Characterizing the Variance Envelope: A Multi-Dimensional Analysis of Spectre Telemetry Across Architectures and Workloads

Preprint working draft.

Characterizing the Variance Envelope: A Multi-Dimensional Analysis of Spectre Telemetry Across Architectures and Workloads Jaya Keshava Chandra Kotha

Jean-Luc Gaudiot

arXiv:2608.13920v1 [cs.CR] 14 Aug 2026

Department of Electrical Engineering and Computer Science Department of Electrical Engineering and Computer Science University of California, Irvine University of California, Irvine Student member, IEEE Life Fellow, IEEE

Abstract—Hardware attacks like Spectre exploit built-in processor vulnerabilities, leaving anomalous footprints in Hardware Performance Counter (HPC) metrics. While machine learning can detect these footprints in controlled settings, static models fail in the real world when confronted with background system noise, diverse attack variants, and adversarial traffic pacing. To close this gap, this paper characterizes the “variance envelope”—the full range of how attack signatures shift—across Intel, ARM, and AMD architectures. We evaluate an extensive experimental matrix encompassing three attack variants, four pacing modes, and four background-noise conditions. Our analysis proves that HPC signatures are highly fragile and easily warped by their execution environment. Furthermore, we expose a critical microarchitectural bottleneck: the persistent, hardware-level failure of Prime+Probe attacks on the AMD Jaguar. Ultimately, this comprehensive characterization demonstrates the fundamental limits of static detection thresholds. By proving that signatures are deeply intertwined with underlying execution environments, this study establishes the empirical foundation required for future work in advanced adaptive modeling and hybrid detection architectures.

The detection challenge is further compounded by the diversity of side-channel leakage mechanisms. Most detectors focus on Flush+Reload techniques, which rely on the direct timing of shared memory lines, or Prime+Probe techniques, which infer data by measuring set-based disturbance across the cache hierarchy. Because these two primitives interact with the cache controller in fundamentally different ways, a detector trained exclusively on one often remains blind to the microarchitectural footprint of the other. Recent Systematization of Knowledge (SoK) studies confirm that current detectors fail under realistic threat models because they are trained and evaluated in artificially constrained environments [7]. Specifically, the field lacks a well-defined characterization of how Spectre HPC signatures manifest across varying workloads and hardware configurations. This absence of a stable threat signature means current models cannot reliably distinguish between malicious activity and stochastic benign fluctuations. Building upon early foundational work that establishes both the feasibility of ML detection [8] and the threat of adversarial pacing [3], we argue that a model cannot adapt to a new domain until its variance envelope—the full range of how attack signatures shift under varying conditions—is thoroughly mapped. To answer the community’s call for realistic threat modeling, this paper presents a comprehensive empirical characterization of Spectre HPC signatures. Our core contributions are:

1. Introduction Hardware security operates as a continuous arms race. As vulnerabilities like Spectre [1] emerge, researchers increasingly deploy Machine Learning (ML) models that monitor Hardware Performance Counters (HPCs) to detect the anomalous telemetry generated by transient execution attacks.

• Multi-Variant and Multi-Architecture Profiling:

We evaluate telemetry shifts across three attack mechanisms (Spectre V1, V2) and two primary leakage channels (Flush+Reload and Prime+Probe) across four devices spanning three architectures (Intel, ARM, and AMD)1

While prior works [2]–[6] obtain near-perfect detection accuracy in isolated environments, these static ML detectors suffer from an illusion of portability and frequently fail in real-world systems. This fragility stems from evaluating a single attack mechanism on a single microarchitecture under idealized, continuous execution. In reality, attacker behavior, background system noise, and the underlying hardware interact to severely distort HPC telemetry distributions.

1. A Note on Hardware Nomenclature: The specific devices evaluated in this study are treated as individual microarchitectural instances. They are not intended to represent the entirety of their respective Instruction Set Architectures (ISAs) or broader product families. We utilize these labels throughout the paper strictly for clarity and usability of reference to our specific testbeds.

1

• System Interference and Background Noise: We

As illustrated in Figure 1(a), the attacker trains the Pattern History Table (PHT) to cause speculative secret access, which manifests in HPC telemetry as anomalous spikes in conditional branch mispredictions. Conversely, Spectre V2 (Branch Target Injection) [1], [11] poisons the indirect branch predictors, such as the Branch Target Buffer (BTB). As detailed in Figure 1(b), this shifts the microarchitectural footprint toward indirect branch speculation metrics.

measure signal degradation under diverse system loads (Idle, CPU, Memory, Mixed) to identify which HPC metrics are resilient and which collapse under environmental pressure. • Adversarial Pacing and Traffic Shaping: We quan-

tify how attacker evasion tactics (such as rate-limiting, burst, and batch execution) alter the stability of HPC telemetry. • Hardware-Intrinsic

Attack Mitigation: We document how specific microarchitectural constraints, such as the persistent failure of the Prime+Probe exploit on the AMD Jaguar architecture, act as inherent defenses. By proving that specific topological cache constraints—such as strict bank-routing structures—actively neutralize the attack, we demonstrate why cross-platform signature uniformity is physically impossible.

This paper provides a novel workload characterization of speculative attack signatures throughout different microarchitectural domains. We demonstrate that detection resiliency is inherently constrained by a telemetry-workload gap, where architectural bottlenecks and environmental noise cause a catastrophic collapse in signal separability.

Figure 1. Microarchitectural hardware schematic contrasting Spectre variants. (a) Spectre V1 exploits the conditional Pattern History Table (PHT). (b) Spectre V2 poisons the indirect Branch Target Buffer (BTB).

