Pith. sign in

REVIEW 5 major objections 6 minor 47 references

EIM-TRNG: Obfuscating Deep Neural Network Weights with Encoding-in-Memory True Random Number Generator via RowHammer

T0 review · 5 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that RowHammer bit flips, normally a DRAM reliability flaw, can serve as a physical true-random source and that encoding DNN weights with fixed plus unpredictable flips obfuscates a stolen model beyond recovery without…

desk verdict Novel idea with real DRAM measurements, but the entropy and DNN-obfuscation claims are unsupported: no randomness tests, and the application evaluation uses row swaps rather than the proposed bit-flip encoding. read the letter →

arxiv 2507.02206 v1 pith:B7NRBQP3 submitted 2025-07-03 cs.CR cs.AI

Ranyang Zhou , Abeer Matar A. Almalky , Gamana Aragonda , Sabbir Ahmed , Filip Roth Tr{o}nnes-Christensen , Adnan Siraj Rakin , Shaahin Angizi This is my paper
classification cs.CRcs.AI
keywords RowHammerDRAMTrueRandomNumberGeneratorDNNweightobfuscationhardwaresecurityentropysourcememoryencryptionside-channeldefense
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that the RowHammer effect—the same disturbance that corrupts DRAM cells—can be turned into a true random number generator, and that this randomness can be embedded directly into stored DNN weights to keep them secret. The proposed Encoding-in-Memory TRNG (EIM-TRNG) hammers the rows adjacent to a page of weights until some cells flip reliably and others hover near the sense amplifier's decision threshold, where thermal noise decides the bit value. Only the unpredictable flips are treated as entropy; they form a one-time 256-bit key, while the mixture of fixed and unpredictable flips scrambles the weight data so that an attacker with full memory visibility sees only an obfuscated model. If the claim holds, model owners can protect intellectual property on commodity DRAM without adding cryptographic hardware, and a stolen model cannot be fine-tuned back to usefulness with limited data.

What carries the argument

The load-bearing object is the set of unpredictable flips: victim-row cells whose flip probability under a fixed hammer count is strictly between 0 and 1 across repeated trials, as computed by the paper's two characterization algorithms. These cells sit at a metastable charge level near VDD/2, so the sense amplifier's decision is settled by thermal noise rather than by deterministic cell properties. Fixed flips (probability near 1) only corrupt the data, while unpredictable flips carry the entropy; the framework extracts a contiguous 256-bit segment of these cells via the column decoder and stores it in SRAM as the key that reverses the encoding. Encoding-in-Memory means the entropy is embedded in the protected data itself, so no separate key buffer in DRAM is exposed to an attacker.

What would settle it

Run repeated hammering on the same victim row at a fixed temperature, record the flip pattern of each unpredictable cell across thousands of trials, and measure per-cell min-entropy and cross-cell correlation; the central claim would be falsified if a classifier trained on half the trials predicts the other half's flips well above chance, if the total min-entropy of the selected 256 cells is substantially below 256 bits, or if re-running the full procedure with refresh and rank-level ECC enabled fails to reproduce the key.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that RowHammer-induced charge leakage pushes some victim cells into a metastable state near VDD/2, and the sense amplifier's resolution of that state is governed by thermal noise, making the resulting bit flips genuinely random. The paper identifies these cells by repeated hammering: cells whose flip count is strictly between 0 and 1000 across ten sets of 1000 trials are considered consistently vulnerable cells, and their flip probabilities vary widely across the memory array. A contiguous 256-bit segment of these unpredictable cells is read out as a cryptographic key and stored in SRAM; the original weight page is then replaced by its RowHammer-corrupted counterpart and shuffled with the encrypted page. Experiments on commodity DDR4 memory show that swapping 50 to 80 page-table entries drops ResNet-20 and ResNet-56 accuracy on CIFAR-10 to the 10% random-guess level, and that fine-tuning the obfuscated model with 1% of the training set recovers no more accuracy than training randomly initialized weights.

Load-bearing premise

The scheme assumes the cells selected as unpredictable are truly random to the attacker, even though they are found by hammering the same cells many times; if an attacker can profile those cells under the same conditions, or the flips are biased or correlated, the 256-bit key holds far less entropy than claimed.

