The bit that jumps out is the move from sampling performance counters to embedding the monitor in RTL. HPC-based schemes only see whatever happens to line up with the sampling window, so a stealthy predictor attack can slip through between reads, while a rule monitor can watch the microarchitectural state transitions directly. The “zero false positives” claim is nice, but usually it means on the benchmark set they used, not that the rule set will stay that clean once the workload gets messier or the core gets tweaked. Still, for a BOOM-style design, catching the attack before secret disclosure matters more than squeezing out a few more percent of throughput.