Pith. sign in

REVIEW 4 major objections 5 minor 22 references

iThermTroj: Exploiting Intermittent Thermal Trojans in Multi-Processor System-on-Chips

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that intermittent, randomly timed thermal tampering evades threshold-based defenses, and that tiny on-chip machine-learning classifiers detect such attacks with 100% accuracy at temperature manipulations of ±0.8 °C or…

desk verdict New intermittent thermal trojan idea worth a look, but the 0.8°C/100% claim is contradicted by the paper's own figures. read the letter →

arxiv 2507.05576 v1 pith:XMUNFHZZ submitted 2025-07-08 cs.CR cs.AR

Mehdi Elahi , Mohamed R. Elshamy , Abdel-Hameed Badawy , Ahmad Patooghy This is my paper · ORCID
classification cs.CRcs.AR
keywords intermittentthermaltrojansensorattackmachinelearninganomalydetectiontinyMLclassifierssystem-on-chipsecuritydynamicmanagementhardware
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that a new class of thermal Trojan—one that randomly and briefly tampers with an SoC's thermal sensor readings instead of permanently altering them—slips past threshold-based detectors such as the Blind Identification Countermeasure (BIC). The paper proposes training tiny on-chip machine-learning classifiers on steady-state temperature traces to catch these intermittent manipulations. On a simulated six-core mobile processor, the classifiers reportedly cut detection failure rates by 29.4%, 17.2%, and 14.3% for attack rates of 80%, 60%, and 40% of the thermal data, and reach 100% detection for any temperature error exceeding ±0.8 °C.

What carries the argument

The two load-bearing pieces are the attack algorithm and the detection models. Algorithm 1 defines iThermTroj: it chooses an attack scenario (lowering, elevation, or fluctuation) and an attack rate (100%, 80%, 60%, or 40%), randomly selects a victim core, and sporadically adds or subtracts a temperature error Δt_error to that core's reported reading. The detection side uses six tinyML classifiers trained on 70% of the steady-state thermal traces and tested on the remaining 30%, producing a trained model that labels each reading as benign or attacked.

What would settle it

Re-run the iThermTroj experiments on the same six-core layout and thermal traces with an independently implemented BIC from reference [14], and check whether BIC's detection failure rate under the attack matches the paper's reported BIC values; if BIC fails at a different rate, or if the 100%-detection threshold at ±0.8 °C does not reproduce, the central claim fails.

Watch

Extended reading notes

Core claim

The central discovery is that persistence is the assumption thermal defenses exploit, and eliminating persistence defeats them. The proposed iThermTroj attack activates randomly in time, leaving most sensor readings untouched, so the tampered values resemble transient noise rather than sustained deviation; BIC, which relies on consistent anomalies, fails against this pattern. The paper further shows that compact classifiers—support vector machines, logistic regression, random forests, decision trees, and two naive Bayes variants—trained on steady-state readings from HotSpot simulations can recognize the anomaly pattern, with failure rates far below BIC's and a full-protection threshold of ±0.8 °C.

Load-bearing premise

The comparison depends on a faithful reimplementation of the BIC countermeasure from reference [14]; the paper reports BIC failure rates but gives no implementation details or parameters, so if that baseline is miscalibrated the claimed improvements and the 0.8 °C resolution do not follow.