Editorial extensions

If this is right

  • A stolen model is not directly usable: after 50 to 80 page-table swaps, the model's accuracy on CIFAR-10 falls to the random-guess level, so an attacker who copies the weight pages gets only obfuscated weights.
  • Recovery by fine-tuning fails: training the obfuscated model with 1% of the training data improves accuracy no more than starting from randomly initialized weights, so limited-data attackers cannot restore the model.
  • The scheme requires no DRAM hardware modification and generates the key offline, so the high latency and energy are paid once per protected page rather than per inference.
  • Because the key is derived from physical cell locations, the obfuscated weights remain tied to the specific memory instance; copying the DRAM contents elsewhere does not transfer the key.
  • The comparison with prior DRAM TRNGs indicates that EIM-TRNG trades throughput and energy for a one-time-use, entropy-embedded security that remains hidden even under full DRAM visibility.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: because flip locations depend on manufacturing variations in a particular chip, EIM-TRNG behaves like a physically unclonable function, but the paper does not test whether the same key is reproducible after power cycling or temperature change, which would decide its use as a stable per-device credential.
  • Beyond the paper: the experiments disable DRAM refresh and rank-level ECC to observe clean RowHammer flips, so an untested question is whether entropy and key stability survive in a normal system with refresh and ECC active.
  • Beyond the paper: the selected 256-bit key is read as a raw contiguous segment, yet per-cell flip probabilities are often far from 0.5, so without post-processing such as cryptographic hashing or debiasing the true entropy of the key may be lower than 256 bits; per-cell min-entropy measurement would quantify this.
  • Beyond the paper: the paper measures obfuscation through row-swap count, but the same scheme could be evaluated as a weight-bit error rate, which would connect directly to model-extraction defenses and let defenders choose the number of flips needed for a target accuracy drop.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes EIM-TRNG, a true random number generator that exploits RowHammer-induced bit flips in commodity DRAM to generate a 256-bit key, and applies it to obfuscate DNN weights by encoding them with fixed and unpredictable flips. The authors characterize bit-flip probabilities across cells on a Samsung DDR4 module using an FPGA platform and report that some cells flip with intermediate probabilities. They also evaluate a DNN protection scheme by swapping page-table entries in ResNet-20/56, claiming the obfuscated model has no recoverable utility. The paper argues that physical randomness from thermal noise in metastable cells provides cryptographic-grade entropy.

Significance. If the method worked as described, it would be a low-cost, no-hardware-modification approach to generate true randomness and protect DNN weights, with potential application in secure inference and IP protection. The idea of repurposing RowHammer into a defensive mechanism is interesting, and the use of a real FPGA-based DRAM testbed is a concrete step. However, the current manuscript does not establish either the entropy guarantee or the effectiveness of the proposed encoding, so the significance remains speculative.