The remainder of this paper is structured as follows. Section 2 outlines the observability channels and Section 3 dives into the evolution of HPC detection. Section 4 details our experimental matrix. Sections 5 through 6 analyze the domain shifts caused by architecture, noise, and pacing. Finally, Section 7discusses the broader implications of these microarchitectural bottlenecks and outlines our avenues for future work, specifically the necessity for advanced adaptive modeling and hybrid detection architectures.

2.1.2. Observability Channels. Once sensitive data is speculatively accessed, it must be transmitted via a covert channel. The Flush+Reload channel [12], [13] relies on direct timing differences of shared memory lines. As shown in Figure 2(a), it generates a highly precise, surgical signature of cache hits and misses. In contrast, Prime+Probe [14]–[16] infers data by measuring set-based disturbance across the cache hierarchy. As depicted in Figure 2(b), the reliance on eviction set construction and broader cache contention significantly changes the resulting telemetry profile.

2. Background To understand why static detection models fail across different computing environments, we must first establish how transient execution attacks generate observable telemetry. This section details the distinct phases of a speculative attack—from the initial branch misprediction to cache-based exfiltration—and explains how underlying architectural differences dictate the resulting Hardware Performance Counter (HPC) signatures.

2.2. HPC Semantics and Cache Hierarchy HPCs are microarchitectural features; their semantics are strictly hardware-dependent. The most critical divergence for side-channel observability lies in the cache inclusion policy [17]. In inclusive hierarchies (predominant in many Intel processors), the Last Level Cache (LLC) acts as a directory for all lower-level lines. Saturating an LLC set triggers an automatic “back-invalidation” that forces data out of the L1, creating a high-magnitude, detectable HPC signature. In contrast, alternative topologies (such as the banked L2 structure of the AMD Jaguar) enforce strict physical memory routing, which severely misaligns standard, unified eviction sets and prevents reliable L1 backinvalidation [3].

2.1. Transient Execution and Leakage Channels While all Spectre-family attacks exploit speculative execution, their demands on the microarchitecture diverge significantly based on the mechanism and the channel. 2.1.1. Attack Mechanisms. Spectre V1 (Bounds Check Bypass) [1], [9], [10] coerces the processor into speculatively executing instructions past a mispredicted bounds check.

2

specific evasion space of transient execution vulnerabilities or evaluate adversarial adaptation.

3.2. The SoK Era: Recognizing Fragility Recognizing that sophisticated attackers will attempt to evade static thresholds, Li et al. [3] introduced the concept of “Adversarial Pacing,” proving that attackers can bypass detection by artificially limiting their execution throughput. While their work effectively modeled the attacker’s evasion strategy, it was limited to a single architectural domain. More recently, the Systematization of Knowledge (SoK) by Kosasih et al. [7] comprehensively analyzed 50 prior works, concluding that the vast majority of proposed HPC detectors remain critically vulnerable. The SoK identified a systemic failure in the literature to account for “Domain Shifts”—specifically highlighting the lack of realistic threat models that combine architectural variance, environmental noise, and adversarial pacing. Figure 2. Comparison of cache side-channel leakage mechanisms. (a) Flush+Reload relies on shared memory lines. (b) Prime+Probe measures set-based disturbance.

3.3. Research Gap and Contributions of this Work

3. Related Work As summarized in Table 1, this work directly answers the SoK’s critique by addressing the fundamental research gap: the absence of a multidimensional threat model evaluation. We provide the first unified empirical characterization that simultaneously maps cross-ISA drift, multi-variant signatures, system noise interference, and adversarial pacing. Furthermore, we evaluate the “quality” of this characterization by quantifying the detection collapse of standard models (Section 5.5), providing the realistic threat model evaluation that the current state-of-the-art lacks.

The use of hardware performance counters for security evolves through three distinct research epochs, moving from general malware classification to the current recognition of signature fragility.

3.1. Malware Classification and Speculative Defense Early feasibility studies demonstrated that hardware performance counters could successfully identify anomalous execution patterns without incurring the overhead of software instrumentation. Tang et al. [18] pioneered this approach by using unsupervised machine learning to classify general malware signatures. Following the disclosure of transient execution vulnerabilities, researchers adapted these techniques specifically for Spectre and Meltdown. Li et al. [8] provided foundational proof-of-concept thresholds, demonstrating that hardware vulnerabilities leave distinct footprints in cache and branching metrics. Kotha et al. [2] expanded on this by proving the feasibility of high-accuracy Multi-Layer Perceptrons (MLPs) for detecting unthrottled speculative bursts. While these early works successfully proved that ML-based detection is possible, their primary weakness lies in their evaluation under isolated, ideal conditions, failing to account for the signal degradation caused by real-world system noise.

TABLE 1. Comparison of the Characterization Matrix Against Prior HPC Security Literature. CI = Cross-ISA, MV = Multi-Variant, SN = System Noise, AP = Adversarial Pacing. Reference Tang et al. [18] Li et al. [8]

CI × ×

MV × ×

SN × ×

AP × ×

Larson et al. [4]

✓

×

×

×

Kotha et al. [2] Kosasih et al. [7] Li et al. [3]

× × ×

× ✓ ×

✓ × ✓

× × ✓

This Work

✓

✓

✓

✓

Primary Objective General anomaly classification Proof-of-concept ML thresholds Basic cross-platform measurement High-accuracy MLP feasibility Systematization of ML failures Attacker throughput vs. detection Empirical characterization of multi-dimensional domain shifts