Editorial extensions

If this is right

  • Threshold-based thermal defenses should no longer be assumed safe against time-randomized tampering; security claims must account for intermittent attack patterns.
  • On-chip ML anomaly detection can provide full protection at a resolution of 0.8 °C, catching temperature manipulations that threshold methods miss at smaller error magnitudes.
  • Detection failure rates still rise as the attack rate falls, reaching 35.16% and 38.10% for 60% and 40% injection rates, so intermittent attacks remain a meaningful challenge even with the proposed classifiers.
  • In the 80% injection scenario, the ML countermeasure reduces detection failure from about 52.38% to roughly 23%, a drop of about 29 percentage points relative to the BIC baseline.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Extending beyond the paper: the same intermittent, time-randomized evasion strategy likely applies to other sensor modalities protected by threshold-based methods, such as voltage or power sensors, though the paper does not test that.
  • Extending beyond the paper: the 0.8 °C full-protection figure comes from simulated traces on a single six-core layout; real-silicon validation with actual sensor noise would be needed to see whether that resolution survives physical hardware.
  • Extending beyond the paper: adding temporal context or combining the evaluated classifiers might push the detection resolution below 0.8 °C, but this is speculative and not established by the paper.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. This paper introduces iThermTroj, an intermittent thermal Trojan that randomly modifies temperature readings of a targeted core in a multi-processor SoC, and claims that existing threshold-based BIC detection fails against it. The authors simulate a heterogeneous 6-core mobile application processor with HotSpot 6.0, inject temperature offsets ranging from -0.8 °C to +0.8 °C at 40%, 60%, and 80% activation rates, and train and evaluate six tiny machine-learning classifiers (SVM, logistic regression, random forest, decision tree, Gaussian Naive Bayes, and Bernoulli Naive Bayes) on the resulting thermal traces. They report detection failure rates and improvements over BIC, and claim a full protection resolution of 0.8 °C with 100% detection accuracy for manipulations exceeding that bound.

Significance. The intermittent attack model is a plausible and timely extension of prior persistent thermal Trojan work, and the paper provides a clearly specified attack algorithm and a systematic comparison of several lightweight classifiers on a realistic HotSpot-based thermal model. The study covers multiple injection rates and a range of temperature offsets, which is commendable. However, the central quantitative claim is internally contradicted by the paper's own evaluation data, no uncertainty quantification or independent test data is provided, the BIC baseline is described only at a high level, and no artifacts or code are released. As it stands, the significance of the work is substantially reduced because the headline 0.8 °C/100% result is not supported by the evidence presented.

major comments (4)
  1. [Abstract and Section V (Resolution Analysis)] The abstract's claim that "any temperature manipulations exceeding ±0.8 degrees will be detected with 100% accuracy" is not supported by the paper's own data. Section V reports complete detection coverage only for Δt_error values below -2/+2 at 40% injection, below -1.2/+1.2 at 60%, and below -1/+1 at 80% injection; the smallest full-protection threshold reported is 1 °C at 80% injection, not 0.8 °C. Figure 2, which tests ΔT = ±0.8, shows per-classifier accuracies below 1.0 (for example, approximately 0.9976 for SVM and 0.7571 for Bernoulli Naive Bayes at ΔT = +0.8), and no tested magnitude exceeds ±0.8. The abstract and Section V must be reconciled, or the 0.8 °C/100% claim should be removed or replaced with the actual resolution reported in Section V.
  2. [Section V (Evaluation Setup)] The reported accuracies are point estimates from a single HotSpot simulation run with a fixed 70/30 split, and no confidence intervals, repeated trials, or independent test workloads are provided. A "100%" detection claim cannot be established from a point estimate of 0.9976, nor even from a single observed perfect value without uncertainty quantification. The authors should report variability across simulation runs, cross-validation folds, or different power traces and layouts before making strong resolution claims.
  3. [Sections III and V (BIC baseline)] The comparison against BIC is not reproducible as reported. Sections III and V report BIC failure rates (e.g., 52.38% in Figure 3) and derive the claimed 29.4%, 17.2%, and 14.3% improvements, but give no implementation details, parameter settings, or code for the BIC countermeasure from reference [14]. If the BIC baseline is not faithfully implemented or is evaluated under different conditions, these improvement percentages and the resolution comparison are not meaningful. The authors should describe the BIC adaptation precisely or release the baseline code.
  4. [Section IV (Training and Evaluation Methodology)] The classifiers are trained and tested on thermal traces generated by the same HotSpot simulator and the same attack-injection procedure, with labels derived from the attack schedule. This is an in-distribution evaluation, and the reported detection rates may not transfer to other workloads, layouts, or attack variants. The paper would be considerably stronger with an out-of-distribution test, such as different power traces, unseen core selections, or attack magnitudes not used in training, or, failing that, a clearly stated limitation and tempered conclusions.
minor comments (5)
  1. [Algorithm 1, Section III] The condition "if T_error ≠ 0" appears trivially true given the surrounding logic, and the notation T_error, Δt_error, and ΔT is used inconsistently; please define each symbol at first use and clarify the intended semantics of the random-value generation step.
  2. [Section V] The text states that the distribution of detection failure rates "appears to follow a normal distribution," but no normality test or fitted distribution is provided; this sentence should be removed or substantiated with a statistical test.
  3. [Section IV] The methodology says the authors "deliberately introducing adversarial attacks on 80% of the data," but the evaluation later uses 40% and 60% injection rates as well; please reword to describe all three scenarios consistently.
  4. [Figures 1-3] The figures are difficult to read in the provided rendering; axis labels, units, and legends should be enlarged, and the per-classifier color coding should be explained explicitly in each caption.
  5. [References] Some references appear to be cited incidentally or are unrelated to the topic (e.g., [6] and [18]); a focused reference list would improve the paper's clarity and relevance.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: the paper's claims are empirical simulation results, and the discrepancies noted by the reader are correctness/reproducibility issues, not circular reductions.