major comments (5)
  1. [Section III-B, Section IV-B, Fig. 5] The paper claims the selected bit flips are 'truly random' due to thermal noise, but it presents no statistical validation of the extracted 256-bit key. No NIST STS, min-entropy, bias, or bit-correlation analysis is reported. Moreover, Fig. 5 shows many 'unpredictable' cells with flip probabilities around 0.1–0.8; a cell with p=0.8 has only about 0.32 bits of min-entropy per sample, so 256 such bits would provide at most roughly 82 bits of entropy even if independent. The authors must report min-entropy and randomness tests for the actual key generation procedure, including the contiguous 256-bit selection step described in Section III-C.
  2. [Section IV-D] The DNN obfuscation experiments do not test the proposed flip-based encoding. They measure accuracy after swapping N page-table rows (50 for ResNet-20, 80 for ResNet-56), which is unrelated to the bit-flip encoding described in Section III-C. To support the central claim, the authors should evaluate the actual procedure: write weights to the encryption row with the induced flips, then measure the accuracy of the obfuscated model without the key and the success of recovery attempts with guessed keys or limited training data. As written, the experiments do not validate the application.
  3. [Algorithm 1 and Section III-A] The scheme's security assumes an attacker cannot model the 'unpredictable' cells, but the defender identifies these cells by repeated hammering. If the attacker has the same DRAM access, as the threat model grants partial low-level system access, they can run the same procedure to estimate each p_i and apply maximum-likelihood decoding to the 256-bit key. The paper provides no security analysis of this attack, no whitening or conditioning step, and no mechanism to prevent an attacker from learning the cell characteristics.
  4. [Section III-C and Table I] There is a direct contradiction: step 5 states the extracted 256-bit key is stored in on-chip SRAM, while Table I lists EIM-TRNG as 'No buffer/key; entropy embedded in data.' This contradiction is material because the security and one-time-use claims depend on whether the key is stored separately or is only implicit in the data. The authors need to clarify the storage architecture and analyze the associated risks.
  5. [Section IV-B, Section IV-C, Algorithms 1–2] The experimental characterization is limited to a single Samsung DDR4 module and reports only a handful of cells (about 30 in Fig. 5 and 10 in Fig. 6). No data are provided on the density of unpredictable cells in a contiguous address space, nor on whether a contiguous 256-bit segment with sufficient entropy exists on the tested module. Without this, the key-generation procedure cannot be reproduced or verified.
minor comments (6)
  1. [Algorithm 2 title] The title contains a typo: 'V arying' should be 'Varying.'
  2. [Table I caption] The abbreviation 'Thpt' is used without definition in the table body; the footnote defines it, but the caption should also clarify the abbreviation for readability.
  3. [Section IV-A] The hardware setup lists 'Date: 2053' for the DRAM chip, which appears to be a typo and should be corrected.
  4. [Reference [43]] Reference [43] is cited as the DDR4 standard (JESD79-4C) but the URL points to a Xilinx page; the citation should point to the actual JEDEC standard.
  5. [Fig. 5] The y-axis is labeled 'Bit Cell Row Number' but lists individual cell identifiers; consider clarifying the axis label as 'Cell ID' to avoid confusion.
  6. [Section III-B] The term 'metastability' is used to describe charge leakage toward VDD/2; since DRAM sense amplifiers resolve binary values, the description should distinguish between charge-level uncertainty and actual circuit metastability.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the TRNG and DNN-obfuscation claims rest on empirical assertions and implementation choices, not on reductions of outputs to inputs.

full rationale

The paper's derivation chain is self-contained in the sense required by this circularity analysis. It does not fit a parameter to one quantity and then repackage that same quantity as a prediction; the 256-bit key is assembled from cells empirically observed to flip with partial probability, and calling these cells 'unpredictable' is an operational definition of the entropy source rather than a reduction of the claimed key entropy to the selection procedure. The assertion in Section III-B that thermal noise makes metastable cells 'truly random' is an unsupported physical claim, and the absence of NIST-style randomness tests or min-entropy estimates is a validation gap, not an equation-level circularity. Likewise, the DNN evaluation in Section IV-D measures accuracy after page-row swaps rather than after the proposed bit-flip encoding, but that is an empirical mismatch between experiment and proposal, not a circular derivation. The paper contains numerous self-citations (e.g., [19], [21], [27], [34], [35], [37]), but they provide background and prior attack/defense context and are not load-bearing for the TRNG construction; no cited uniqueness theorem is invoked to forbid alternatives, and no ansatz is smuggled in via the authors' prior work. Because no specific reduction of a claimed result to its own inputs can be exhibited, the appropriate finding is no significant circularity.

Assumptions & free parameters 5 free parameters · 3 assumptions · 0 invented entities

The central claim rests on several empirical choices: HC, cell-selection criteria, 256-bit segment, row swaps, and the assumption of attacker ignorance. None are derived from first principles, and the DNN obfuscation experiment is decoupled from the TRNG bit-flip statistics.