4. Experimental Methodology

To address the limitations of single-device evaluations, subsequent research began exploring cross-platform telemetry. Larson et al. [4] conducted basic cross-platform measurements for edge devices, establishing that HPC behavior diverges across architectures. However, their work primarily focused on general malicious attacks and did not map the

To capture the microarchitectural variance of transient execution attacks, our experimental framework systematically isolates the variables that distort HPC telemetry. We evaluate three distinct attack profiles (Spectre V1 with Flush+Reload, Spectre V2 with a Flush+Reload-like timing

3

leak, and Spectre V1 with Prime+Probe) across a multidimensional matrix of hardware topologies, environmental interference, and adversarial traffic shaping.

unmitigated footprint of the attacks, we needed systems completely free of these black-box filters. Most importantly, the primary architectural difference we evaluated—inclusive versus non-inclusive cache design—remains highly relevant today. Modern enterprise servers (such as Intel Xeon Scalable and AMD Zen) have shifted toward non-inclusive or exclusive caches to manage massive memory capacities. Therefore, the hardware dynamics we isolated on our test machines apply directly to today’s high-performance processors.

4.1. Hardware Testbed and Architectural Diversity We deploy our attack implementations across four distinct microarchitectures, representing a spectrum of speculative depths, cache replacement policies, and instruction sets: • Intel Core i7-3537U (Ivy Bridge): Serves as our pri-

4.2. Adversarial Pacing and Traffic Shaping

mary baseline representing deep-speculation pipelines with strictly inclusive Last-Level Caches (LLC). (Referred to hereafter and in figures as Intel 1).

To model a sophisticated adversary attempting to blend into benign background noise, we introduce traffic shaping. We deliberately mix four pacing modes to evaluate attack robustness and throughput-confidence trade-offs by modulating the frequency and duration of speculative cacheprobing operations:

• Intel Core i5-7200U (Kaby Lake): Acts as a sec-

ondary inclusive-cache baseline to isolate and quantify intra-ISA (generational) telemetry variance. (Referred to hereafter and in figures as Intel 2). • ARM Cortex-A76: Represents modern RISC archi-

• Unthrottled Mode: Performs continuous speculative

tectures featuring a non-inclusive L3 victim cache, enabling the study of cross-ISA telemetry shifts in decoupled hierarchies.

memory reads and subsequent cache-line reloads with no explicit throughput target. This serves as the baseline control condition, representing the maximum microarchitectural footprint achievable by the exploit.

• AMD A4-5000 (Jaguar): Represents embedded x86-64

microarchitectures featuring a strictly banked, inclusive L2 cache topology, providing the foundation for our hardware-intrinsic mitigation analysis.

• Constant Rate Mode: Sets a global target for success-

ful data leakage in characters per second. It normalizes throughput and reduces timing drift by inserting a calculated microsecond-level delay immediately after each secret-access-and-reload cycle to warp the resulting HPC distribution.

The exact hardware specifications, cache topologies, and software environments for all evaluated platforms are summarized in Table 2.

• Burst-All Mode: Executes a rapid, back-to-back se-

TABLE 2. Experimental Testbed Specifications Processor

Micro architecture

Cores / Threads

Intel Core i7-3537U

Ivy Bridge (22nm)

2C / 4T

Intel Core i5-7200U

Kaby Lake (14nm)

2C / 4T

ARM CortexA76

ARM v8.2-A (7nm)

4C / 4T

AMD A4-5000

Jaguar (28nm)

4C / 4T

Cache (L1d / L2 / L3) 32KB / 256KB / 4MB (Inclusive) 32KB / 256KB / 3MB (Inclusive) 64KB / 512KB / 2MB (NonInclusive) 32KB / 2MB (Inclusive [4-Bank]) / None

quence of speculative reads until the target payload is reached, followed by an extended sleep period so the total activity aligns to a one-second window. This stresses the stability of telemetry under clustered, high-intensity activity followed by microarchitectural silence.

OS & Kernel Kali 2025.3 (Linux 6.12)

Kali 2025.3 (Linux 6.12)

• Batch-Rate Mode: Organizes speculative probes into

Debian 12 (Linux 6.1)

discrete, fixed-size batches. The system enforces a perbatch timing target proportional to the batch size divided by the rate, modeling a highly structured, periodic attack traffic designed to mimic the temporal patterns of legitimate background processes.

Kali 2025.3 (Linux 6.16)

4.3. The Interference Matrix and Benign Baselines To neutralize scheduling artifacts, our background load engine leverages NumPy and SciPy. These primitives explicitly release the CPython Global Interpreter Lock (GIL), allowing background tasks to execute as unthrottled concurrent threads across separate physical cores to induce four distinct architectural states:

Hardware Controls and Scalability. We deliberately chose these platforms as controlled baselines to isolate unfiltered hardware behavior. Newer processors contain hidden microcode patches (such as branch history flushing) that mask raw hardware signals. To accurately map the true,

4

• Idle: The baseline condition running with no active

characterizing the transition from optimal signal visibility to the “signal collapse” observed under heavy system noise and intentional traffic shaping. By decoupling these layers, we isolate the specific variance induced by the hardware architecture, the leakage mechanism, and the adversary’s defensive evasion strategy.

interference threads, serving as the optimal, quiet environment for the attacker. • CPU-Intensive: A continuous, multi-threaded work-

load that computes dot products and calculates eigenvalues on random floating-point matrices (base size of 200 × 200). This introduces severe arithmetic and scheduling contention.