full rationale

The paper does not present a formal derivation chain in which an output quantity reduces to its own inputs. The attack is defined by injecting a temperature error (Algorithm 1), and the ML classifiers are trained and tested on HotSpot-generated thermal traces with a 70/30 split. This is standard supervised evaluation on a held-out portion of the same simulated distribution; it is a methodological limitation (in-distribution testing) but not a definitional circularity, because the reported accuracies are measured on data not used for training. The BIC baseline in [14] is authored by two co-authors of this paper, but it is used as a comparison target, not as a premise from which the paper's conclusions are derived; the claimed BIC failure is presented as an experimental observation, even though implementation details are missing, which is a reproducibility concern rather than a circular step. The abstract's '0.8 degrees / 100% accuracy' claim is contradicted by Section V's Resolution Analysis, which reports complete detection coverage only below -2/+2 at 40% injection and below -1/+1 at 80% injection, and by Figure 2, where accuracies at ΔT = ±0.8 are below 1.0. That internal mismatch is a correctness defect and should be corrected, but it is not an instance of self-definition, fitted-input-called-prediction, or self-citation load-bearing logic. No equation or construction in the paper makes the claimed result equivalent to its inputs, so the circularity score is 0.

Assumptions & free parameters 4 free parameters · 5 assumptions · 1 invented entities

The central claims rest mainly on simulated data and threat-model assumptions. The free parameters are the hand-chosen attack rates and temperature-error grid, the undisclosed learned ML coefficients, and the single train and test split. The axioms concern the realism of HotSpot traces, the representativeness of one mobile AP layout, the faithful reproduction of the BIC baseline, and the attacker's ability to inject exact temperature offsets intermittently. No physical entities are introduced beyond the iThermTroj attack concept.

