPRAC mitigates the highest-count row(s) in the PSQ on each Alert, performs opportunistic mitigations for all banks on all-bank RFMs, and optionally performs proactive mitigations during refresh, with an energy-aware variant gated by threshold NPRO. The security analysis models a wave/feinting attack against an idealized PRAC that mitigates the global top-N rows, derives a recurrence (Eq. 3) for the online-phase activation count, and claims that a PSQ of size at least Nmit achieves the same security as the ideal. The paper reports deterministic security at Rowhammer thresholds as low as 22 (NBO=1, 4 RFMs/Alert) and 71 at the default NBO=32 with 1 RFM/Alert, with 0.8% slowdown (0% with proactive mitigations) and 15 bytes of storage per bank.","tokens_in":100,"tokens_out":10705,"duration_ms":163548,"significance":"If correct, QPRAC would be a significant step toward practical in-DRAM Rowhammer mitigation at sub-100 thresholds, with negligible performance overhead and a storage footprint far smaller than prior trackers. The paper is unusually strong on reproducibility: the artifact includes Python scripts that regenerate the security figures and a Ramulator2-based performance simulation with traces. The analytical model's predictions match the wave-attack simulations within 1%. The performance evaluation across 57 workloads and the comparison with Mithril, PrIDE, and MOAT are useful. The main reservation is that the deterministic security claim rests on an informal worst-case argument rather than a formal invariant or exhaustive search, and the energy-aware default variant lacks a quantitative security bound; both need to be addressed before the headline claims can be taken at face value.","major_comments":[{"comment":"The central security claim that the wave/feinting recurrence in Eq. (3) bounds the worst case for QPRAC is not formally established. The 'Alternative Attacks Are Inferior' paragraph in Section IV.B argues by example that any attack forcing mitigations on locally maximum rows is sub-optimal, but it does not prove that no schedule can keep a high-count row outside the PSQ while successively boosting sacrificial entries above it. The insertion rule uses a strictly-greater-than comparison against the PSQ minimum, and the ABOACT window permits activations after an Alert; the argument in Section IV.B does not bound the cumulative effect of such activations across successive Alert cycles. Because the headline TRH values (22, 71, etc.) are derived from Eq. (3) under a specific uniform wave schedule, the authors should either (a) provide a formal invariant showing that every row outside the PSQ is reinserted after a bounded number of activations independent of the schedule, or (b) qualify the abstract and Section III.C.3 claims as security against known wave/feinting attacks. The supplied artifact scripts evaluate Eqs. (2)-(3) for the wave attack only and do not search the space of adversarial schedules, so they cannot close this gap.","section":"Section IV.B, Eq. (3)"},{"comment":"QPRAC+Proactive-EA is presented as the default energy-optimized design, yet no security analysis is provided for it. The paper states only that it 'achieves a security level between QPRAC and QPRAC+Proactive' and that it reduces the setup-phase pool to a lesser extent than proactive mitigation on every REF. Since NPRO determines which proactive mitigations are skipped, the supported TRH for this variant depends on NPRO; without a quantitative analysis, the security guarantee for the configuration recommended in the abstract and evaluation (Table III, Figure 13) is unsupported. Please derive the worst-case TRH as a function of NPRO (e.g., by modeling the setup-phase mitigation rate with the threshold) or state explicitly which TRH values are claimed for QPRAC+Proactive-EA.","section":"Section IV.C and Table III"},{"comment":"The reported energy per activation for PSQ logic, '0.23 µJ per ACT', is inconsistent with the accompanying statement that this is 'just 0.05% of the activation energy' for a DDR5 device. Per-activation DRAM energy is on the order of a few nanojoules, so 0.23 µJ (230 nJ) would be roughly two orders of magnitude larger, not 0.05% of the activation energy. This appears to be a unit error (likely 0.23 nJ). Because Table III and Section VI.F use this number to support the negligible-energy-overhead conclusion, the authors should correct the unit and re-verify the percentages.","section":"Section VI.F"}],"minor_comments":[{"comment":"The word 'Opportuinsitc' in the introduction should be 'Opportunistic'.","section":"Section I"},{"comment":"The word 'Onlie' in the subsection heading should be 'Online'.","section":"Section IV.C.2"},{"comment":"The phrase 'PRAC Level' is used without definition; please state that it refers to the number of RFMs per Alert (PRAC-1/2/4).","section":"Table III"},{"comment":"The minimum PSQ size is stated as Nmit in Section III.C.3 and as Nmit+1 for proactive mitigation in Section III.E; please clarify that the 5-entry design is chosen to support Nmit