5.1. Cross Device Telemetry: The Impact of Microarchitecture

• Memory-Pressure: An array-manipulation workload

A core fallacy in portable hardware security is the assumption that identical attack software generates uniform telemetry among different processors. To quantify this crossdevice variance, we evaluate the unthrottled Spectre V1 Flush+Reload implementation against a benign idle baseline across our primary hardware profiles: the Intel Core i73537U, ARM Cortex-A76, and AMD Jaguar.

that continuously allocates, sorts, and computes Fast Fourier Transforms (FFTs) on large floating-point arrays (106 elements). The generator maintains a rolling buffer of the 10 most recent arrays to force continuous cache-line replacement and thrash the LLC. • Mixed Workload: A highly variable workload de-

signed to model realistic, multi-faceted behavior. It rapidly cycles through pseudo-inverse matrix calculations, normal distribution statistics (mean and standard deviation), and 1D FFT signal processing.

To conduct a fair cross-ISA comparison, we abstract the telemetry into normalized ratios rather than raw event counts. Relying on raw counts introduces severe bias due to variations in clock frequencies and pipeline widths across architectures. Instead, we monitor two generalized architectural metrics: the Cache Miss Ratio (calculated as Last Level Cache misses divided by Last Level Cache references) and the Branch Miss Ratio (calculated as global branch mispredictions divided by global branch references).

Benign Baseline Workloads: Separately from the background interference, when establishing the non-malicious "Benign" execution baselines (evaluated in Section 5), we avoid using simple idle sleep states. Instead, the framework executes a diverse suite of standard system utilities to model legitimate application telemetry. These workloads include stress-ng for targeted CPU and virtual memory pressure, openssl sha256 for cryptographic hashing, gcc for source compilation, and tar/dd for heavy file I/O operations.

As visualized in Figure 3, the distributions of both the attack and the benign baseline differ drastically across the microarchitectures. In Panel A, the attack consistently forces a Cache Miss Ratio near 1.0 across all devices, which is expected given the aggressive cache flushing inherent to the Flush+Reload channel. However, the benign baseline reveals massive architectural divergence. On the Intel Core i7 platform, the benign cache miss ratio spans a wide variance envelope, creating a measurable gap between normal execution and the attack.

4.4. Automated Data Collection and Alignment To maintain reproducibility and strict temporal alignment, we orchestrate the data collection using a custom batch_auto pipeline. For each attack bucket, the matrix dictates 40 total runs (10 attack runs across each of the 4 primary background modes). To maintain strict run isolation, the pipeline enforces the following sequence: the chosen interference condition is initiated prior to attack execution, the attack executes and logs timestamped metadata, the interference is terminated, and a stabilization gap is enforced before the next run. This rigid coupling assures that the varying combinations of attack families, pacing models, and interference conditions remain perfectly aligned with the sampled HPC telemetry, enabling highly accurate comparative evaluations.

Conversely, the AMD Jaguar exhibits a naturally high and tightly clustered benign Cache Miss Ratio (Median: 0.92, IQR: 0.90–0.93). Compared to the Intel platform’s benign median of 0.69, this native architectural behavior drastically compresses the separability margin between benign and malicious execution, mathematically proving the risk of cross-ISA false positives. Panel B demonstrates a similar divergence in the Branch Predictor. Across all platforms, the attack execution creates a highly predictable control flow, resulting in a low, tightly clustered Branch Miss Ratio. However, the benign system noise varies wildly. The ARM Cortex-A76 maintains a low benign branch miss ratio, whereas the AMD Jaguar exhibits massive variance with an interquartile range stretching far above the other platforms.

5. Empirical Characterization of MultiDimensional Domain Shifts To establish a clear baseline for domain adaptation, we first analyze the “ground truth” HPC telemetry of transient execution attacks—defined here as the signatures generated by unthrottled exploits executing on an isolated, idle system. This serves as the idealized reference point for

This baseline data proves that the separation boundaries between benign and malicious execution are strictly hardwaredependent. A static machine learning classifier trained to

5

Figure 3. Baseline HPC telemetry comparing unthrottled Spectre V1 (red) against benign idle execution (blue). Panel A illustrates the Cache Miss Ratio, while Panel B illustrates the Branch Miss Ratio. The overlaid scatter plots reveal severe microarchitectural variance in the baseline system noise.

detect the wide cache miss separation on an Intel processor will completely fail to generalize to the compressed, noisy environment of the AMD Jaguar.

Figure 4. Baseline HPC fingerprints for attack variants on the Intel Core i5-7200U platform. Panels A and B highlight the statistical similarity in speculative stability across different branch metrics, while Panel C illustrates the L1 Data Cache Miss Ratio.

5.2. Cross-Variant Fingerprints: Mechanisms and Channels

Panels A and B isolate the impact of the speculation triggers via two distinct lenses: the Conditional Branch Misprediction Ratio and the Global Branch Miss Ratio. Whether utilizing a conditional bounds check bypass (V1_fr, V1_pp) or indirect branch target injection (V2_fr), all three attack variants show remarkably similar fingerprints characterized by low-magnitude, tightly clustered ratios.

While Section 5.1 establishes the baseline variance across architectures, a secondary domain shift occurs when an attacker alters their exploit strategy on a specific, fixed hardware target. To quantify this intra-ISA variance, we evaluate three distinct attack variants on a single platform—the Intel Core i5-7200U—under Idle conditions: Spectre V1 via Flush+Reload (V1_fr), Spectre V2 via Flush+Reload (V2_fr), and Spectre V1 via Prime+Probe (V1_pp).

