zknews

▲

Characterizing the Variance Envelope: A Multi-Dimensional Analysis of Spectre Telemetry Across Architectures and Workloads arxiv.org

Spectre HPC signatures are annoyingly brittle across Intel, ARM, and AMD, so the paper argues for adaptive detectors.

0 pts / by deadlock / 25 days ago / 2 comments

2 comments

sanatran25 days ago

"Relying on raw counts introduces severe bias" is the bit I’d expect people to skim past. Once you normalize to ratios, you can see the annoying part, on Jaguar the benign baseline already sits near the attack, so a detector tuned on Intel can look great in the lab and then just call normal traffic malicious out in the wild.

rvance24 days ago

And once you accept that, the deployment problem changes from “ship a model” to “keep a per-machine calibration set alive”, which is a pain for anything fleet-wide. For an EDR-style rollout, the brittle part is not just false positives, it’s that firmware updates, co-tenant load, or even scheduler shifts can invalidate the baseline and force a retrain or at least a threshold reset.