{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T07:02:07Z","timestamp":1782975727452,"version":"3.54.5"},"reference-count":92,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001659","name":"Deutsche Forschungsgemeinschaft","doi-asserted-by":"publisher","award":["491039149"],"award-info":[{"award-number":["491039149"]}],"id":[{"id":"10.13039\/501100001659","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000028","name":"Semiconductor Research Corporation","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100000028","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,5,18]]},"DOI":"10.1109\/sp63933.2026.00135","type":"proceedings-article","created":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T19:34:20Z","timestamp":1782934460000},"page":"676-695","source":"Crossref","is-referenced-by-count":0,"title":["Trevex: A Black-Box Detection Framework for Data-Flow Transient Execution Vulnerabilities"],"prefix":"10.1109","author":[{"given":"Daniel","family":"Weber","sequence":"first","affiliation":[{"name":"CISPA Helmholtz Center for Information Security"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Fabian","family":"Thomas","sequence":"additional","affiliation":[{"name":"CISPA Helmholtz Center for Information Security"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Leon","family":"Trampert","sequence":"additional","affiliation":[{"name":"CISPA Helmholtz Center for Information Security"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ruiyi","family":"Zhang","sequence":"additional","affiliation":[{"name":"CISPA Helmholtz Center for Information Security"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Michael","family":"Schwarz","sequence":"additional","affiliation":[{"name":"CISPA Helmholtz Center for Information Security"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Meltdown: Reading Kernel Memory from User Space","author":"Lipp","year":"2018","journal-title":"USENIX Security"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00002"},{"key":"ref3","article-title":"A Systematic Evaluation of Transient Execution Attacks and Defenses","volume-title":"USENIX Security, 2019, extended classification tree and PoCs","author":"Canella"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00087"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354252"},{"key":"ref6","article-title":"Foreshadow: Extracting the Keys to the Intel SGX Kingdom with Transient Out-of-Order Execution","author":"Van Bulck","year":"2018","journal-title":"USENIX Security"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00089"},{"key":"ref8","article-title":"Rage against the machine clear: A systematic analysis of machine clears and their implications for transient execution attacks","author":"Ragab","year":"2021","journal-title":"USENIX Security"},{"key":"ref9","article-title":"Downfall: Exploiting speculative data gathering","author":"Moghimi","year":"2023","journal-title":"USENIX Security"},{"key":"ref10","volume-title":"Register File Data Sampling","year":"2024"},{"key":"ref11","article-title":"Analyzing and exploiting branch mispredictions in microcode","author":"Mosier","year":"2025","journal-title":"arXiv preprint"},{"key":"ref12","article-title":"Phantom trails: Practical pre-silicon discovery of transient data leaks","author":"de Faveri Tron","year":"2025","journal-title":"USENIX Security"},{"key":"ref13","article-title":"Flop: Breaking the apple m3 cpu via false load output predictions","author":"Kim","year":"2025","journal-title":"USENIX Security"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00098"},{"key":"ref15","article-title":"Medusa: Microarchitectural Data Leakage via Automated Attack Synthesis","volume-title":"USENIX Security Symposium","author":"Moghimi"},{"key":"ref16","article-title":"Data sampling on mds-resistant 10th generation intel core (ice lake)","author":"Moghimi","year":"2020","journal-title":"arXiv preprint arXiv"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/3503222.3507729"},{"key":"ref18","article-title":"Speculation at fault: Modeling and testing microarchitectural leakage of CPU exceptions","author":"Hofmann","year":"2023","journal-title":"USENIX Security"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179391"},{"key":"ref20","article-title":"Enter, exit, page fault, leak: Testing isolation boundaries for microarchitectural leaks","author":"Oleksenko","year":"2025","journal-title":"arXiv preprint"},{"key":"ref21","article-title":"Breaking the x86 isa","author":"Domas","year":"2017","journal-title":"Black Hat"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/3458903.3458906"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/ISCA52012.2021.00073"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560578"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/TC.2022.3152666"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.3390\/electronics8091057"},{"key":"ref27","article-title":"InSpectre: Breaking and Fixing Microarchitectural Vulnerabilities by Formal Analysis","author":"Balliu","year":"2019","journal-title":"arXiv"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3676642.3736115"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3690344"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1145\/3669940.3707243"},{"key":"ref31","volume-title":"Affected Processors: Transient Execution Attacks","year":"2025"},{"key":"ref32","article-title":"Predicting secret keys via branch prediction","author":"Acri\u00e7mez","year":"2007","journal-title":"CT-RSA"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243761"},{"key":"ref34","article-title":"Spectre Returns! Speculation Attacks using the Return Stack Buffer","author":"Koruyeh","year":"2018","journal-title":"WOOT"},{"key":"ref35","article-title":"Shesha: Multihead microarchitectural leakage discovery in new-generation intel processors","author":"Chakraborty","year":"2024","journal-title":"arXiv preprint"},{"key":"ref36","volume-title":"Software Security Guidance: Load Value Injection","year":"2024"},{"key":"ref37","volume-title":"Speculative Code Store Bypass and Floating-Point Value