{"id":"942aaabf-675b-432c-b1b7-ff88368c3ec1","arxiv_id":"2505.17253","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":3.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"A literature survey of eNVM security covering five memory technologies, security primitives (PUFs, TRNGs, logic locking), seven attack classes, and publication trends.","lead":"This paper surveys the security landscape of embedded non-volatile memories, reviewing five memory technologies, the security primitives built on them, and the physical and logical attacks they face. It is a reference-oriented literature review with no new experiments, and its bibliometric trend analysis is not reproducible.","discovery_kind":"review","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Table 2 lists a documented thermal attack on PCM citing [94], but [94] is a temperature-sensitivity study of analog in-memory computing without an adversary model; the taxonomy overstates the demonstrated attack surface.","rationale":"Reading in good faith, the paper is a survey whose central claim is that Tables 1 and 2 give researchers a systematic map of eNVM security primitives and attacks. For that claim to hold, every table entry must trace to a source that actually establishes the listed item. I found a concrete, testable failure: the PCM/Thermal entry in Table 2 cites [94], which is a temperature-sensitivity study of PCM-based analog in-memory computing, not an attack paper. The survey text itself uses 'potential attack surface,' but the table presents it as a documented attack. This is a real correctness issue in the core deliverable, not merely a formatting or reproducibility complaint. The reader's weakest_assumption concerned the general accuracy and completeness of the cited literature; my concern is a specific instance of that class, so my agreement is partial rather than full. I do not see a reason to reject the survey or to downgrade it below conditional acceptance: the taxonomy is broadly useful, the references are numerous, and the identified misclassification is local and fixable. The Web of Science reproducibility issue and the duplicate reference are additional revision items but are secondary to the security map itself. My recommendation is to keep the reader's CONDITIONAL verdict, with the revision explicitly required to correct the Table 2 attribution and to audit adjacent rows for the same attack-versus-reliability confusion.","tokens_in":26703,"tokens_out":3648,"duration_ms":31286,"concrete_test":"Retrieve the full text of [94] and check for (i) an explicit adversary or threat model, (ii) an attack procedure, and (iii) any security claim. If none of the three is present, remove the PCM/Thermal entry from Table 2 and revise Section 4.7 to state that temperature sensitivity is a potential attack vector not yet demonstrated as a PCM attack. As a secondary check, audit the other Thermal entries in the same way, prioritizing [97] for MRAM and [95] for RRAM, to confirm they describe adversarial attacks rather than reliability effects.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The survey's central contribution is the systematic map in Tables 1 and 2, so each cell must be backed by a source that actually demonstrates the listed primitive or attack. That condition fails in at least one high-profile cell: Table 2 lists 'Thermal — PCM — [94]'. Reference [94] is Boybat et al., 'Temperature sensitivity of analog in-memory computing using phase-change memory' (IEDM 2021), a device reliability and computational-accuracy study of resistance drift under temperature variation. It contains no adversary model, no attack procedure, and no security claim. The survey's own Section 4.7 hedges by stating that these findings 'reveal a potential attack surface,' yet Table 2 converts that hedge into a documented thermal attack on PCM. Because Table 2 is one of the two summary artifacts defining the survey's contribution, this misclassification is substantive: a reader relying on the table would overcount PCM's demonstrated attack surface. The same pattern should be checked elsewhere—for example, FeRAM is absent from the Thermal row even though Section 4.7 says 'almost all types of eNVMs are susceptible'—but the [94] entry alone is sufficient to invalidate that row as currently presented.