free parameters (5)
  • Hammer Count (HC) = 1,000,000 activations; swept from 450,000 to 550,000 in Fig. 6
    Chosen to induce RowHammer flips; not derived from first principles, and key behavior depends on it.
  • Vulnerable-cell selection threshold = 0 < flip_count < 1000 per set; intersection across 10 sets
    Defines which cells count as 'unpredictable'; arbitrary and affects the entropy estimate.
  • Key segment selection = 256 contiguous bits selected by density of unpredictable flips
    Key size fixed by design; the contiguous selection rule is heuristic and not validated for independence.
  • Number of row swaps N = 50 for ResNet-20, 80 for ResNet-56
    Fitted to the target of 10% CIFAR-10 accuracy; not derived from TRNG flip statistics.
  • Retraining data fraction = 1% of CIFAR-10 training set
    Chosen as the attacker's data budget; the result compares to random initialization but is not a security bound.
assumptions (3)
  • domain assumption RowHammer bit flips in selected cells are driven by thermal noise and are truly unpredictable to an adversary
    Invoked in Section III-B; no physical model or measurement of min-entropy is provided.
  • domain assumption The intersection of vulnerable-cell sets across 10 repeated experiments identifies a stable set of entropy cells
    Algorithm 1; assumes temporal and temperature stability of 'unpredictable' behavior, not demonstrated.
  • domain assumption An attacker with partial low-level access cannot observe or reproduce the exact flip pattern of the selected cells
    Threat model in Section III-A and security discussion in Section IV-E; unproven and requires a profiling attack analysis.

how reviews work

0 comments
Cite this review

Pith. "Pith review of EIM-TRNG: Obfuscating Deep Neural Network Weights with Encoding-in-Memory True Random Number Generator via RowHammer." pith.science (2026). https://pith.science/paper/B7NRBQP3

@misc{pith2026250702206,
  author       = {Pith},
  title        = {Pith review of: EIM-TRNG: Obfuscating Deep Neural Network Weights with Encoding-in-Memory True Random Number Generator via RowHammer},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/B7NRBQP3}},
  note         = {Machine review of arXiv:2507.02206}
}
read the original abstract

True Random Number Generators (TRNGs) play a fundamental role in hardware security, cryptographic systems, and data protection. In the context of Deep NeuralNetworks (DNNs), safeguarding model parameters, particularly weights, is critical to ensure the integrity, privacy, and intel-lectual property of AI systems. While software-based pseudo-random number generators are widely used, they lack the unpredictability and resilience offered by hardware-based TRNGs. In this work, we propose a novel and robust Encoding-in-Memory TRNG called EIM-TRNG that leverages the inherent physical randomness in DRAM cell behavior, particularly under RowHammer-induced disturbances, for the first time. We demonstrate how the unpredictable bit-flips generated through carefully controlled RowHammer operations can be harnessed as a reliable entropy source. Furthermore, we apply this TRNG framework to secure DNN weight data by encoding via a combination of fixed and unpredictable bit-flips. The encrypted data is later decrypted using a key derived from the probabilistic flip behavior, ensuring both data confidentiality and model authenticity. Our results validate the effectiveness of DRAM-based entropy extraction for robust, low-cost hardware security and offer a promising direction for protecting machine learning models at the hardware level.

Figures

Figures reproduced from arXiv: 2507.02206 by the authors.

Figure 1
Figure 1. Organization of a DRAM chip. Time (tRP ) determines the minimum time required between a PRE and a new ACT command. This interval is crucial for closing an active WL and resetting the bitlines (BLs) to the precharge voltage of VDD 2 . Additionally, DRAM retention time denotes the maximum period a cell can reliably store data before requiring a refresh operation. The Refresh Window (tREFW ) specifies the time frame wi… view at source ↗
Figure 2
Figure 2. (a) Prescribing RowHammer by increasing HC to create a metastability [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Overview of the EIM-TRNG and encrypted weight storage framework. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Xilinx Alveo U200 FPGA & Host PC. B. Distribution of Unpredictable Bits To evaluate the susceptibility of DRAM cells under RowHammer stress, we first focus on characterizing the num￾ber and distribution of affected cells when subjected to a fixed number of activations,…
Figure 5
Figure 5. Figure 5: Bit-flip probabilities of selected DRAM cells after applying RowHam [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Bit-Flip behavior of selected DRAM cells under RowHammer Attacks with the mean bit-flip count for ten individual DRAM cells across varying [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

47 extracted references · 45 canonical work pages

  1. [1]

    Eden: Enabling energy-efficient, high- performance deep neural network inference using approximate dram,