free parameters (4)
  • ML model learned parameters (weights and coefficients for SVM, logistic regression, random forest, decision tree… = not reported
    The classifiers are trained on the simulated thermal data; without disclosed hyperparameters and coefficients, the reported accuracy cannot be independently reproduced.
  • Attack rate values (100%, 80%, 60%, 40%) = enumerated scenario inputs
    These hand-chosen rates define how much thermal data is tampered with and directly drive the detection success numbers.
  • Delta_T error grid from 0.2 to 0.8 degrees Celsius in steps of 0.2 = 0.2, 0.4, 0.6, 0.8
    The claimed 0.8 degree full-protection resolution is selected from this coarse grid; no finer steps or continuous analysis are provided.
  • Train and test split ratio 70/30 = 0.70/0.30
    A single split is used without cross-validation or repeated runs, so variance in the reported metrics is unknown.
assumptions (5)
  • domain assumption HotSpot 6.0 thermal simulator produces realistic steady-state thermal traces for the target mobile SoC.
    All training and testing data come from HotSpot 6.0 in Section V; there is no validation against silicon measurements or sensor noise models.
  • domain assumption The 6-core mobile AP layout from [21] and the power traces used are representative of real-world mobile SoCs.
    Only one layout is used and no workload, ambient temperature, or process variation is considered.
  • domain assumption The BIC countermeasure from [14] is faithfully reproduced in Figures 1 and 3.
    No implementation details, parameters, or code for BIC are given, yet the comparison and the claimed percentage improvements depend on it.
  • ad hoc to paper The attacker can modify thermal sensor readings at arbitrary randomly chosen time steps by an exact Delta_T without leaving other detectable traces.
    This capability is central to the iThermTroj model in Algorithm 1 and is never demonstrated on real hardware.
  • ad hoc to paper Supervised labels distinguishing corrupted from uncorrupted thermal data are available during training.
    The ML training uses the known attack injection to create labels; a real deployment would not have such labels, and the paper does not address unsupervised or online learning.
invented entities (1)
  • iThermTroj (intermittent thermal trojan)
    purpose: A sporadic tampering attack that randomly alters one core's temperature reading in lowering, elevation, or fluctuation modes to evade threshold-based detectors.
    The attack exists only as a simulation algorithm (Algorithm 1) on HotSpot 6.0 traces; no fabricated chip, measured sensor output, or off-line falsifiable signal is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of iThermTroj: Exploiting Intermittent Thermal Trojans in Multi-Processor System-on-Chips." pith.science (2026). https://pith.science/paper/XMUNFHZZ

@misc{pith2026250705576,
  author       = {Pith},
  title        = {Pith review of: iThermTroj: Exploiting Intermittent Thermal Trojans in Multi-Processor System-on-Chips},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XMUNFHZZ}},
  note         = {Machine review of arXiv:2507.05576}
}
abstract

Thermal Trojan attacks present a pressing concern for the security and reliability of System-on-Chips (SoCs), especially in mobile applications. The situation becomes more complicated when such attacks are more evasive and operate sporadically to stay hidden from detection mechanisms. In this paper, we introduce Intermittent Thermal Trojans (iThermTroj) that exploit the chips' thermal information in a random time-triggered manner. According to our experiments, iThermTroj attack can easily bypass available threshold-based thermal Trojan detection solutions. We investigate SoC vulnerabilities to variations of iThermTroj through an in-depth analysis of Trojan activation and duration scenarios. We also propose a set of tiny Machine Learning classifiers for run-time anomaly detection to protect SoCs against such intermittent thermal Trojan attacks. Compared to existing methods, our approach improves the attack detection rate by 29.4\%, 17.2\%, and 14.3\% in scenarios where iThermTroj manipulates up to 80\%, 60\%, and 40\% of SoC's thermal data, respectively. Additionally, our method increases the full protection resolution to 0.8 degrees Celsius, meaning that any temperature manipulations exceeding $\pm 0.8$ degrees will be detected with 100\% accuracy.

Figures

Figures reproduced from arXiv: 2507.05576 by the authors.

Figure 1
Figure 1. b. This stark contrast highlights a critical vulnerabil [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Output parameters of six machine learning classifiers applied to 80% of the thermal data, tested across [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Detection Failure Rates of the ML Countermeasure Across Different Trojan Injection Rates and [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

22 extracted references · 22 canonical work pages

  1. [20]

    MATTER: Multi-stage Adaptive Thermal Trojan for Efficiency & Resilience degradation

    M. Elahi, M. R. Elshamy, A.-H. Badawy, M. Fazeli, and A. Patooghy, “Matter: Multi-stage adaptive thermal trojan for efficiency & resilience degradation,” 2024. [Online]. Available: https://arxiv.org/abs/2412.00226

    work page Pith review arXiv 2024

  2. [14]

    Bic: Blind identification countermeasure for malicious thermal sensor attacks in mobile socs,