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"This survey maps the security landscape of embedded non-volatile memories (eNVMs). It reviews five technologies — flash, PCM, MRAM, RRAM, and FeRAM — from an architectural viewpoint, discussing why each is vulnerable. It then surveys eNVM-based security primitives (PUFs, TRNGs, logic locking) and a broad attack taxonomy (side-channel, probing, fault injection, rowhammer, information leakage, denial of service, and thermal attacks), summarized in Tables 1 and 2. It closes with a Web of Science-based publication-trend analysis and a timeline of NVM milestones. The central claim is that the same properties that make eNVMs useful for security applications also expose them to a wide range of physical and logical attacks.","tokens_in":26874,"tokens_out":2563,"duration_ms":18231,"significance":"If the taxonomy is reliable, the paper provides a useful and reasonably broad reference for researchers entering the eNVM security area. It compiles a large body of work across multiple memory technologies and connects device-level vulnerabilities to system-level attacks, which is valuable for structuring future research. The paper's summary tables are a particularly helpful contribution, and the inclusion of less-covered topics such as rowhammer on RRAM and thermal attacks is timely. The main limitation is that the survey's value depends on each table cell being backed by a source that actually demonstrates the listed primitive or attack; the PCM thermal-attack entry is a concrete case where this condition fails.","major_comments":[{"comment":"The Thermal—PCM cell cites reference [94], but [94] (Boybat et al., IEDM 2021) is a temperature-sensitivity study of analog in-memory computing that contains no adversary model, no attack procedure, and no security claim. Section 4.7 itself hedges by calling the finding 'a potential attack surface,' yet Table 2 converts that hedge into a documented thermal attack on PCM. Because Table 2 is one of the two central summary artifacts of the survey, this misclassification overstates PCM's demonstrated attack surface and should be corrected, either by removing the cell or by marking it as a potential, not demonstrated, vulnerability.","section":"Section 4.7, Table 2"},{"comment":"The text states that 'almost all types of eNVMs are susceptible' to thermal attacks, but the Thermal row of Table 2 lists only PCM, RRAM, and MRAM, with no entry for FeRAM or Flash. The table's disclaimer says absence indicates underexplored literature, not immunity, but the inconsistency between the blanket text claim and the row entries should be resolved to avoid confusing readers about which technologies have documented thermal attack studies.","section":"Section 4.7, Table 2"},{"comment":"The background on PCM states that the phase change occurs 'at a relatively low temperature of around 600°C.' For GST alloys used in PCM, the amorphous-to-crystalline transition typically occurs around 150–200°C, while roughly 600°C is closer to the melting point. This physical imprecision in a foundational technology description is noticeable in a survey that aims to explain architectural vulnerabilities.","section":"Section 2.2"},{"comment":"The publication-trend analysis is presented without the Web of Science search query, database version, inclusion/exclusion criteria, or any normalization of raw counts. As a stated contribution of the paper, the trend claims are therefore not reproducible, and it is unclear whether the counts reflect all publications on each technology or a particular topical subset. The authors should add a methodology paragraph or temper the claims accordingly.","section":"Section 5, Figure 6"}],"minor_comments":[{"comment":"References [1] and [12] are the same work (Khan and Ghosh, Journal of Low Power Electronics and Applications, 2021) and should be merged to avoid duplicate numbering.","section":"References"},{"comment":"The figure caption and text are inconsistent: the caption lists (a) STT-MRAM, (b) RRAM, (c) FeRAM, but the body text refers to Figure 2(c) for RRAM, and the figure itself appears to contain a duplicated FeRAM subfigure. This should be cleaned up.","section":"Figure 2"},{"comment":"There is a typo in 'GeSbT ealloys' that should read 'GeSbTe alloys.'","section":"Section 2.2"}],"recommendation":"major_revision","confidential_remarks":"The paper is within the scope of a hardware-security or VLSI venue, and the overall direction is sound. The key concern for the editor is the rigor of the summary tables: a survey whose central contribution is a taxonomy needs each table entry to be backed by a source that actually demonstrates the stated attack or primitive. The Table 2 thermal-PCM entry is a clear counterexample. The publication-trend methodology also needs attention before the paper can serve as a reliable reference."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe short version: this is a genuinely useful survey of eNVM security, but its central summary table overstates at least one attack, and the bibliometric section is not reproducible. Worth engaging with as a map, not as a final word.