{"id":"4b86ba6d-47a7-4ff9-91c9-5f0b8399d88c","arxiv_id":"2606.12011","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":6.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"InjectV is a gem5-based framework for precise fault injection in RISC-V that identifies attack points on FISSC security benchmarks with a claimed 95.8% time saving versus traditional methods.","lead":"The paper introduces InjectV, a new framework for simulating fault injection attacks on RISC-V processors using the gem5 simulator. A smart generalist might read it to learn how software simulation can help test hardware security before building expensive physical prototypes.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.3","headline":"gem5 fault model fidelity to real RISC-V transient faults is unvalidated","rationale":"The reader's weakest assumption is exactly the load-bearing condition for the experimental claim. No other internal inconsistency is detectable from the given text, and the absence of hardware validation data keeps the verdict at UNVERDICTED.","tokens_in":1672,"tokens_out":292,"duration_ms":9626,"concrete_test":"Execute the hardened VerifyPIN binary on physical RISC-V hardware (same ISA and core as the gem5 model) using voltage glitching or EM injection at the exact instruction addresses and registers flagged by InjectV; measure attack success rate and compare to the simulation-reported rate. A >20% absolute difference falsifies the modeling assumption.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The headline claim (95.8% time-saving and effective identification of injection points on FISSC/VerifyPIN) requires that transient faults injected into gem5 registers/memory produce the same observable control-flow, counter, and comparison outcomes as physical faults. The abstract and experimental description supply no calibration data, no comparison to laser/voltage-glitch results on the same RISC-V core, and no quantification of timing or masking discrepancies between the simulator and silicon. If gem5's fault propagation or architectural visibility differs from hardware, the identified attack points and the reported advantage become simulation artifacts rather than transferable security findings.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The paper presents InjectV, a fault-injection framework built on the gem5 simulator for RISC-V platforms. It supports precise transient fault injection into registers and memory at security-critical points (control-flow decisions, counters, comparisons) and reports experiments on FISSC benchmarks including hardened VerifyPIN variants that identify injection points while claiming a 95.8% time-saving advantage over traditional fault-injection approaches.","tokens_in":1787,"tokens_out":340,"duration_ms":11534,"significance":"A validated gem5-based framework could provide a useful white-box, pre-silicon tool for systematic FIA assessment when physical experiments are costly or unavailable. The reported time-saving and attack-point identification results, however, rest on an unvalidated assumption that gem5 fault propagation matches silicon behavior; without calibration data the claimed advantage and security findings remain simulation-specific.","major_comments":[{"comment":"Experimental results section: the headline 95.8% time-saving claim is stated without any description of measurement methodology, chosen baselines, number of trials, or error quantification, rendering the performance advantage unverifiable.","section":"Experimental results"},{"comment":"Experimental setup and results: no calibration data, no comparison against laser/voltage-glitch results on the same RISC-V core, and no quantification of timing or masking discrepancies are supplied to support the assumption that gem5-injected transient faults produce the same observable outcomes as physical faults; this assumption is load-bearing for the claim that identified attack points are transferable.","section":"Experimental setup and results"}],"minor_comments":[],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the detailed feedback on InjectV. The comments highlight important gaps in experimental documentation and validation assumptions. We address each point below and indicate planned revisions.","responses":[{"response":"We agree that the 95.8% time-saving figure requires supporting methodological details to be verifiable. The revised manuscript will add an explicit subsection in the Experimental Results section describing the baseline (exhaustive traditional fault injection without guided selection), the measurement process (wall-clock simulation time across FISSC benchmarks), the number of trials, and any observed variance or error quantification.","revision_made":"yes","referee_comment":"[Experimental results] Experimental results section: the headline 95.8% time-saving claim is stated without any description of measurement methodology, chosen baselines, number of trials, or error quantification, rendering the performance advantage unverifiable."},{"response":"The manuscript frames InjectV as a pre-silicon simulation tool and does not assert that gem5 fault outcomes are identical to physical silicon behavior. We will revise the text to explicitly state the modeling assumptions, add a dedicated Limitations subsection discussing the lack of physical calibration, potential timing/masking differences, and the simulation-specific nature of the identified attack points. No physical hardware experiments or calibration data are available in the current study.","revision_made":"partial","referee_comment":"[Experimental setup and results] Experimental setup and results: no calibration data, no comparison against laser/voltage-glitch results on the same RISC-V core, and no quantification of timing or masking discrepancies are supplied to support the assumption that gem5-injected transient faults produce the same observable outcomes as physical faults; this assumption is load-bearing for the claim that identified attack points are transferable."}],"tokens_in":1288,"tokens_out":413,"duration_ms":24483,"standing_objections":["No physical calibration data or direct comparisons to laser/voltage-glitch experiments on RISC-V hardware are available to validate gem5 fault propagation equivalence."]