    M. Abdelrehim, A. Patooghy, A. Malekmohammadi, and A.-H. A. Badawy, “Bic: Blind identification countermeasure for malicious thermal sensor attacks in mobile socs,” in 2022 23rd International Symposium on Quality Electronic Design (ISQED) . IEEE, 2022, pp. 1–6

    work page 2022

  3. [1]

    Band: coordinated multi-dnn inference on heterogeneous mobile processors,

    J. S. Jeong, J. Lee, D. Kim, C. Jeon, C. Jeong, Y . Lee, and B.-G. Chun, “Band: coordinated multi-dnn inference on heterogeneous mobile processors,” in Proceedings of the 20th Annual International Conference on Mobile Systems, Applications and Services , 2022, pp. 235–247

    work page 2022

  4. [2]

    Addressing benign and malicious crosstalk in modern system-on- chips,

    A. Patooghy, M. Elahi, M. F. Torkaman, S. S. Dokhtfaroughi, and R. Ra- jaei, “Addressing benign and malicious crosstalk in modern system-on- chips,” IEEE Access , vol. 11, pp. 142 263–142 275, 2023

    work page 2023

  5. [3]

    Fine- grained clustering-based power identification for multicores,

    M. R. Elshamy, M. Elahi, A. Patooghy, and A.-H. A. Badawy, “Fine- grained clustering-based power identification for multicores,” in 2024 IEEE 15th International Green and Sustainable Computing Conference (IGSC), 2024, pp. 165–170

    work page 2024

  6. [4]

    An efficient thermal model of chiplet heterogeneous integration system for steady- state temperature prediction,

    C. Wang, Q. Xu, C. Nie, H. Cao, J. Liu, and Z. Li, “An efficient thermal model of chiplet heterogeneous integration system for steady- state temperature prediction,” Microelectronics Reliability, vol. 146, p. 115006, 2023

    work page 2023

  7. [5]

    Machine learning for power, energy, and thermal management on multicore processors: A survey,

    S. Pagani, P. D. S. Manoj, A. Jantsch, and J. Henkel, “Machine learning for power, energy, and thermal management on multicore processors: A survey,” IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems , vol. 39, no. 1, pp. 101–116, 2020

    work page 2020

  8. [6]

    Llms in action: Robust metrics for evaluating automated ontology annotation systems,

    A. Noori, P. Devkota, S. D. Mohanty, and P. Manda, “Llms in action: Robust metrics for evaluating automated ontology annotation systems,” Information, vol. 16, no. 3, 2025. [Online]. Available: https://www.mdpi.com/2078-2489/16/3/225

    work page 2025

Show all 22 references
  1. [7]

    Performance assessment and optimization of a thin-film thermoelectric cooler for on- chip transient thermal management,

    T. Gong, L. Li, M. Shi, L. Kang, L. Gao, and J. Li, “Performance assessment and optimization of a thin-film thermoelectric cooler for on- chip transient thermal management,” Applied Thermal Engineering , vol. 224, p. 120079, 2023

    2023

  2. [8]

    Dynamic thermal management through task scheduling,

    J. Yang, X. Zhou, M. Chrobak, Y . Zhang, and L. Jin, “Dynamic thermal management through task scheduling,” in ISPASS 2008 - IEEE Inter- national Symposium on Performance Analysis of Systems and software , 2008, pp. 191–201

    2008

  3. [9]

    A novel thermal management scheme for 3d-ic chips with multi-cores and high power density,

    B. Ding, Z.-H. Zhang, L. Gong, M.-H. Xu, and Z.-Q. Huang, “A novel thermal management scheme for 3d-ic chips with multi-cores and high power density,” Applied thermal engineering , vol. 168, p. 114832, 2020

    2020

  4. [10]

    Fem-based thermal profile prediction for thermal management of system-on-chips,

    A. Oukaira, D. E. Touati, A. Hassan, M. Ali, Y . Savaria, and A. Lakhssassi, “Fem-based thermal profile prediction for thermal management of system-on-chips,” 2022 8th International Conference on Optimization and Applications (ICOA) , pp. 1–4, 2022. [Online]. Available: https:...