\n\nWhat's new: the paper extends the authors' own ISVLSI survey with two additional attack classes (information leakage, thermal) and a bibliometric trend. The five-technology structure—Flash, PCM, MRAM, RRAM, FeRAM—with separate treatment of security primitives (PUFs, TRNGs, logic locking) and attack taxonomy is a reasonable organizing principle. Tables 1 and 2 are the main deliverables, and for a newcomer they do provide a quick route into the literature. The discussion of architectural reasons for vulnerability (e.g., asymmetric write currents, supply noise, filament sensitivity in RRAM) is mostly accurate and helpful.\n\nThe soft spots are real but mostly fixable. The most serious is Table 2's Thermal row for PCM, which cites [94] (Boybat et al., temperature sensitivity of analog in-memory computing). That paper is a device reliability and accuracy study; it contains no adversary model and demonstrates no attack. Section 4.7 itself hedges with 'potential attack surface', but the table converts that hedge into a documented attack. A reader relying on the table will think PCM has been shown to be thermally attackable, which is not what the literature supports. The same row also omits FeRAM even though the text says almost all eNVMs are susceptible. Fixing this requires re-labeling the row as 'suspected' or 'reliability-based' and adjusting the table header accordingly.\n\nOther issues: the Web of Science trend (Figure 6) is presented without a search query, database version, or inclusion criteria, so the numbers are not independently checkable. Several figures are embedded scans with illegible text (Figures 3 and 4), which is poor for a survey. And reference [12] duplicates [1]. The PCM background repeats the '600°C phase transition' phrasing, which is closer to the melting temperature; the amorphous-crystalline transition is lower.\n\nThe survey does not claim a new scientific result, so novelty is appropriately modest. Its value is as a reference map, and that value is reduced by the Table 2 overstatement. I'd send it to peer review because the scope is timely and the fixable issues are worth correcting, but I'd want the table corrected before publication. For your own work, treat the table as a starting point, not a verified inventory.\n\nRecommendation: engage with it, but only after tightening the accuracy.","headline":"A useful but uneven eNVM security survey whose central attack table overstates at least one documented attack, and whose trend analysis is not reproducible.","tokens_in":27400,"tokens_out":2538,"would_cite":false,"duration_ms":24726,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This survey claims that the same physical features of embedded non-volatile memories that enable security primitives also expose those memories to a wide range of physical and logical attacks, and it maps that landscape across five memory…","keywords":["embedded non-volatile memory","physically unclonable function","true random number generator","logic locking","side-channel analysis","fault injection","row hammer","thermal attack"],"falsifier":"Take one row of Table 2 and check it against the cited original: for example, attempt the reported 15-trace differential power analysis key extraction from [71] on the commercial MRAM chip used in that study, or re-run the Section 5 publication counts with an explicit search query and compare the yearly totals. If the attack does not reproduce or the counts diverge materially, that part of the survey's claim fails.","tokens_in":26462,"feed_emoji":"🔐","tokens_out":9447,"duration_ms":86135,"temperature":0.7,"pith_summary":"Embedded non-volatile memories (eNVMs) — flash, PCM, MRAM, RRAM, and FeRAM — are moving from storage into caches, secure boot, and in-memory computing, and this survey tries to give designers and researchers one reference map of what that means for security. Its central contention is that the same physical properties that make these memories useful security building blocks are the properties that expose them to attack: data retention without power, high and asymmetric read/write currents, stochastic switching, and sensitivity to magnetic, electric, and thermal fields. The paper organizes the field into three layers: the five memory technologies and their architectural vulnerabilities, the security primitives built from them (physically unclonable functions, true random number generators, and logic locking), and seven attack classes (side-channel analysis, probing, fault injection, row hammer, information leakage, denial of service, and thermal attacks), summarized in two comparison tables. If this map is accurate, it gives a reader a fast way to see which attacks have actually been demonstrated on which memory, which primitives are mature, and where the literature is thin — for example, FeRAM appears in very few attack