Injection","year":"2021"},{"key":"ref38","volume-title":"Floating Point Value Injection","year":"2021"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-29959-0_14"},{"key":"ref40","article-title":"Flush+Reload: a High Resolution, Low Noise, L3 Cache Side-Channel Attack","author":"Yarom","year":"2014","journal-title":"USENIX Security"},{"key":"ref41","article-title":"Cache Missing for Fun and Profit","author":"Percival","year":"2005","journal-title":"BSDCan"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363194"},{"key":"ref43","article-title":"Osiris: Automated Discovery of Microarchitectural Side Channels","author":"Weber","year":"2021","journal-title":"USENIX Security"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363219"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00020"},{"key":"ref46","volume-title":"Deep Dive: Load Value Injection","year":"2020"},{"key":"ref47","volume-title":"speculative execution, variant 4: speculative store bypass","author":"Horn","year":"2018"},{"key":"ref48","volume-title":"Security analysis of amd predictive store forwarding","year":"2023"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.46586\/uasc.2026.301"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/96267.96279"},{"key":"ref51","article-title":"Automated whitebox fuzz testing","author":"Godefroid","year":"2008","journal-title":"NDSS"},{"key":"ref52","volume-title":"More about AFL - History","year":"2025"},{"key":"ref53","volume-title":"Oss-fuzz - google\u2019s continuous fuzzing service for open source software","author":"Serebryany"},{"key":"ref54","volume-title":"RISCVuzz: Discovering architectural CPU vulnerabilities via differential hardware fuzzing","author":"Thomas","year":"2024"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-51479-1_2"},{"key":"ref56","article-title":"$\\mu$ RL: Discovering Transient Execution Vulnerabilities Using Reinforcement Learning","author":"Tol","year":"2025","journal-title":"arXiv preprint arXiv"},{"key":"ref57","volume-title":"Speculative Code Store Bypass","year":"2021"},{"key":"ref58","volume-title":"misc0110\/PTEditor: A small library to modify all page-table levels of all processes from user space for x86_64 and ARMv8","author":"Schwarz","year":"2018"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1145\/3297858.3304062"},{"key":"ref60","article-title":"Cascade: Cpu fuzzing via intricate program generation","author":"Solt","year":"2024","journal-title":"USENIX Security"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00137"},{"key":"ref62","volume-title":"Sample Size Calculator","year":"2025"},{"key":"ref63","volume-title":"Sampling techniques, 3rd edition","author":"Cochran","year":"1977"},{"key":"ref64","volume-title":"Speculative Leaks Security Notice - AMD-SB-7007","year":"2023"},{"key":"ref65","volume-title":"Fix the DIV(0) inital fix attempt","year":"2023"},{"key":"ref66","volume-title":"XSA-439: Divide speculative information leak","year":"2023"},{"key":"ref67","article-title":"Repurposing segmentation as a practical lvi-null mitigation in sgx","volume-title":"USENIX Security Symposium","author":"Giner","year":"2022"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1145\/2133375.2133377"},{"key":"ref69","volume-title":"Vector Register Sampling \/ CVE-20200548 \/ INTEL-SA-OO329","year":"2020"},{"key":"ref70","volume-title":"Cache speculation side-channels","year":"2018"},{"key":"ref71","volume-title":"Instructions affected by rogue system register read","year":"2018"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-51479-1_5"},{"key":"ref73","volume-title":"Transient Fail (GitHub)","year":"2020"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.23105"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00036"},{"key":"ref76","article-title":"Revizor Releases: v2.0.0","volume-title":"The Revizor Project Contributors","year":"2026"},{"key":"ref77","article-title":"Encarsia: Evaluating cpu fuzzers via automatic bug injection","author":"B\u00f6lcskei","year":"2025","journal-title":"USENIX Security"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.23018"},{"key":"ref79","article-title":"Beta: Automated black-box exploration for timing attacks in processors","author":"Chen","year":"2024","journal-title":"arXiv"},{"key":"ref80","article-title":"Breaking the x86 ISA","author":"Domas","year":"2017","journal-title":"Black Hat US"},{"key":"ref81","article-title":"Silifuzz: Fuzzing cpus by proxy","author":"Serebryany","year":"2021","journal-title":"arXiv"},{"key":"ref82","article-title":"\u00c6PIC Leak: Architecturally Leaking Uninitialized Data from the Microarchitecture","author":"Borrello","year":"2022","journal-title":"USENIX Security"},{"key":"ref83","volume-title":"Zenbleed","author":"Ormandy","year":"2023"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359837"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3623192"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560600"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1145\/3719027.3765148"},{"key":"ref88","article-title":"Synthesizing formal models of hardware from rtl for efficient verification of memory model implementations","author":"Hsiao","year":"2021","journal-title":"MICRO"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO61859.2024.00045"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00180"},{"key":"ref91","article-title":"H-houdini: Scalable invariant learning","author":"Dinesh","year":"2025","journal-title":"ASPLOS"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00026"}],"event":{"name":"2026 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2026,5,18]]},"end":{"date-parts":[[2026,5,21]]}},"container-title":["2026 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11573355\/11573356\/11573526.pdf?arnumber=11573526","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T05:36:16Z","timestamp":1782970576000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11573526\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,18]]},"references-count":92,"URL":"https:\/\/doi.org\/10.1109\/sp63933.2026.00135","relation":{},"subject":[],"published":{"date-parts":[[2026,5,18]]}}}