{"id":"0ecd1d7d-65eb-4ddf-abed-acf783500a50","arxiv_id":"2506.01991","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"A low-priority observer task can infer a high-priority victim's critical job executions from its own response times using a probabilistic suffix tree plus K-means clustering, but the evaluation does not demonstrate true future prediction.","lead":"This paper tests whether a low-priority task can learn when a high-priority task runs its rare critical mode by watching its own response times. It reports that a statistical model of those response times identifies critical jobs better than a random coin flip, on simulations and two small physical systems.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Unvalidated victim-specific cluster attribution: K-means separability, missing majority baseline, and no temporal holdout undermine the leakage claim.","rationale":"I agree with the reader's weakest-assumption identification: the K-means clustering in Section IV-C assumes clean separation of observer response times into victim-mode clusters regardless of other higher-priority tasks' mode variations, and the synthetic evaluation enforces this separation by setting Ctyp = 0.7 Ccri for every task and choosing a large victim mode spread (e.g., Table II). This is indeed the load-bearing condition for the central leakage claim. My reading additionally stresses two evaluation gaps that make the concern decisive rather than merely theoretical: the inference precision metric is dominated by the class prior, so an all-typical baseline would outperform the reported numbers at 10% critical rate, and no temporal holdout is described, so the paper's 'predict future critical arrivals' claim is not directly demonstrated. Despite these issues, the underlying response-time correlation mechanism is plausible, and the demonstrations on real platforms provide limited supporting evidence. The paper should therefore remain conditional: the central claim may hold in the tested regime, but the current evidence does not establish it generally. No change to the reader's verdict is needed.","tokens_in":19654,"tokens_out":6268,"duration_ms":71823,"concrete_test":"Run a controlled synthetic experiment with the generator of Section V-A1: fix the victim's Ccri/Ctyp ratio at 1.1, set another higher-priority task's ratio to 2.0, train on the first 30 hyperperiods, and evaluate on the next 20 as a true temporal holdout. Report the full confusion matrix for victim jobs, including critical precision, critical recall, and IP, alongside an all-typical majority-class baseline. If critical recall is near zero or IP falls at or below the majority baseline when the victim's mode spread is moderate, then the reported leakage is an artifact of enforced separability and class imbalance rather than victim-specific inference.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing inference step is Section IV-C's K-means classification of observer response times into victim-typical versus victim-critical clusters, but the paper never validates that these clusters actually correspond to victim modes. In Eq. (1), the observer's response time accumulates interference from every higher-priority task, R_o = C_o + B_o + sum_{τh∈hp(τo)} ceil(R_o/T_h) C_h, so a high response time can be caused by critical jobs of any higher-priority task, not necessarily the victim. The method simply partitions observed R_o values into two clusters and labels one 'victim critical.' With the synthetic setup enforcing Ctyp_i = 0.7 Ccri_i for every task (Section V-A1), other tasks' mode spreads alone can shift the observer's response time by as much as or more than the victim's mode spread; no cluster purity, critical-job true-positive rate, or overlap statistic is reported. Additionally, the reported inference precision, IP = successful predictions / total jobs (Section V-A3), is class-prior dominated: with 10% critical jobs, an all-typical classifier achieves 90% precision, above the reported 71%, so beating a 50% coin toss does not establish extraction of critical invocations. Finally, the workflow selects victim jobs from a trace used for training and does not describe a temporal holdout, so the paper's stated claim of predicting future critical arrivals (Section I) is not actually tested.