up to 4 plus one refresh-time mitigation, and that a smaller PSQ (Nmit+1) suffices for PRAC-1 with proactive mitigation.","section":"Section III.D.2 and III.E"},{"comment":"The claim 'first secure, scalable, and practical' should be qualified given the concurrent MOAT work discussed in Section VII.A; please clarify how the comparison is positioned relative to that publication.","section":"Abstract and Section VII.A"},{"comment":"The y-axis label and caption use different phrasings for the same quantity ('ABO occurrences per tREFI interval' versus 'Alert Back-Off (ABO) occurrences'); please make the terminology consistent.","section":"Figure 15"}],"recommendation":"major_revision","confidential_remarks":"The manuscript appears to be the HPCA 2025 camera-ready version. If this is being considered for a journal, I recommend the editors clarify the intended relationship to the published version and to the concurrent MOAT work. I do not see signs of circular fitting: NBO, NPRO, and PSQ size are presented as operating points, and the wave-attack simulations are used for validation rather than parameter fitting. The main concern is that the deterministic-security claim is stronger than the analysis supports, especially for the energy-aware default variant."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Read QPRAC. The genuinely new piece is the priority-based service queue: it sidesteps Panopticon's full-FIFO bypass and UPRAC's oracle-top-N impracticality, and the corrected PRAC analysis (minimum TRH 44/29/22 vs UPRAC's 17/10) is a real contribution. The evaluation is thorough: 57 workloads in Ramulator2, 0.8% slowdown at NBO=32, 0% with proactive mitigations, 15 bytes per bank, and a shipped artifact with scripts that regenerate the security and performance figures. That is reproducible evidence and should be credited.\n\nThe soft spot is the security argument, not the system. Section IV's bound rests on the wave/feinting attack being the worst case for PRAC and on the claim that any attack forcing mitigations on local rather than global maxima is sub-optimal. The first is an assumption inherited from prior work; the second is argued with a two-case diagram, not a proof. In particular, the claim that a globally maximum row 'cannot increase its activation outside the PSQ' is too strong - it can be incremented while its count stays at or below the queue minimum, and only gets inserted once it exceeds that minimum. The stress-test worry about using ABOACT to accumulate increments across Alert cycles doesn't, as far as I can tell, break the design, because the insertion threshold resets as sacrificial rows get mitigated; but that is exactly the kind of thing a formal invariant would settle. The artifact scripts evaluate Equations (2)-(3) for the wave schedule; they don't search adversarial schedules. So 'deterministic security' is a claim ahead of the proof. Given how much of the paper's value depends on the TRH=71/22 numbers, this deserves careful referee scrutiny.\n\nTwo smaller things. The energy numbers have a unit problem: 0.23 uJ per ACT as 0.05% of activation energy would imply a ~460 uJ baseline ACT, which is off by orders of magnitude; likely the unit should be nJ. And QPRAC+Proactive-EA is given performance and energy results but no explicit security bound; the paper says it lands between QPRAC and QPRAC+Proactive, which is plausible but unquantified. The 'first' claim is softened by concurrent MOAT, but they do compare against it, so that's fine.\n\nBottom line: this is a solid systems paper for DRAM/Rowhammer people. It deserves a serious review, with the main question being whether the worst-case attack model can be upgraded to a proof or an exhaustive schedule search. I'd take it for reading group and would cite it for the PSQ mechanism and the corrected PRAC analysis.","headline":"QPRAC's priority-queue design and corrected PRAC analysis are real contributions, the evaluation is solid and reproducible, but the 'deterministic security' claim is ahead of the proof: the worst-case attack model is assumed, not proven.","tokens_in":28656,"tokens_out":6648,"would_cite":true,"duration_ms":73669,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"QPRAC claims that a priority-based service queue makes JEDEC's PRAC Rowhammer defense both secure and practical at sub-100 thresholds.","keywords":["Rowhammer","PRAC","DDR5","priority queue","Alert Back-Off","DRAM security","Row hammer mitigation","activation counting"],"falsifier":"Run a custom attack in the paper's simulator (or on real DDR5 with PRAC) that alternates between two disjoint row sets so that the PSQ's minimum entry is always a low-count row, while a target row is hammered only during Alert windows; if the target row's activation count exceeds NBO + Nonline (e.g., NBO + 46 for PRAC-1 at NBO=1) without any mitigation, the deterministic security claim is false.","tokens_in":27529,"feed_emoji":"🛡️","tokens_out":8011,"duration_ms":70349,"temperature":0.7,"pith_summary":"QPRAC is a design for implementing JEDEC's