    S. Koppula, L. Orosa, A. G. Ya ˘glıkc ¸ı, R. Azizi, T. Shahroodi, K. Kanellopoulos, and O. Mutlu, “Eden: Enabling energy-efficient, high- performance deep neural network inference using approximate dram,” in Proceedings of the 52nd Annual IEEE/ACM International Symposium on Microarchitecture, 2019, pp. 166–181

    work page 2019

  2. [2]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” arXiv preprint arXiv:1412.6572 , 2014

    arXiv 2014

  3. [3]

    Deepsteal: Advanced model extractions leveraging efficient weight stealing in memories,

    A. S. Rakin, M. H. I. Chowdhuryy, F. Yao, and D. Fan, “Deepsteal: Advanced model extractions leveraging efficient weight stealing in memories,” in 2022 IEEE SP . IEEE, 2022, pp. 1157–1174

    work page 2022

  4. [4]

    Compro- mising the intelligence of modern dnns: On the effectiveness of targeted rowpress,

    R. Zhou, J. T. Liu, S. Ahmed, S. Angizi, and A. S. Rakin, “Compro- mising the intelligence of modern dnns: On the effectiveness of targeted rowpress,” in 2025 Design, Automation & Test in Europe Conference (DATE). IEEE, 2025, pp. 1–7

    work page 2025

  5. [5]

    Delay sensitivity polynomials based design- dependent performance monitors for wide operating ranges,

    R. Shi, L. Yang, and H. Wang, “Delay sensitivity polynomials based design- dependent performance monitors for wide operating ranges,” in 2020 Design, Automation & Test in Europe Conference & Exhibition (DATE), 2020, pp. 1610–1613

    work page 2020

  6. [6]

    Tbnet: A neural architectural defense framework facilitating dnn model protection in trusted execution environments,

    Z. Liu, T. Zhou, Y . Luo, and X. Xu, “Tbnet: A neural architectural defense framework facilitating dnn model protection in trusted execution environments,” in Proceedings of the 61st ACM/IEEE Design Automa- tion Conference, 2024, pp. 1–6

    work page 2024

  7. [7]

    Mirrornet: A tee-friendly framework for secure on-device dnn inference,

    Z. Liu, Y . Luo, S. Duan, T. Zhou, and X. Xu, “Mirrornet: A tee-friendly framework for secure on-device dnn inference,” in 2023 IEEE/ACM International Conference on Computer Aided Design (ICCAD) . IEEE, 2023, pp. 1–9

    2023

  8. [8]

    Secureml: A system for scalable privacy- preserving machine learning,

    P. Mohassel and Y . Zhang, “Secureml: A system for scalable privacy- preserving machine learning,” in 2017 IEEE symposium on security and privacy (SP) . IEEE, 2017, pp. 19–38

    work page 2017

Show all 47 references
  1. [9]

    Embedding water- marks into deep neural networks,

    Y . Uchida, Y . Nagai, S. Sakazawa, and S. Satoh, “Embedding water- marks into deep neural networks,” in Proceedings of the 2017 ACM on international conference on multimedia retrieval , 2017, pp. 269–277

    2017

  2. [10]

    A survey of hardware random number generators,

    C. Wallace, “A survey of hardware random number generators,” Pro- ceedings of the IEEE , vol. 85, no. 4, pp. 845–857, 2001

    2001

  3. [11]

    A provably secure true random number generator with built-in tolerance to active attacks,

    B. Sunar, W. J. Martin, and D. R. Stinson, “A provably secure true random number generator with built-in tolerance to active attacks,” IEEE Transactions on Computers , vol. 56, no. 1, pp. 109–119, 2007

    2007

  4. [12]

    True random number generators,

    M. Dichtl, “True random number generators,” in Cryptographic Engi- neering. Springer, 2007, pp. 223–244

    2007

  5. [13]

    Drng: Dram-based random number generation using its startup value behavior,

    C. Eckert, F. Tehranipoor, and J. A. Chandy, “Drng: Dram-based random number generation using its startup value behavior,” in 2017 IEEE 60th International Midwest Symposium on Circuits and Systems (MWSCAS) . IEEE, 2017, pp. 1260–1263

    2017

  6. [14]

    Dtrng: Low cost and robust true random number generator using dram weak write scheme,

    K. Humood, B. Mohammad, and H. Abunahla, “Dtrng: Low cost and robust true random number generator using dram weak write scheme,” in 2021 IEEE International Symposium on Circuits and Systems (ISCAS) . IEEE, 2021, pp. 1–5