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies timing-based information leakage in fixed-priority preemptive real-time systems where tasks have two execution modes (typical and critical). The authors propose that a low-priority \"observer\" task can infer, and even predict, the future critical-mode arrivals of a high-priority \"victim\" task by measuring its own response times. The technical approach combines standard response-time analysis (Eq. 1) with a probabilistic suffix tree (PST) for predicting future response times and K-means clustering to map observed response times to victim typical/critical modes (Sections III and IV). The evaluation uses synthetic UUniFast tasksets with varying utilization and critical arrival rates, an ArduPilot case study, overhead measurements on a Raspberry Pi 4, and two physical demonstrations (a robot arm and a surveillance system). The paper reports inference precision above a random coin-toss baseline and false positive rates below 25%.","tokens_in":19934,"tokens_out":3119,"duration_ms":34080,"significance":"If the central claim is established, the paper would be a useful contribution to real-time systems security: it extends prior side-channel and covert-channel work (e.g., FrameLeaker, ScheduLeak) to non-deterministic dual-mode data-flow tasks and provides a low-footprint inference method that works on embedded platforms. The paper has clear strengths: the response-time recurrence in Eq. (1) is standard and correctly used; the design-space exploration is systematic; the overhead measurements are concrete; and the two physical demonstrations give the work practical grounding. However, the current evaluation does not yet validate the headline claim of predicting future critical arrivals, and the reported metrics are not sufficient to demonstrate that the K-means clusters correspond to victim modes. The central idea is defensible, but the load-bearing evidence needs rework.","major_comments":[{"comment":"The inference precision metric, IP = successful predictions / total observed jobs, is class-prior dominated. In Case I only 10% of victim jobs are critical, so a trivial classifier that always predicts \"typical\" attains 90% precision, well above the reported 71% for the proposed method. The random-selection baseline, which is near 50%, is not a meaningful adversary baseline under class imbalance. The paper should report balanced accuracy, per-class precision and recall (especially for the critical class), and compare against a majority-class baseline. This is load-bearing for the claim that critical invocations are actually extracted.","section":"Section V-A3, Section V-A5"},{"comment":"The evaluation does not test the stated claim of predicting future critical arrivals. The workflow randomly selects a victim job from the same response-time trace used for training, and the paper does not describe a temporal holdout separating training and prediction intervals. Algorithm 1 has training and prediction durations, but the experiments do not specify that the predicted jobs lie strictly after the training window. The headline claim requires evaluating on a future held-out interval, not on jobs drawn from the training distribution.","section":"Section V-A4, Section I"},{"comment":"The K-means step that labels observer response times as \"victim critical\" versus \"victim typical\" is not validated. In Eq. (1), the observer's response time accumulates interference from every higher-priority task, so a large response time can be caused by critical jobs of any higher-priority task, not necessarily the victim. Because the synthetic setup sets Ctyp_i = 0.7 Ccri_i for every task, other tasks' mode spreads can shift the observer's response time by as much as the victim's mode spread. The paper reports no cluster purity, no critical-class true-positive rate, and no comparison of the inferred clusters against ground-truth victim labels. This cluster-to-mode correspondence is load-bearing for the entire inference method.","section":"Section IV-C, Section V-A1"},{"comment":"The method has several parameters (PST probability threshold Pmin, maximum suffix length L, number of clusters K, and the critical arrival rate model) that are chosen by hand or drawn from a uniform distribution. In particular, the assumption that typical/critical markers are independent uniform draws at each job is an ad-hoc model that is not derived from the data-flow-driven execution model motivating the paper. The paper should include a sensitivity analysis over these parameters and test at least one workload model in which mode switches have temporal structure, since the PST is specifically motivated by temporal patterns.","section":"Section IV-B, Section V-A1"}],"minor_comments":[{"comment":"The text says the observer infers future victim arrivals \"by measuring the victim's own response times,\" but the method measures the observer's own response times; this should be corrected.","section":"Section III-A"},{"comment":"In the clustering illustration, the text says \"we train the PST ... and calculate the response time of τv,\" which appears to be a typo for the response time of the observer τo; the following sentence refers to the measured response times of the observer task.","section":"Section IV-C"},{"comment":"The timing overhead is reported inconsistently: the abstract states 50 ms, Section V-C reports roughly 50 us for a 50-hyperperiod training duration, and also mentions about 20 ms for a 20-hyperperiod duration. Please clarify the units and which configuration corresponds to each reported value.","section":"Section