categories, which the authors explicitly say means underexplored rather than immune.","feed_headline":"The same memory features that secure chips also expose them","feed_subtitle":"Five embedded memory technologies, their PUF and TRNG uses, and seven attack classes in one reference.","key_machinery":"The load-bearing mechanism is the dual use of the eNVM cell's physics: the exact properties that store data without power and supply entropy — data retention, high and asymmetric read/write currents, stochastic switching, and sensitivity to magnetic, electric, and thermal fields — are the channels through which the surveyed attacks operate. The organizational machinery is the two comparison tables: Table 1 maps each memory technology to published physically unclonable function (PUF, a chip-specific fingerprint from manufacturing variation), true random number generator (TRNG, a circuit that harvests physical randomness), and logic locking (a countermeasure that gates circuit behavior on a secret key) implementations, and Table 2 maps each technology to published side-channel, probing, fault-injection, row-hammer, information-leakage, denial-of-service, and thermal attacks. These tables turn a scattered literature into a grid on which both maturity and gaps are visible at a glance.","core_discovery":"On the paper's own terms, its discovery is that eNVM security is a two-sided story with a common root. The non-volatility, asymmetric read/write currents, high write currents, and stochastic switching of these memories are what let PUFs and TRNGs generate entropy without storing keys on-chip; those same characteristics are what side-channel, probing, fault-injection, row-hammer, information-leakage, denial-of-service, and thermal attacks exploit. The paper supports that claim technology by technology: flash's thin tunnel oxide invites charge-injection faults, PCM's phase-change drift and analog resistance states enable both reconfigurable PUFs and thermal tampering, MRAM's magnetic tunnel junctions provide high-entropy switching but are flipped by magnetic fields, RRAM's conductive filaments and sneak-path currents give entropy and also create row-hammer and supply-noise channels, and FeRAM's data-dependent write currents enable power analysis. The paper concludes that the same features that enable eNVM applications also expose them to a wide range of physical and logical attacks, and it treats the absence of a published attack for a given memory as a gap in the literature, not as evidence of immunity.","pith_inferences":["If the dual-use framing is right, an eNVM cell engineered for high-entropy PUF or TRNG behavior may be more leakage-prone through power and timing channels; the paper documents both sides but does not state this as a design trade-off.","The survey's own caveat that absence of an attack does not imply immunity points to a concrete agenda: targeted fault-injection and thermal experiments on FeRAM, and probing studies on RRAM, are the rows with the largest room to move.","Extending the map to non-volatile caches suggests that power-cycling or cold-start attacks on cached plaintext become realistic once SRAM and DRAM are replaced by eNVMs; the paper notes the risk but does not develop countermeasures at the cache level.","The same leakage channels that enable side-channel attacks on RRAM matrix-vector multiplication also suggest covert channels inside processing-in-memory accelerators, since compute and memory share the same arrays and power grid."],"forward_implications":["A designer choosing an eNVM for a secure product can use the tables to see which primitives have published demonstrations on which memory, and which attack classes already have countermeasure literature.","Because the same properties create both entropy and leakage, eNVM-based PUFs and TRNGs should be assumed to need side-channel-hardened readout, not just good randomness metrics.","The seven attack classes give security researchers a checklist for evaluating a new eNVM technology: for a new memory, each empty cell in Table 2 is a candidate demonstration, not a safety claim.","The publication-trend analysis implies that security attention should follow the field's shift from flash toward RRAM and MRAM, which now receive the most research and also show the broadest documented attack surface.","As eNVMs move into caches and in-memory computing, the survey's denial-of-service, information-leakage, and thermal categories become directly relevant to AI accelerators and secure processors."],"supporting_citations":[{"why":"Supplies the survey's core vulnerability analysis, the denial-of-service and thermal framing, and much of the attack background for RRAM, MRAM, and PCM.","marker":"[1]"},{"why":"The authors' earlier conference