    2021

  7. [15]

    Fracdram: Fractional values in off-the-shelf dram,

    F. Gao, G. Tziantzioulis, and D. Wentzlaff, “Fracdram: Fractional values in off-the-shelf dram,” in MICRO. IEEE, 2022, pp. 885–899

    2022

  8. [16]

    Quac-trng: High-throughput true random number generation using quadruple row activation in commodity dram chips,

    A. Olgun, M. Patel, A. G. Ya ˘glıkc ¸ı, H. Luo, J. S. Kim, F. N. Bostancı, N. Vijaykumar, O. Ergin, and O. Mutlu, “Quac-trng: High-throughput true random number generation using quadruple row activation in commodity dram chips,” in ISCA. IEEE, 2021, pp. 944–957

    2021

  9. [17]

    Threshold breaker: Can counter-based rowhammer prevention mecha- nisms truly safeguard dram?

    R. Zhou, J. Liu, S. Ahmed, N. Kochar, A. S. Rakin, and S. Angizi, “Threshold breaker: Can counter-based rowhammer prevention mecha- nisms truly safeguard dram?” arXiv preprint arXiv:2311.16460 , 2023

    2023 arXiv

  10. [18]

    Flipping bits in memory without accessing them: An experimental study of dram disturbance errors,

    Y . Kim, R. Daly, J. Kim, C. Fallin, J. H. Lee, D. Lee, C. Wilkerson, K. Lai, and O. Mutlu, “Flipping bits in memory without accessing them: An experimental study of dram disturbance errors,” ACM SIGARCH Computer Architecture News , vol. 42, no. 3, pp. 361–372, 2014

    2014

  11. [19]

    Lt-pim: An lut-based processing-in-dram architecture with rowhammer self-tracking,

    R. Zhou, S. Tabrizchi, A. Roohi, and S. Angizi, “Lt-pim: An lut-based processing-in-dram architecture with rowhammer self-tracking,” IEEE Computer Architecture Letters , vol. 21, no. 2, pp. 141–144, 2022

    2022

  12. [20]

    Uncovering in-dram rowhammer protection mechanisms: A new methodology, custom rowhammer patterns, and implications,

    H. Hassan, Y . C. Tugrul, J. S. Kim, V . Van der Veen, K. Razavi, and O. Mutlu, “Uncovering in-dram rowhammer protection mechanisms: A new methodology, custom rowhammer patterns, and implications,” in MICRO-54: 54th Annual IEEE/ACM International Symposium on Microarchitecture,...

    2021

  13. [21]

    Assessing the potential of escalating rowhammer attack distance to bypass counter-based defenses,

    R. Zhou, J. Liu, S. Ahmed, N. Kochar, A. S. Rakin, and S. Angizi, “Assessing the potential of escalating rowhammer attack distance to bypass counter-based defenses,” IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems , 2024

    2024

  14. [22]

    Red-lut: Reconfigurable in- dram luts enabling massive parallel computation,

    R. Zhou, A. Roohi, D. Misra, and S. Angizi, “Red-lut: Reconfigurable in- dram luts enabling massive parallel computation,” in Proceedings of the 41st IEEE/ACM International Conference on Computer-Aided Design , 2022, pp. 1–8

    2022

  15. [23]

    Flexidram: A flexible in-dram framework to enable parallel general-purpose computation,

    ——, “Flexidram: A flexible in-dram framework to enable parallel general-purpose computation,” in Proceedings of the ACM/IEEE Inter- national Symposium on Low Power Electronics and Design , 2022, pp. 1–6

    2022

  16. [24]

    Exploiting the dram rowhammer bug to gain kernel privileges,

    M. Seaborn and T. Dullien, “Exploiting the dram rowhammer bug to gain kernel privileges,” Black Hat , vol. 15, p. 71, 2015

    2015

  17. [25]

    Understanding rowhammer under reduced refresh latency: Experimental analysis of real dram chips and implications on future solutions,

    Y . C. Tu ˘grul, A. G. Ya ˘glıkc ¸ı,˙I. E. Y ¨uksel, A. Olgun, O. Canpolat, N. Bostancı, M. Sadrosadati, O. Ergin, and O. Mutlu, “Understanding rowhammer under reduced refresh latency: Experimental analysis of real dram chips and implications on future solutions,” in 2025 IEEE...