},"desk_editor":{"model":"grok-4.3","letter":"InjectV is a framework that extends the gem5 simulator to support targeted transient fault injection in RISC-V systems. It focuses attacks on security-critical spots such as control-flow decisions, counters, and comparisons, and it handles faults in registers and memory.\n\nThe paper does a straightforward job of describing how to build this capability on top of an existing simulator and then running it against the FISSC benchmarks, including hardened versions of VerifyPIN. A pre-silicon tool like this can be useful for teams that want to explore fault-attack surfaces before chips are taped out.\n\nThe main reported result is a 95.8% time saving compared with traditional fault-injection approaches. The abstract states the number but supplies no description of how it was measured, what the baseline implementation was, how many trials were run, or any variability. More importantly, the work provides no calibration data showing that faults modeled inside gem5 produce the same observable outcomes as physical laser or voltage-glitch experiments on actual RISC-V cores. Without that check, the identified attack points and the claimed advantage remain tied to the simulator's internal fault model.\n\nThe contribution is an engineering extension rather than a new theoretical result. No derivations or parameter fitting appear.\n\nThis paper is aimed at hardware-security engineers and researchers who work with RISC-V and need simulation-based fault analysis. Readers who want a concrete framework description could find it worth examining if the code is released.\n\nIt deserves peer review. The core idea fills a practical gap in pre-silicon testing for an open ISA, even though the current evidence is thin. Reviewers should ask for the missing experimental methodology and any validation against real hardware.","headline":"InjectV adds guided fault injection to gem5 for RISC-V but the 95.8% time-saving claim has no supporting measurement details or hardware validation.","tokens_in":2255,"tokens_out":415,"would_cite":false,"duration_ms":16324,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"InjectV models fault injection attacks on RISC-V using the gem5 simulator to identify vulnerabilities at critical execution points.","keywords":["fault injection attacks","RISC-V","gem5 simulator","hardware security","vulnerability assessment","transient faults","FISSC benchmarks","pre-silicon evaluation"],"falsifier":"Direct comparison of InjectV-identified vulnerable points and attack success rates against equivalent experiments performed on physical RISC-V hardware.","tokens_in":2580,"feed_emoji":"🛡️","tokens_out":567,"duration_ms":12709,"temperature":0.7,"pith_summary":"The paper introduces InjectV as a framework for simulating fault injection attacks in RISC-V systems within the gem5 environment. It targets precise injection at points like control-flow decisions, counters, and comparisons while supporting transient faults in registers and memory. This approach aims to replace expensive and limited physical fault experiments with a systematic, white-box simulation method during pre-silicon design. Results on FISSC suite benchmarks, including hardened VerifyPIN variants, show effective detection of injection points along with major reductions in analysis time.","feed_headline":"RISC-V simulator finds fault injection points 95.8% faster","feed_subtitle":"InjectV on gem5 targets control flow and memory faults in simulation, reducing reliance on physical hardware tests.","key_machinery":"gem5 simulator extended for precise, guided transient fault injection at control-flow decisions, counters, and comparisons in RISC-V.","core_discovery":"InjectV provides a gem5-based platform that enables guided transient fault injection into RISC-V registers and memory at security-critical locations, allowing developers to systematically explore attack vectors on benchmarks from the FISSC suite and achieve identification of vulnerable points with substantially lower effort than physical testing methods.","pith_inferences":["The same modeling approach could be applied to evaluate countermeasures in other processor architectures if ported.","Automated tools might later use InjectV outputs to suggest code or hardware modifications that close identified gaps.","Accuracy checks against multiple real RISC-V chips would strengthen confidence in the simulation results for production use."],"forward_implications":["Developers can assess system resilience to fault attacks earlier in the design cycle without physical prototypes.","Systematic testing becomes feasible for multiple attack scenarios involving registers and memory.","Hardened code variants like those in FISSC can be evaluated for remaining weaknesses in simulation.","Time required for vulnerability discovery drops significantly compared to traditional physical injection."],"fun_headline_variants":["InjectV models fault injections in RISC-V gem5 sim","gem5-based InjectV for RISC-V transient faults","InjectV enables guided faults in RISC-V registers","RISC-V faults identified 95.8% faster with InjectV"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"The gem5 simulator accurately reproduces the effects of real transient faults on physical RISC-V hardware.","fun_headline_variants_meta":{"raw":{"variants":["InjectV models fault injections in RISC-V gem5 sim","gem5-based InjectV for RISC-V transient faults","InjectV enables guided faults in RISC-V registers","RISC-V faults identified 95.8% faster with InjectV"]},"model":"grok-4.3","cost_usd":0.006059,"raw_usage":{"total_tokens":2832,"prompt_tokens":602,"num_sources_used":0,"completion_tokens":68,"cost_in_usd_ticks":60587000,"prompt_tokens_details":{"text_tokens":602,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":2162,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":602,"tokens_out":68,"duration_ms":14615,"temperature":1.0,"reasoning_tokens":2162,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-27T08:59:40.754213+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"Direct comparison of InjectV-identified vulnerable points and attack success rates against equivalent experiments performed on physical RISC-V hardware.","supporting_citations":[],"review_version":1}