In the branching domain (Panel A), Spectre V2 (V2_fr) exhibits a slightly higher Conditional Branch Misprediction Ratio (Median: 0.018) compared to the Spectre V1 variants (Median: 0.012), reflecting the additional overhead of indirect branch poisoning. However, this variation remains statistically insignificant when compared to the massive variance and elevated median of the naturally noisy benign baseline (Median: 0.165). This consistency occurs because unthrottled attack loops successfully train the underlying predictors to favor the speculative path, resulting in a stable, low-entropy signature. In contrast, the benign baseline represents diverse architectural paths and stochastic system activity, leading to significantly higher instability that overshadows the subtle differences between exploit mechanisms.

This analysis models a realistic adversary who, rather than dealing with different platforms, specializes their exploit for a specific victim machine but alternates between different microarchitectural triggers or leakage channels to bypass signature-based monitors. Because these variants manipulate different components of the same microarchitecture, they generate highly specific telemetry fingerprints. Figure 4 illustrates this divergence across three primary microarchitectural vectors. To ensure robustness against temporal aliasing in the hardware counters, we utilize selfcontained retirement and misprediction ratios from within our synchronized collection batches.

6

Panel C highlights the divergence in leakage channels. While V1_fr and V1_pp share a similar speculation trigger, Prime+Probe (V1_pp) infers data by measuring set-based disturbance across the cache hierarchy. This necessitates constructing eviction sets and thrashing the L1 cache, pushing its median L1 Data Cache Miss Ratio to 0.119. In contrast, the surgical Flush+Reload variants create a lowimpact footprint (Median: 0.027), placing Prime+Probe’s severe cache contention visibly above both the F+R variants and the benign baseline (Median: 0.094). These distinct fingerprints prove that the variance envelope is mechanism-dependent even on a constant hardware target. A detector optimized for the cache signatures of Flush+Reload will likely fail to recognize the heavy setbased contention of Prime+Probe, offering a clear evasion path for sophisticated adversaries.

5.3. Signal Degradation Under Environmental Noise While the isolated fingerprints in Section 4.2 provide clear microarchitectural benchmarks, real-world deployment occurs within an unpredictable environment where background operations compete for limited hardware resources. To quantify the stability of these signals, we subject the V1 Prime+Probe attack and a Benign baseline to a multidimensional interference matrix on the Intel Core i5-7200U platform. Figure 5 illustrates the divergence between metrics that degrade gracefully and those that collapse entirely under system load.

Figure 5. Side-by-side comparison of telemetry degradation. Panel A illustrates the catastrophic collapse of the L1 Cache Miss Ratio due to resource contention and signal inversion. Panel B demonstrates the graceful resilience of the Conditional Branch Misprediction Ratio, which maintains a clear margin of separability across all noise modes.

The data reveals two opposing microarchitectural behaviors. In Panel A, the L1 Data Cache Miss Ratio—a primary metric for cache-based side channels—exhibits a catastrophic loss of separability. Under resource-contention-heavy workloads (e.g., CPU-bound and memory-intensive background tasks), we observe that the “signal inversion” is not simply a magnitude shift but a frequency-domain overlap between benign cache thrashing and malicious eviction.

resource easily thrashed by background tasks, the BPU remains highly sensitive to the repetitive, tight-loop logic characteristic of Spectre exploits. Even as the system reaches peak interference in the Mixed mode, the attack’s “low-entropy” branching signature remains distinct. This comparison illustrates a fundamental bottleneck for hardware-based malware detection: the selection of features must be context-aware. Relying on cachelevel telemetry alone invites evasion through environmental noise, whereas integrating resilient branching metrics offers a stable foundation for domain-adaptive models.

This suggests that ALU-heavy contention actively throttles the attacker’s execution frequency, “silencing” the cachemiss signature. Furthermore, under memory pressure (Mem), the benign L1 cache distribution expands significantly (Median: 0.094, Max: 0.134) to completely swallow the Prime+Probe attack’s median signature (Median: 0.108). Because the variance of the benign noise overlaps the attack footprint, static L1 cache thresholds are rendered mathematically ineffective in this domain.

5.4. Adversarial Pacing & Traffic Shaping While previous sections analyze the impact of extrinsic environmental noise, this section assesses the effectiveness of intentional, intrinsic adversarial manipulation. A sophisticated attacker can trade execution throughput for microarchitectural stealth by using traffic shaping— modulating the frequency and duration of speculative bursts to distort the resulting Hardware Performance Counter (HPC) distributions.

In contrast, Panel B demonstrates that speculative branching metrics degrade gracefully. Even under heavy memory contention, the Conditional Branch Misprediction Ratio of the attack footprint (Median: 0.008, Max: 0.036) maintains a clear, near-constant margin of separability from the naturally noisy benign baseline (Median: 0.150). This resilience stems from the dedicated nature of the Branch Prediction Unit (BPU); while the cache is a shared global

To quantify this “Throughput-Visibility Trade-off,” we evaluate three distinct attack primitives: V1(BCB) Flush+Reload,

7

V2(BTI) Flush+Reload, and V1(BCB) Prime+Probe. As illustrated in Figure 6, we map the resulting two-dimensional evasion space using global branch and cache miss ratios. By subsampling the telemetry to 500 random points per execution mode, we isolate the specific microarchitectural “trajectories” that occur as an adversary transitions from an unthrottled state to high-pacing regimes (r = 50).

maintains a high Cache Miss Ratio (consistently between 0.2 and 0.5) but slides rightward along the X-axis. This indicates that while temporal shaping reduces the frequency of cache evictions, it simultaneously increases the microarchitectural entropy within the branch predictor. This diffusion pushes the signature into the high-variance region of the benign clusters, attempting to facilitate evasion through signal blurring. • V2(BTI)

Flush+Reload (Top-Left Precision Retention): The middle panel demonstrates a “top-left retention” strategy. Unlike V1, this variant remains pinned in the high-cache/low-branch-miss zone even under heavy pacing (r = 50). This indicates that the Branch Target Injection (BTI) mechanism is fundamentally more surgical; the adversary maintains near-perfect branch prediction accuracy while executing high-frequency flushes. This creates a “loud” microarchitectural outlier that resists blending into the stochastic noise of legitimate applications.