V-C, Abstract"},{"comment":"Several references are duplicated: Völp et al. appears as [16], [22], and [48]; Son et al. appears as [17] and [47]; Ghassami et al. appears as [18] and [53]. These should be consolidated.","section":"References"},{"comment":"In the PST example, the displayed probabilities are labeled with the continuation suffix rather than the conditioning suffix; e.g., P(r1_o | r1_o r2_o r1_o) should presumably be P(r1_o | r1_o r2_o). Please revise the notation for clarity.","section":"Example 1"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Dear Colleague,\n\nQuick take: the basic leakage mechanism is real and worth knowing; the evaluation as submitted does not support the headline claim of predicting future critical arrivals.\n\nWhat's actually new: prior side-channel work like ScheduLeak assumes fixed execution times. This paper targets non-deterministic dual-mode tasks, where each job is either typical or critical. The idea is to have a low-priority observer watch its own response times, which increase when higher-priority jobs run their critical mode, and then use a probabilistic suffix tree plus K-means to classify the observer's response times into victim-typical versus victim-critical. That combination is new to me, and the two physical demos give it concreteness. The response-time recurrence in Eq. (1) is standard and correctly applied; the Section III range argument is sound.\n\nWhere it gets soft. The most serious problem is the baseline. The only comparator is a coin toss. With 10% critical jobs, always guessing 'typical' would yield 90% precision, above the reported ~71%, so beating random does not demonstrate extraction of critical invocations. The paper needs a majority-class baseline and per-class recall/precision for critical jobs.\n\nSecond, the K-means step is load-bearing but unvalidated. The observer's response time accumulates interference from all higher-priority tasks, so a critical job of some other task can push the response time into the 'victim critical' cluster. The synthetic setup enforces Ctyp = 0.7*Ccri for every task, making this confound likely, yet no cluster purity or overlap statistic is reported.\n\nThird, the paper claims prediction of future critical arrivals, but the experiment randomly selects a victim job from the trace and no temporal holdout is described. The future-prediction claim is not actually tested. Minor but annoying: overhead numbers are inconsistent (50 ms in the abstract, ~50 us in Fig. 11b, ~20 ms in text).\n\nWho this is for: real-time systems folks working on scheduler side channels. The core phenomenon - response times leak mode information in fixed-priority systems - is real, and the physical demos support that basic point. But as submitted, the evidence establishes 'some leakage occurs,' not the specific precision/FPR numbers or the predictive claim. I'd send it to a serious referee and expect heavy revision: majority-class baseline, per-class metrics, cluster validation, temporal holdout, and consistent overhead numbers.\n\nBest","headline":"Real leakage mechanism, but the evaluation oversells it: weak baseline, unvalidated clustering, and no temporal holdout.","tokens_in":20456,"tokens_out":3025,"would_cite":true,"duration_ms":29433,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"By measuring its own response times, a low-priority observer task can predict when a high-priority victim task will execute its critical jobs.","keywords":["information leakage","real-time systems","side channel","fixed-priority scheduling","response time analysis","probabilistic suffix tree","K-means clustering","dual-mode execution"],"falsifier":"Run a fixed-priority system with a victim whose typical and critical execution times differ by only a small amount, or with other high-priority tasks whose own typical and critical execution times vary widely, collect the observer's response times, and check whether K-means produces a threshold with false-positive rate below 25 percent; if the two response-time distributions overlap substantially, the claimed inference fails.","tokens_in":19421,"feed_emoji":"⏱️","tokens_out":5972,"duration_ms":57278,"temperature":0.7,"pith_summary":"The paper claims that in fixed-priority real-time systems where tasks alternate between short typical executions and long critical executions, a low-priority task can learn the high-priority victim's execution pattern just by timing itself. The response time of the observer carries an imprint of the interference caused by the victim's jobs, and longer critical jobs push that response time upward. The authors build a probabilistic suffix tree over the observer's response-time history and use K-means clustering to split those response times into a 'typical victim' cluster and a 'critical victim' cluster, then predict future critical arrivals from the deepest matching suffix. This matters because the result would mean an unprivileged task can