Per Row Activation Counting (PRAC) framework in DDR5 DRAM that aims to make Rowhammer mitigation both secure and practical at very low Rowhammer thresholds. The paper argues that existing PRAC-based defenses are either insecure, because FIFO service queues can be bypassed during the non-blocking Alert window, or impractical, because they require reading all activation counters on each Alert. QPRAC replaces the FIFO with a small priority-based service queue that always keeps the highest-activated rows, and it adds opportunistic and proactive mitigation opportunities. The authors claim that with a queue size of at least the number of RFMs per Alert, QPRAC provides deterministic security matching an ideal PRAC implementation, supporting thresholds as low as 22 and 71 in its default configuration with 0.8% slowdown or less. This matters because future DRAM generations are expected to have Rowhammer thresholds below 100, and current mitigations do not scale to that regime.","feed_headline":"Priority queue makes Rowhammer defense secure at threshold 71","feed_subtitle":"A tiny on-chip priority queue keeps PRAC's Rowhammer mitigation near-zero-cost even below 100 activations.","key_machinery":"The key mechanism is the Priority-Based Service Queue (PSQ), a per-bank queue that stores row IDs and their activation counts, sorted in descending order of count, and is designed to be full at all times. On each activation, if the activated row's count exceeds the minimum entry in the queue, that entry is evicted and the new row is inserted, so the queue always tracks the highest-activated rows even when an Alert window delivers extra activations. This design prevents the 'bypass when full' attack that breaks FIFO-based queues: a row hammered during the Alert window cannot escape tracking because it inserts by priority. The PSQ also drives the mitigation policy: when its highest count crosses the back-off threshold NBO, an Alert is raised and the top rows are mitigated in priority order, with blast-radius victim refreshes.","core_discovery":"The central claim is that QPRAC achieves deterministic Rowhammer security at sub-100 thresholds while remaining practical and spec-compliant. Specifically, the paper shows that a priority-based service queue of size N ≥ Nmit (the number of RFMs per Alert) makes QPRAC's security identical to that of an 'ideal' PRAC that always mitigates the globally top-N activated rows, even under optimized wave/feinting attacks with transitive blast-radius effects. Under this model, QPRAC is secure for Rowhammer thresholds as low as 44, 29, and 22 at a back-off threshold NBO of 1 with 1, 2, or 4 RFMs per Alert, and for a threshold of 71 at the default NBO=32 with 1 RFM/Alert. The paper additionally shows that opportunistic mitigation on all-bank RFMs and energy-aware proactive mitigation during refresh reduce the slowdown to 0.8% and 0%, respectively, on benign workloads, with 15 bytes of storage per bank.","pith_inferences":["We infer that the 'always full' priority-queue principle is a general antidote to insertion-bypass attacks: any tracking structure that evicts the lowest-count entry instead of the oldest entry retains information about the most dangerous rows, so the idea could transfer beyond PRAC to other defense contexts.","The security bound rests on a worst-case attack model (wave/feinting); a new attack that deliberately forces mitigations of locally-maximum rows while holding a global maximum outside the queue could shift the bounds, so the claimed TRH numbers should be re-verified against adaptive attacks not covered by the model.","The paper's performance-attack analysis shows that the all-bank RFM interface is the main bottleneck at NBO below 64; we infer that a per-bank RFM command, which the paper discusses as a specification change, would be the natural next step for making very low thresholds affordable under adversarial load.","We also infer that the 7-bit per-row counter sizing derived from the worst-case bound could be re-derived for any new threat model; if a stronger attack is found, the counter size and the queue threshold would need to grow together."],"forward_implications":["If QPRAC's security analysis is correct, DRAM vendors can implement PRAC with a 5-entry priority queue per bank and achieve deterministic Rowhammer protection at thresholds as low as 71 with 1 RFM per Alert, without modifying the JEDEC specification.","With the energy-aware proactive mitigation scheme, the performance overhead drops to 0% on benign workloads while energy overhead stays near 1.9%, making sub-100 threshold protection essentially free for typical usage.","QPRAC scales to 4 RFMs per Alert, lowering the supported threshold to 22 at NBO=1, and maintains under 1% slowdown across queue sizes from 1 to 5, giving vendors flexibility in choosing a queue size.","Compared with existing in-DRAM mitigations that lose 7% to 69% performance at thresholds between 64 and 512, QPRAC's near-zero overhead at those thresholds could extend the usable life of DDR5 as thresholds