• V1(BCB) Prime+Probe (Diagonal Signal Collapse):

The bottom panel showcases the most elusive primitive. It follows a tight diagonal collapse trajectory where both cache intensity and branching signatures degrade proportionally. In the high-pacing regime, the attack becomes functionally indistinguishable from the lowestintensity benign samples. Unlike Flush+Reload variants, which are anchored by high-intensity cache footprints, paced Prime+Probe achieves near-total microarchitectural invisibility. This divergence underscores a fundamental challenge for unified hardware detectors. While global metrics remain sensitive to “noisy” primitives like Flush+Reload, they are highly susceptible to evasion by “quiet” primitives like paced Prime+Probe. Our results highlight the critical necessity for detectors to move beyond static, global thresholds and instead adopt variant-aware models that can identify “lowentropy” speculative states even when the primary cachelevel signatures have been successfully shaped into benign magnitudes.

5.5. Implications for Adaptive Detection The empirical variance characterized across Subsections 5.1 through 5.4 proves that Spectre microarchitectural signatures are volatile functions of the hardware platform, exploit mechanism, and environmental context, yielding three critical consequences for resilient monitor design.

Figure 6. Evasion Space trajectories for Spectre V1 and V2. Flush+Reload variants (top/middle) maintain high cache-intensity signatures, whereas V2(BTI) resists branching entropy diffusion. Conversely, Prime+Probe (bottom) exhibits a diagonal signal collapse, merging indistinguishably into the benign baseline under heavy pacing.

5.5.1. Hardware Domain Shift and Portability. The cross-device divergence characterized in Section 5.1 proves raw telemetry is non-portable due to the frequency and pipeline biases described earlier [2], [3]. Because localized hardware traits—such as the compressed separability margin caused by the AMD Jaguar’s naturally elevated cache noise floor—drastically inflate false-positive rates, direct crossplatform deployments suffer from severe signature degra-

The empirical data reveals three distinct evasion behaviors that are highly dependent on the underlying side-channel mechanism and the speculative trigger: • V1(BCB) Flush+Reload (Horizontal Entropy Diffu-

sion): In the top panel, the attack exhibits a primarily horizontal migration. As pacing increases, the signature

8

dation [7]. This “Hardware Domain Shift” underscores the necessity for architecture-aware normalization or transfer learning to dynamically calibrate decision thresholds to each device’s native noise floor.

TABLE 3. Zero-Shot Transfer Performance: Baseline LSTM trained on Intel 1 (Idle), tested against characterized domain shifts.

Target Domain (Test Set) Intel 1 (Idle)

5.5.2. Feature Stability vs. Mechanism Variance. The intra-ISA variance characterized in Section 5.2 highlights the danger of mechanism-specific overfitting. An attacker can retain the same speculative trigger while entirely altering the leakage channel’s footprint (Flush+Reload vs. Prime+Probe). Attention-based feature importance reveals that LLC-related metrics (LLC Misses and LLC Load Misses) serve as the most stable indicators across platforms, significantly outperforming volatile L1 cache features easily thrashed by background system noise. Robust detection must therefore prioritize resilient branching ratios and stable LLC telemetry.

F1-Score

Accuracy

1.00

1.00

Intel 2 (Idle)

0.99

0.99

Intel 1 (Memory Pressure) ARM (Paced Attack)

0.54

0.69

0.00

0.50

Observed Effect Baseline (Source Data) Cross-Generation Drift Environmental Noise Cross-ISA Signal Collapse

hardware anomaly. As detailed in Section 6, the Jaguar’s banked L2 cache hierarchy and aggressive L2 prefetching physically neutralize the Prime+Probe channel. Rather than repeating redundant ML failure rates, the next section provides a microarchitectural post-mortem of how intrinsic hardware constraints can physically dismantle specific attack channels before their signatures can reach the telemetry layer.

5.5.3. The Necessity of Domain Adaptation. The synthesis of environmental noise and traffic shaping formalizes the requirement for Domain Adaptation (DA). To evaluate our characterization data, we execute a zero-shot domain transfer study using a baseline LSTM network (64 hidden units, 32 dense units, sigmoid activation) trained on the Intel 1 (Idle) dataset (80/20 split, Adam optimizer, binary cross-entropy, batch size 64, early stopping). To cleanly isolate instant-state thresholds from temporal smoothing dependencies, the model configures its input layer to process a single timestep (sequence length = 1, 4 features).

6. Microarchitectural Bottlenecks: A Case Study of Prime+Probe While Prime+Probe is often considered an adaptable sidechannel due to its independence from shared memory, empirical results show severe non-portability across disparate cache hierarchies [3]. As demonstrated in Section 5.1, Prime+Probe signatures exhibit near-perfect separability on Intel and ARM platforms but collapse completely into indistinguishability on the AMD Jaguar. This section presents a microarchitectural post-mortem proving this failure stems from physical memory hierarchy constraints rather than timing measurement limitations.