detect and predict safety-critical mode switches, enabling targeted denial-of-service or actuation-blocking attacks. In synthetic tasksets, an ArduPilot-style case study, and two physical demonstrations, the inference beats random guessing, with false-positive rates below 25 percent.","feed_headline":"Low-priority tasks can predict a victim's critical mode","feed_subtitle":"Measuring its own response times reveals critical-job timing with under 25 percent false positives.","key_machinery":"The load-bearing mechanism is the combination of a probabilistic suffix tree (a tree of suffixes of the observer's response-time sequence, each node storing the probability of the next response-time symbol) and K-means clustering (which partitions the observer's response times into two clusters and yields a threshold). The PST performs the prediction: given the last few observed response times, it looks up the deepest matching suffix and returns the most likely next response time. The cluster threshold performs the classification: a predicted response time above the threshold is attributed to a critical victim job, one below it to a typical victim job. The underlying enabler is the standard fixed-priority response-time recurrence, which quantifies how the victim's longer critical execution inflates the observer's response time.","core_discovery":"The central claim is that the fixed-priority scheduler leaks information through response-time interference: the observer's measured response time $R_o^a$ varies with whether higher-priority jobs, especially the victim's, executed in typical or critical mode. The authors show this by extending standard response-time analysis $R_i = B_i + C_i + \\sum_{\\tau_j \\in hp(\\tau_i)} \\lceil R_i/T_j \\rceil C_j$ to max/min response-time ranges and then demonstrating that observed response times of the observer can be clustered into two groups whose boundary separates the victim's critical jobs from its typical jobs. Once the cluster threshold is learned offline, a probabilistic suffix tree converts a short history of the observer's own recent response times into a prediction of the next victim mode. On synthetic workloads the approach achieves more than 55 percent inference precision for critical arrival rates up to 30 percent and less than 25 percent false positives; on the ArduPilot taskset precision is 50 to 70 percent; and on the surveillance demonstration the false-positive rate is 16.45 percent.","pith_inferences":["A natural defense test follows from the paper's own mechanism: if system designers shrink the gap between $C^{\\mathrm{typ}}_v$ and $C^{\\mathrm{cri}}_v$, or make other higher-priority tasks' execution times more variable, the K-means clusters should merge and the inference should degrade; the paper does not run this experiment.","The PST is essentially learning a finite-memory model of a hidden Markov process, so the same method should apply to inferring any mode switch that changes a task's execution time, such as input-dependent branches or sensor-triggered phases, not just the two-mode model considered here.","Because the paper compares only against random selection, a stronger baseline, such as always predicting the majority typical class, would already match the precision figures for low critical rates; the paper's real advantage is the low false-positive rate for the rare critical class, not raw accuracy.","The saturation of precision with observation-window length suggests the attack is robust even under memory constraints, but it also implies that short-memory schedule randomization or dummy work inserted around critical jobs could be a low-cost defense worth testing."],"forward_implications":["A compromised low-priority task can act as a side-channel sensor: it needs only its own response times and a system clock, and its training phase can be done offline from public scheduling parameters.","Rare critical arrivals are the easiest to detect: with 10 percent critical jobs the precision is above 70 percent and false positives stay near 15 percent, which is exactly the regime an attacker would target.","The attacker's footprint is small: about 1 MB of memory and roughly 50 microseconds of runtime inference overhead on a Raspberry Pi 4, so the observer can stay within its timing budget and remain stealthy.","Longer training and longer observation histories do not improve inference, so an observer needs only a short recent window of about 10 response times to make predictions.","The same leakage appears on realistic platforms: a manufacturing robot can be frozen by exploiting the predicted critical timing, and a motion-triggered surveillance system leaks critical motion detections with a false-positive rate of 16.45 percent."],"supporting_citations":[{"why":"Supplies the standard fixed-priority response-time recurrence used to bound the observer's response times and derive leakage ranges.","marker":"[27]"},{"why":"Supplies the probabilistic