    2025

  18. [26]

    Dram bender: An extensible and versatile fpga-based infrastructure to easily test state-of-the-art dram chips,

    A. Olgun, H. Hassan, A. G. Ya ˘glıkc ¸ı, Y . C. Tu˘grul, L. Orosa, H. Luo, M. Patel, O. Ergin, and O. Mutlu, “Dram bender: An extensible and versatile fpga-based infrastructure to easily test state-of-the-art dram chips,” IEEE Transactions on Computer-Aided Design of Integrate...

    2023

  19. [27]

    Dram-locker: A general-purpose dram protection mechanism against adversarial dnn weight attacks,

    R. Zhou, S. Ahmed, A. Roohi, A. S. Rakin, and S. Angizi, “Dram-locker: A general-purpose dram protection mechanism against adversarial dnn weight attacks,” in 2024 Design, Automation & Test in Europe Confer- ence & Exhibition (DATE) . IEEE, 2024, pp. 1–6

    2024

  20. [28]

    Refault: A fault injection platform for rowhammer research on ddr5 memory,

    S. Gloor, P. Jattke, and K. Razavi, “Refault: A fault injection platform for rowhammer research on ddr5 memory,” in Proceedings of the Microarchitecture Security Conference , 2025

    2025

  21. [29]

    Architectural support for mitigating row hammering in dram memories,

    D.-H. Kim, P. J. Nair, and M. K. Qureshi, “Architectural support for mitigating row hammering in dram memories,” IEEE Computer Architecture Letters, vol. 14, no. 1, pp. 9–12, 2014

    2014

  22. [30]

    Hydra: enabling low-overhead mitigation of row-hammer at ultra-low thresholds via hybrid tracking,

    M. Qureshi, A. Rohan, G. Saileshwar, and P. J. Nair, “Hydra: enabling low-overhead mitigation of row-hammer at ultra-low thresholds via hybrid tracking,” in Proceedings of the 49th Annual International Symposium on Computer Architecture , 2022, pp. 699–710

    2022

  23. [31]

    Twice: Preventing row-hammering by exploiting time window counters,

    E. Lee, I. Kang, S. Lee, G. E. Suh, and J. H. Ahn, “Twice: Preventing row-hammering by exploiting time window counters,” in Proceedings of the 46th International Symposium on Computer Architecture , 2019, pp. 385–396

    2019

  24. [32]

    Graphene: Strong yet lightweight row hammer protection,

    Y . Park, W. Kwon, E. Lee, T. J. Ham, J. H. Ahn, and J. W. Lee, “Graphene: Strong yet lightweight row hammer protection,” in 2020 53rd Annual IEEE/ACM International Symposium on Microarchitecture (MICRO). IEEE, 2020, pp. 1–13

    2020

  25. [33]

    Trrespass: Exploiting the many sides of target row refresh,

    P. Frigo, E. Vannacc, H. Hassan, V . Van Der Veen, O. Mutlu, C. Giuf- frida, H. Bos, and K. Razavi, “Trrespass: Exploiting the many sides of target row refresh,” in 2020 IEEE Symposium on Security and Privacy (SP). IEEE, 2020, pp. 747–762

    2020

  26. [34]

    Dnn-defender: A victim-focused in-dram defense mechanism for taming adversarial weight attack on dnns,

    R. Zhou, S. Ahmed, A. S. Rakin, and S. Angizi, “Dnn-defender: A victim-focused in-dram defense mechanism for taming adversarial weight attack on dnns,” in Proceedings of the 61st ACM/IEEE Design Automation Conference, 2024, pp. 1–6

    2024

  27. [35]

    P- pim: A parallel processing-in-dram framework enabling row hammer protection,

    R. Zhou, S. Tabrizchi, M. Morsali, A. Roohi, and S. Angizi, “P- pim: A parallel processing-in-dram framework enabling row hammer protection,” in 2023 Design, Automation & Test in Europe Conference & Exhibition (DATE) . IEEE, 2023, pp. 1–6

    2023

  28. [36]

    Chronus: Understanding and securing the cutting-edge industry solutions to dram read disturbance,

    O. Canpolat, A. G. Ya ˘glıkc ¸ı, G. F. Oliveira, A. Olgun, N. Bostancı, I. E. Yuksel, H. Luo, O. Ergin, and O. Mutlu, “Chronus: Understanding and securing the cutting-edge industry solutions to dram read disturbance,” in 2025 IEEE International Symposium on High Performance Co...