This single-timestep configuration acts as an analytical control. Standard sliding-window sequence models suffer from acute temporal overfitting to the source domain’s instruction strides. Under adversarial traffic shaping (e.g., Constant-Rate or Batch-Rate modes), the adversary systematically shifts speculative access intervals, shattering temporal dependencies and causing severe sequence misalignment. Removing the temporal window cleanly tests raw threshold resilience under active pacing.

6.1. Beyond Timing: Validating the Channel Resolution

As summarized in Table 3, while the model achieves nearperfect separability on its source domain (F1 ≈ 1.00) and generalizes across intra-ISA generational drift (Intel 2, F1 ≈ 0.99), performance degrades under memory pressure on the same host machine (Intel 1 Memory Pressure, F1 = 0.54). Most critically, simultaneous cross-ISA transfer and adversarial pacing induce complete detection collapse (F1 = 0.00, Accuracy = 0.50), performing no better than random chance due to the lack of tracking over shaped telemetry intervals. This failure mathematically proves that static, single-input signatures established in isolated environments are blind to domain-shifted telemetry, meaning future detectors must transition to adaptive monitoring architectures.

Failed cache exploits are frequently misattributed to insufficient timer resolution (e.g., low-frequency rdtsc execution). However, our timing analysis confirms that the Jaguar platform provides sufficient granularity to cleanly differentiate L1 hits from L2/DRAM misses. While the “Probe” phase successfully records latency deltas, these variations fail to correlate with malicious activity. This signature absence indicates that the attack fails to induce microarchitectural state changes, exposing an inherent state of Architectural Resistance rather than measurement failure.

6.2. The Inclusive L2 Paradox and Eviction Failure

The AMD Jaguar platform is omitted from Table 3 because its functional Flush+Reload metrics match the ARM baseline’s transfer degradation. Crucially, for set-based interference, the Jaguar microarchitecture presents a unique

On Intel platforms, inclusive Last Level Caches (LLCs) enable reliable eviction from lower-level caches by saturating specific LLC sets, yielding a high-magnitude, low-

9

variance telemetry footprint. Conversely, the Jaguar exposes an eviction misalignment paradox. While the L2 cache is nominally inclusive, its 2MB capacity is strictly divided into four physically routed banks. Because standard Prime+Probe loops lack the address-bit precision to evenly target these specific banks, the attacker populates the L2 unevenly. Failing to saturate the specific sets tracking the victim’s data, the hardware is never triggered to enforce inclusive back-invalidation. Consequently, the loop remains microarchitecturally silent to the L1, generating a successful timer log of an unsuccessful physical eviction. This induces a complete signal washout: while HPCs log L2 updates, the undisturbed L1 footprint prevents data leakage, rendering the L1 cache miss ratio statistically indistinguishable from benign idle noise.

shaping, and cross-device variance, this paper demonstrates that the “ground truth” signatures established in isolated laboratory environments are fundamentally fragile. Our results reveal a critical hierarchy of stealth. While Flush+Reload variants maintain a high-intensity cache footprint that is relatively resilient to pacing, Prime+Probe variants exhibit a catastrophic signal collapse, achieving near-total microarchitectural invisibility when shaped by an informed adversary. Furthermore, the AMD Jaguar case study formalizes the existence of physical observability bottlenecks that remain ISA-independent. The failure of Prime+Probe due to L2 banking topology differences proves that hardware-based malware detection cannot rely on universal, static feature sets. These findings serve as a primary requirement for the development of adaptive, architecture-aware security monitors.

6.3. Hardware-Induced Telemetry Evasion via L2 Prefetching

To move beyond the limits of rigid thresholding, the field must prioritize domain-adaptation techniques capable of dynamically recalibrating decision thresholds. Based on this empirical foundation, our immediate future work will address these observability bottlenecks through advanced adaptive modelling. Specifically, we plan to explore hybrid architectures—integrating frameworks such as DomainAdversarial Neural Networks (DANN) and XGBoost—to dynamically recalibrate decision thresholds in response to fluctuating noise floors and cross-ISA variance. Ultimately, the transition toward such context-aware, hybrid monitoring remains a microarchitectural necessity for securing modern speculative pipelines.

The AMD Jaguar’s L2 hardware prefetcher introduces a concurrent mechanism for telemetry dilution. Triggered by high-frequency Prime+Probe loop access intervals, the prefetcher aggressively streams lines into the L2 before the “Probe” phase registers a timing delta, effectively erasing the channel’s temporal footprint. We must demarcate these functional boundaries: the L2 banking topology mismatch (Section 6.2) is the primary structural bottleneck causing physical exploit failure. Conversely, the prefetcher acts as the primary telemetry masking agent. This is empirically validated by toggling MSR 0xC0011022, where disabling the prefetcher recovers the latency signal delta by only 12%, leaving the remaining 88% bound to the banked L2 layout mismatch. The prefetcher does not dismantle the exploit; rather, it visually dilutes the failed footprint, forcing telemetry to mirror benign idle execution.

Acknowledgements This work was supported in part by the National Science Foundation (NSF) under Grant CNS-2026675. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the authors and do not necessarily reflect the views of NSF. Generative AI Disclosure. In accordance with IEEE policies, we disclose the use of large language models strictly for language refinement, structural organization, and LaTeX formatting. AI was not used to formulate hypotheses or generate data, and the authors take full responsibility for the paper’s originality and scientific integrity.

6.4. Summary: The Hard Limit of Portability The Jaguar case study formalizes a fundamental constraint for hardware security: Observability is not microarchitecturally portable, even within a shared ISA. The collapse of Prime+Probe signatures on the Jaguar proves that execution topology and directory structures dictate counter semantics independent of the instruction set. Consequently, hardwarebased detectors cannot act as architecture-agnostic black boxes; a feature set optimized for the set-based contention of an inclusive-cache layout (Intel/ARM) remains fundamentally blind when deployed against a strictly banked L2 cache topology (AMD) sharing the same x86-64 instruction primitives and inclusive policy.