suffix tree method used to predict the observer's next response time from its recent history.","marker":"[28]"},{"why":"Supplies the K-means clustering algorithm used to split observer response times into typical-victim and critical-victim clusters.","marker":"[29]"},{"why":"Provides the ScheduLeak scheduler side-channel that motivates the attack model and the use of leaked critical timing for denial-of-service.","marker":"[14]"},{"why":"Defines the dual-mode typical/critical execution model with longer critical execution times that the paper assumes for all tasks.","marker":"[20]"},{"why":"Establishes a prior covert-channel technique in fixed-priority multiframe tasks and the workload-generation conventions the paper follows.","marker":"[31]"},{"why":"Supplies the UUniFast algorithm used to generate synthetic task sets for the evaluation.","marker":"[33]"},{"why":"Supplies the ArduPilot real-world taskset parameters used in the UAV autopilot case study.","marker":"[35]"},{"why":"Defines the noninterference model and public scheduling assumptions that make offline training from public parameters possible.","marker":"[22]"}],"fun_headline_variants":["Timing leaks: low-priority tasks infer critical mode","Response times betray real-time task secrets","Observer task cracks victim's critical mode via timing","Scheduler leaks: low-priority spies on critical job patterns","Real-time info leak: response times reveal execution mode"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole inference rests on the assumption that the victim's critical jobs are long enough, and the timing variation from all other higher-priority tasks is small enough, that the observer's response times split into two cleanly separable clusters.","fun_headline_variants_meta":{"raw":{"variants":["Timing leaks: low-priority tasks infer critical mode","Response times betray real-time task secrets","Observer task cracks victim's critical mode via timing","Scheduler leaks: low-priority spies on critical job patterns","Real-time info leak: response times reveal execution mode"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.0007,"raw_usage":{"total_tokens":3206,"prompt_tokens":1035,"completion_tokens":2171,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":651,"completion_tokens_details":{"reasoning_tokens":2096}},"tokens_in":651,"tokens_out":2171,"duration_ms":13311,"temperature":1.0,"reasoning_tokens":2096,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T20:38:40.556414+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run a fixed-priority system with a victim whose typical and critical execution times differ by only a small amount, or with other high-priority tasks whose own typical and critical execution times vary widely, collect the observer's response times, and check whether K-means produces a threshold with false-positive rate below 25 percent; if the two response-time distributions overlap substantially, the claimed inference fails.","supporting_citations":[{"cited_title":"Finding response times in a real-time system,","cited_arxiv_id":null,"evidence_quote":"Supplies the standard fixed-priority response-time recurrence used to bound the observer's response times and derive leakage ranges."},{"cited_title":"Variations on probabilistic suffix trees: statistical modeling and prediction of protein families,","cited_arxiv_id":null,"evidence_quote":"Supplies the probabilistic suffix tree method used to predict the observer's next response time from its recent history."},{"cited_title":"Unsupervised k-means clustering algorithm,","cited_arxiv_id":null,"evidence_quote":"Supplies the K-means clustering algorithm used to split observer response times into typical-victim and critical-victim clusters."},{"cited_title":"A novel side-channel in real-time schedulers,","cited_arxiv_id":null,"evidence_quote":"Provides the ScheduLeak scheduler side-channel that motivates the attack model and the use of leaked critical timing for denial-of-service."},{"cited_title":"Formal analysis of sporadic overload in real-time systems,","cited_arxiv_id":null,"evidence_quote":"Defines the dual-mode typical/critical execution model with longer critical execution times that the paper assumes for all tasks."},{"cited_title":"A new covert channel in fixed-priority real-time multiframe tasks,","cited_arxiv_id":null,"evidence_quote":"Establishes a prior covert-channel technique in fixed-priority multiframe tasks and the workload-generation conventions the paper follows."},{"cited_title":"Priority assignment for global fixed priority pre-emptive scheduling in multiprocessor real-time systems,","cited_arxiv_id":null,"evidence_quote":"Supplies the UUniFast algorithm used to generate synthetic task sets for the evaluation."},{"cited_title":"https://github.com/ardupilot/ardupilot","cited_arxiv_id":null,"evidence_quote":"Supplies the ArduPilot real-world taskset parameters used in the UAV autopilot case study."}],"review_version":1}