    2025

  29. [37]

    A novel insight into the vulnerability of ddr4 dram cells across multiple hammering settings,

    R. Zhou, J. Liu, N. Kochar, S. Ahmed, A. S. Rakin, and S. Angizi, “A novel insight into the vulnerability of ddr4 dram cells across multiple hammering settings,” IEEE Embedded Systems Letters , vol. 16, no. 4, pp. 337–340, 2024

    2024

  30. [38]

    Deepsniffer: A dnn model extraction framework based on learning architectural hints,

    X. Hu, L. Liang, S. Li, L. Deng, P. Zuo, Y . Ji, X. Xie, Y . Ding, C. Liu, T. Sherwood et al. , “Deepsniffer: A dnn model extraction framework based on learning architectural hints,” in Proceedings of the Twenty-Fifth International Conference on Architectural Support for Progr...

    2020

  31. [39]

    Csinn: Reverse engineering of neural network architectures through electromagnetic side channel,

    L. Batina, S. Bhasin, D. Jap, and S. Picek, “Csinn: Reverse engineering of neural network architectures through electromagnetic side channel,” in 28th USENIX Security Symposium (USENIX Security 19) , 2019, pp. 515–532

    2019

  32. [40]

    Deep-troj: An inference stage trojan insertion algorithm through efficient weight replacement attack,

    S. Ahmed, R. Zhou, S. Angizi, and A. S. Rakin, “Deep-troj: An inference stage trojan insertion algorithm through efficient weight replacement attack,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2024, pp. 24 810–24 819

    2024

  33. [41]

    Pt-guard: Integrity-protected page tables to defend against breakthrough rowhammer attacks,

    A. Saxena, G. Saileshwar, J. Juffinger, A. Kogler, D. Gruss, and M. Qureshi, “Pt-guard: Integrity-protected page tables to defend against breakthrough rowhammer attacks,” in 2023 53rd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) . IEEE, 20...

    2023

  34. [42]

    [Online]

    (2021) Xilinx inc., xilinx alveo u200 fpga board. [Online]. Available: https://www.xilinx.com/products/boards-and-kits/alveo.html

    2021

  35. [43]

    [Online]

    (2020) Jesd79-4c: Ddr4 sdram standard. [Online]. Available: https://www.xilinx.com/products/boards-and-kits/alveo.html

    2020

  36. [44]

    D-range: Using commodity dram devices to generate true random numbers with low latency and high throughput,

    J. S. Kim, M. Patel, H. Hassan, L. Orosa, and O. Mutlu, “D-range: Using commodity dram devices to generate true random numbers with low latency and high throughput,” in 2019 IEEE International Symposium on High Performance Computer Architecture (HPCA) . IEEE, 2019, pp. 582–595

    2019

  37. [45]

    Dr-strange: End-to-end system design for dram-based true random number generators,

    F. N. Bostancı, A. Olgun, L. Orosa, A. G. Ya ˘glıkc ¸ı, J. S. Kim, H. Hassan, O. Ergin, and O. Mutlu, “Dr-strange: End-to-end system design for dram-based true random number generators,” arXiv preprint arXiv:2201.01385, 2022

    2022 arXiv

  38. [46]

    Exploiting dram latency variations for generating true random numbers,

    M. A. Rahman and S. Ray, “Exploiting dram latency variations for generating true random numbers,” in 2019 IEEE Computer Society Annual Symposium on VLSI (ISVLSI) . IEEE, 2019, pp. 35–40

    2019

  39. [47]

    The cifar-10 dataset,

    A. Krizhevsky, V . Nair, and G. Hinton, “The cifar-10 dataset,” online: http://www. cs. toronto. edu/kriz/cifar . html , vol. 55, 2014

    2014

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.