References [1]

P. Kocher, J. Horn, A. Fogh, D. Genkin, D. Gruss, W. Haas, M. Hamburg, M. Lipp, S. Mangard, T. Prescher et al., “Spectre attacks: Exploiting speculative execution,” Communications of the ACM, vol. 63, no. 7, pp. 93–101, 2020.

[2]

J. Kotha and J.-L. Gaudiot, “A data-driven approach using hardware performance counters to detect micro-architectural attacks,” in Proceedings of the Nineteenth IEEE International Workshop on Security, Trust, and Privacy for Software Applications (STPSA 2025) at COMPSAC 2025. Toronto, Canada: IEEE, Jul. 2025, pp. 2301–2306.

7. Conclusion This study provides a comprehensive examination of the microarchitectural observability of Spectre-class attacks under realistic deployment conditions. By analyzing the intersection of environmental noise, adversarial traffic

10

[3]

C. Li and J. Gaudiot, “Detecting spectre attacks using hardware performance counters,” IEEE Transactions on Computers, vol. 71, no. 6, pp. 1320–1331, 2022.

[11] E. M. Koruyeh, K. N. Khasawneh, C. Song, and N. Abu-Ghazaleh, “Spectre returns! speculation attacks using the return stack buffer,” in 12th USENIX Workshop on Offensive Technologies (WOOT 18), 2018.

[4]

E. C. Larson et al., “Real-time edge processing detection of malicious attacks using machine learning and processor core events,” in 2021 IEEE International Systems Conference (SysCon). IEEE, 2021, pp. 1–7.

[12] Y. Yarom and K. Falkner, “FLUSH+RELOAD: A high resolution, low noise, l3 cache side-channel attack,” in 23rd USENIX Security Symposium (USENIX Security 14), 2014, pp. 719–732.

[5]

X. Zhang, Y. Xiao, and Y. Zhang, “CloudRadar: Real-time detection of cache-based side-channel attacks in clouds,” in Proceedings of the 2018 International Symposium on Research in Attacks, Intrusions, and Defenses (RAID), 2018, pp. 118–140.

[13] D. Gruss, C. Maurice, K. Wagner, and S. Mangard, “Flush+flush: A fast and stealthy cache attack,” in Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA). Springer, 2016, pp. 279–299.

[6]

[7]

[8]

[9]

[14] C. Percival, “Cache missing for fun and profit,” in Proceedings of BSDCan 2005, vol. 13, 2005.

T. Zhou and Y. Makris, “Hardware-based detection of Spectre attacks: A machine learning approach,” in 2021 IEEE International Symposium on Hardware Oriented Security and Trust (HOST). IEEE, 2021, pp. 1–11.

[15] F. Liu, Y. Yarom, Q. Ge, G. Heiser, and R. B. Lee, “Last-level cache sidechannel attacks are practical,” in 2015 IEEE Symposium on Security and Privacy. IEEE, 2015, pp. 605–622.

W. Kosasih, Y. Feng, C. Chuengsatiansup, Y. Yarom, and Z. Zhu, “Sok: Can we really detect cache side-channel attacks by monitoring performance counters?” in Proceedings of the ACM on Web Conference 2024, 07 2024, pp. 172–185.

[16] E. Tromer, D. A. Osvik, and A. Shamir, “Efficient cache attacks on aes, and countermeasures,” Journal of Cryptology, vol. 23, no. 1, pp. 37–71, 2010.

C. Li and J.-L. Gaudiot, “Detecting malicious attacks exploiting hardware vulnerabilities using performance counters,” in 2019 IEEE 43rd Annual Computer Software and Applications Conference (COMPSAC), vol. 1. IEEE, 2019, pp. 588–597.

[17] M. Yan, R. Bhaskar, C. W. Fletcher, and J. Torrellas, “Secure hierarchyaware cache replacement policy (SHARP): Defending against cachebased side channel attacks,” in 2017 ACM/IEEE 44th Annual International Symposium on Computer Architecture (ISCA). IEEE, 2017, pp. 347–360.

C. Canella, J. Van Bulck, M. Schwarz, M. Lipp, B. von Berg, P. Ortner, F. Piessens, D. Evtyushkin, and D. Gruss, “A systematic evaluation of transient execution attacks and defenses,” in 28th USENIX Security Symposium (USENIX Security 19), 2019, pp. 249–266.

[18] A. Tang, S. Sethumadhavan, and S. J. Stolfo, “Unsupervised anomalybased malware detection using hardware features,” in Research in Attacks, Intrusions and Defenses (RAID). Springer, 2014, pp. 109–129.

[10] R. Mcilroy, J. Sevcik, T. Tebbi, B. L. Titzer, and T. Verwaest, “Spectre is here to stay: An analysis of side-channels and speculative execution,” arXiv preprint arXiv:1902.05178, 2019.

11

Related documents

• MicroIntent: Intent-Based Placement Strategy for Microservice Application in the Compute Continuum Using LLMs#985334
• Measurement and Potential Field-Based Patient Modeling for Model-Mediated Tele-ultrasound#1104885
• Prospective Longitudinal Multicentric Study to Evaluate Syde® Digital Endpoints in Healthy Adults#890265
• Daring to leave the laboratory: Why operational neuroscience requires a different research strategy#1081537
• Daring to leave the laboratory: Why operational neuroscience requires a different research strategy#1081441