fall."],"supporting_citations":[{"why":"Introduces the per-row activation counting and FIFO service queue design whose security flaws QPRAC is designed to fix; supplies the t-bit toggling and queue-bypass vulnerabilities.","marker":"[2]"},{"why":"Proposes a queue-free PRAC implementation that QPRAC deems impractical; also provides the wave/feinting attack model that the security analysis extends.","marker":"[4]"},{"why":"Defines the wave/feinting attack pattern and blast-radius transitive effects used to bound worst-case activations in the security analysis.","marker":"[38]"},{"why":"Sets the Alert Back-Off parameters (NBO, Nmit, ABOACT, ABODelay) that constrain the design and the security bounds.","marker":"[40]"},{"why":"Concurrent PRAC implementation; used for comparison of performance, energy, and security posture.","marker":"[46]"},{"why":"State-of-the-art in-DRAM mitigation used as a baseline for performance comparison at low TRH.","marker":"[19]"},{"why":"State-of-the-art in-DRAM mitigation used as a baseline for performance comparison at low TRH.","marker":"[26]"},{"why":"Cycle-accurate DRAM simulator used to evaluate performance overheads of QPRAC.","marker":"[36]"}],"fun_headline_variants":["Priority queue hardens Rowhammer defense down to 71 activations","QPRAC: Secure Rowhammer mitigation at ultra-low thresholds","Priority queues make PRAC Rowhammer defense practical at 71","New queue design slashes Rowhammer defense cost to 0.8%","Rowhammer immune below 100 activations with priority queue"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The security bounds assume that the wave/feinting attack—extended with transitive blast-radius effects—is the strongest possible attack on a PRAC-based defense, and that any attack forcing the PSQ to mitigate locally-maximum rows is sub-optimal.","fun_headline_variants_meta":{"raw":{"variants":["Priority queue hardens Rowhammer defense down to 71 activations","QPRAC: Secure Rowhammer mitigation at ultra-low thresholds","Priority queues make PRAC Rowhammer defense practical at 71","New queue design slashes Rowhammer defense cost to 0.8%","Rowhammer immune below 100 activations with priority queue"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000497,"raw_usage":{"total_tokens":2486,"prompt_tokens":1043,"completion_tokens":1443,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":659,"completion_tokens_details":{"reasoning_tokens":1354}},"tokens_in":659,"tokens_out":1443,"duration_ms":11393,"temperature":1.0,"reasoning_tokens":1354,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-09T22:11:41.176141+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run a custom attack in the paper's simulator (or on real DDR5 with PRAC) that alternates between two disjoint row sets so that the PSQ's minimum entry is always a low-count row, while a target row is hammered only during Alert windows; if the target row's activation count exceeds NBO + Nonline (e.g., NBO + 46 for PRAC-1 at NBO=1) without any mitigation, the deterministic security claim is false.","supporting_citations":[{"cited_title":"Panopticon: A complete in-dram rowhammer mitigation,","cited_arxiv_id":null,"evidence_quote":"Introduces the per-row activation counting and FIFO service queue design whose security flaws QPRAC is designed to fix; supplies the t-bit toggling and queue-bypass vulnerabilities."},{"cited_title":"Understanding the security benefits and overheads of emerging industry solutions to dram read disturbance,","cited_arxiv_id":null,"evidence_quote":"Proposes a queue-free PRAC implementation that QPRAC deems impractical; also provides the wave/feinting attack model that the security analysis extends."},{"cited_title":"Protrr: Principled yet optimal in-dram target row refresh,","cited_arxiv_id":null,"evidence_quote":"Defines the wave/feinting attack pattern and blast-radius transitive effects used to bound worst-case activations in the security analysis."},{"cited_title":"JESD79-5C","cited_arxiv_id":null,"evidence_quote":"Sets the Alert Back-Off parameters (NBO, Nmit, ABOACT, ABODelay) that constrain the design and the security bounds."},{"cited_title":"MOAT: Securely Mitigating Rowhammer with Per-Row Activation Counters,","cited_arxiv_id":null,"evidence_quote":"Concurrent PRAC implementation; used for comparison of performance, energy, and security posture."},{"cited_title":"Pride: Achieving secure rowhammer mitigation with low-cost in-dram trackers,","cited_arxiv_id":null,"evidence_quote":"State-of-the-art in-DRAM mitigation used as a baseline for performance comparison at low TRH."},{"cited_title":"Mithril: Cooperative row hammer protection on commodity dram leveraging managed refresh,","cited_arxiv_id":null,"evidence_quote":"State-of-the-art in-DRAM mitigation used as a baseline for performance comparison at low TRH."},{"cited_title":"Ramulator 2.0: A modern, modular, and extensible dram simulator,","cited_arxiv_id":null,"evidence_quote":"Cycle-accurate DRAM simulator used to evaluate performance overheads of QPRAC."}],"review_version":1}