version that this paper explicitly extends with broader primitives, new attack vectors, and trend analysis.","marker":"[2]"},{"why":"Introduces reconfigurable PUFs and is the foundation for the PCM PUF and reconfigurable-key line of work.","marker":"[15]"},{"why":"Proposes the X-point PUF that turns RRAM sneak-path currents into challenge-response pairs, anchoring the RRAM PUF section.","marker":"[17]"},{"why":"Demonstrates a self-heating PCM array TRNG, the source for the PCM TRNG row in Table 1.","marker":"[47]"},{"why":"Implements logic locking with 2T/3T MTJ key gates, the only logic-locking entry in Table 1.","marker":"[66]"},{"why":"Provides the experimental MRAM side-channel attack, including a 15-trace differential power analysis key extraction, underpinning the SCA row for MRAM.","marker":"[71]"},{"why":"Establishes the internal supply-noise fault-injection model for RRAM and STT-MRAM used in the fault-injection and denial-of-service sections.","marker":"[77]"},{"why":"Demonstrates NeuroHammer, the rowhammer-style bit-flip attack on RRAM crossbars that also feeds the thermal-attack discussion.","marker":"[88]"},{"why":"Describes the RRAM supply-noise information-leakage attack that the information-leakage section builds on.","marker":"[90]"}],"fun_headline_variants":["Why eNVM's security strengths are its weaknesses too","eNVM survey: protective features double as attack vectors","The double edge of embedded non-volatile memory security","eNVM security: from PUF entropy to thermal tampering","Same eNVM traits that yield entropy open attack paths"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the 102 cited papers are accurately characterized and that the publication-database counts behind Figure 6 come from a representative search; if any cited attack or primitive is misdescribed, or the trend data are unrepresentative, the survey's conclusions weaken.","fun_headline_variants_meta":{"raw":{"variants":["Why eNVM's security strengths are its weaknesses too","eNVM survey: protective features double as attack vectors","The double edge of embedded non-volatile memory security","eNVM security: from PUF entropy to thermal tampering","Same eNVM traits that yield entropy open attack paths"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000601,"raw_usage":{"total_tokens":2854,"prompt_tokens":1036,"completion_tokens":1818,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":652,"completion_tokens_details":{"reasoning_tokens":1736}},"tokens_in":652,"tokens_out":1818,"duration_ms":11072,"temperature":1.0,"reasoning_tokens":1736,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T14:50:11.781387+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take one row of Table 2 and check it against the cited original: for example, attempt the reported 15-trace differential power analysis key extraction from [71] on the commercial MRAM chip used in that study, or re-run the Section 5 publication counts with an explicit search query and compare the yearly totals. If the attack does not reproduce or the counts diverge materially, that part of the survey's claim fails.","supporting_citations":[{"cited_title":"Self-Heating Phase-Change Memory-Array Demon- strator for True Random Number Generation.IEEE Transactions on Electron Devices, (5):2185–2192, 2017","cited_arxiv_id":null,"evidence_quote":"Demonstrates a self-heating PCM array TRNG, the source for the PCM TRNG row in Table 1."},{"cited_title":"Logic Locking Using Emerging 2T/3T Magnetic Tunnel Junctions for Hardware Security.IEEE Access, pages 102386–102395, 2022","cited_arxiv_id":null,"evidence_quote":"Implements logic locking with 2T/3T MTJ key gates, the only logic-locking entry in Table 1."},{"cited_title":"Side-Channel Attack on STTRAM Based Cache for Cryptographic Application","cited_arxiv_id":null,"evidence_quote":"Provides the experimental MRAM side-channel attack, including a 15-trace differential power analysis key extraction, underpinning the SCA row for MRAM."},{"cited_title":"Fault injection attacks on emerging non-volatile memory and countermeasures","cited_arxiv_id":null,"evidence_quote":"Establishes the internal supply-noise fault-injection model for RRAM and STT-MRAM used in the fault-injection and denial-of-service sections."},{"cited_title":"NeuroHammer: Inducing Bit-Flips in Memristive Crossbar Memories","cited_arxiv_id":null,"evidence_quote":"Demonstrates NeuroHammer, the rowhammer-style bit-flip attack on RRAM crossbars that also feeds the thermal-attack discussion."},{"cited_title":"Information Leakage Attacks on Emerging Non-V olatile Memory and Countermeasures","cited_arxiv_id":null,"evidence_quote":"Describes the RRAM supply-noise information-leakage attack that the information-leakage section builds on."}],"review_version":1}