    2022

  5. [11]

    Untrimmed low-power thermal sensor for soc in 22 nm digital fabrication technology,

    R. Eitan and A. Cohen, “Untrimmed low-power thermal sensor for soc in 22 nm digital fabrication technology,” Journal of Low Power Electronics and Applications , vol. 4, no. 4, pp. 304–316, 2014. [Online]. Available: https://www.mdpi.com/2079-9268/4/4/304

    2014

  6. [12]

    Your hardware is all wired up! attacking network-on-chips via crosstalk channel,

    A. Patooghy, M. F. Torkaman, and M. Elahi, “Your hardware is all wired up! attacking network-on-chips via crosstalk channel,” in Proceedings of the 12th International Workshop on Network on Chip Architectures , 2019, pp. 1–6

    2019

  7. [13]

    Node-wise hardware trojan detection based on graph learning,

    K. Hasegawa, K. Yamashita, S. Hidano, K. Fukushima, K. Hashimoto, and N. Togawa, “Node-wise hardware trojan detection based on graph learning,” IEEE Transactions on Computers , 2023

    2023

  8. [15]

    Understanding the sources of power consumption in mobile socs,

    M. Said, S. Chetoui, A. Belouchrani, and S. Reda, “Understanding the sources of power consumption in mobile socs,” in 2018 Ninth International Green and Sustainable Computing Conference (IGSC) . IEEE, 2018, pp. 1–7

    2018

  9. [16]

    Power-temperature stability and safety analysis for multiprocessor systems,

    G. Bhat, S. Gumussoy, and U. Y . Ogras, “Power-temperature stability and safety analysis for multiprocessor systems,” ACM Transactions on Embedded Computing Systems (TECS) , vol. 16, no. 5s, pp. 1–19, 2017

    2017

  10. [17]

    Circuit enclaves susceptible to hardware trojans insertion at gate-level designs,

    S. M. Sebt, A. Patooghy, H. Beitollahi, and M. Kinsy, “Circuit enclaves susceptible to hardware trojans insertion at gate-level designs,” IET Computers & Digital Techniques , vol. 12, no. 6, pp. 251–257, 2018

    2018

  11. [18]

    Detection of multiple small biased gps spoofing attacks on autonomous vehicles using time series analysis,

    A. Mohammadi, R. Ahmari, V . Hemmati, F. Owusu-Ambrose, M. N. Mahmoud, P. Kebria, and A. Homaifar, “Detection of multiple small biased gps spoofing attacks on autonomous vehicles using time series analysis,” IEEE Open Journal of V ehicular Technology, pp. 1–13, 2025

    2025

  12. [19]

    Evaluating trojan attack vulnerabilities in autonomous landing systems for urban air mobility,

    R. Ahmari, V . Hemmati, A. Mohammadi, M. Mynuddin, P. Kebria, M. Mahmoud, and A. Homaifar, “Evaluating trojan attack vulnerabilities in autonomous landing systems for urban air mobility,” Proceedings of the Automation, Robotics & Communications for Industry , vol. 4, no. 5.0, ...

    2025

  13. [21]

    Thermal modeling and validation of a real-world mobile ap,

    Y .-H. Gong, J. J. Yoo, and S. W. Chung, “Thermal modeling and validation of a real-world mobile ap,” IEEE Design & Test , vol. 35, no. 1, pp. 55–62, 2017

    2017

  14. [22]

    Hotspot: A compact thermal modeling methodology for early-stage vlsi design,

    W. Huang, S. Ghosh, S. Velusamy, K. Sankaranarayanan, K. Skadron, and M. R. Stan, “Hotspot: A compact thermal modeling methodology for early-stage vlsi design,” IEEE Transactions on very large scale integration (VLSI) systems , vol. 14, no. 5, pp. 501–513, 2006

    2006

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.