{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,20]],"date-time":"2025-06-20T18:10:01Z","timestamp":1750443001951,"version":"3.41.0"},"reference-count":52,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"7","license":[{"start":{"date-parts":[[2025,7,1]],"date-time":"2025-07-01T00:00:00Z","timestamp":1751328000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,7,1]],"date-time":"2025-07-01T00:00:00Z","timestamp":1751328000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,7,1]],"date-time":"2025-07-01T00:00:00Z","timestamp":1751328000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U24A20289","62122023"],"award-info":[{"award-number":["U24A20289","62122023"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"Natural Science Foundation of Changsha City","doi-asserted-by":"publisher","award":["kq2208212"],"award-info":[{"award-number":["kq2208212"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Comput.-Aided Des. Integr. Circuits Syst."],"published-print":{"date-parts":[[2025,7]]},"DOI":"10.1109\/tcad.2025.3526544","type":"journal-article","created":{"date-parts":[[2025,1,6]],"date-time":"2025-01-06T19:33:27Z","timestamp":1736192007000},"page":"2475-2487","source":"Crossref","is-referenced-by-count":0,"title":["Nested Speculative Execution Attacks via Runahead"],"prefix":"10.1109","volume":"44","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1903-9584","authenticated-orcid":false,"given":"Chaoqun","family":"Shen","sequence":"first","affiliation":[{"name":"College of Integrated Circuit Science and Engineering, Nanjing University of Posts and Telecommunications, Nanjing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6759-8949","authenticated-orcid":false,"given":"Gang","family":"Qu","sequence":"additional","affiliation":[{"name":"Department of Electrical and Computer Engineering, University of Maryland at College Park, College Park, MD, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8712-2964","authenticated-orcid":false,"given":"Jiliang","family":"Zhang","sequence":"additional","affiliation":[{"name":"College of Integrated Circuit Science and Engineering, Nanjing University of Posts and Telecommunications, Nanjing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00002"},{"key":"ref2","first-page":"973","article-title":"Meltdown: Reading kernel memory from user space","volume-title":"Proc. USENIX Secur.","author":"Lipp"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1145\/3445814.3446708"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363194"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/3575693.3575719"},{"key":"ref6","first-page":"955","article-title":"Translation leak-aside buffer: Defeating cache side-channel protections with TLB attacks","volume-title":"Proc. USENIX Secur.","author":"Gras"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3466752.3480079"},{"key":"ref8","first-page":"565","article-title":"DRAMA: Exploiting DRAM addressing for cross-CPU attacks","volume-title":"Proc. USENIX Secur.","author":"Pessl"},{"key":"ref9","first-page":"1451","article-title":"Rage against the machine clear: A systematic analysis of machine clears and their implications for transient execution attacks","volume-title":"Proc. USENIX Secur.","author":"Ragab"},{"key":"ref10","first-page":"639","article-title":"Robust website fingerprinting through the cache occupancy channel","volume-title":"Proc. USENIX Secur.","author":"Shusterman"},{"key":"ref11","first-page":"859","article-title":"Stealthy tracking of autonomous vehicles with cache side channels","volume-title":"Proc. USENIX Secur.","author":"Luo"},{"key":"ref12","first-page":"2003","article-title":"Cache telepathy: Leveraging shared resource attacks to learn DNN architectures","volume-title":"Proc. USENIX Secur.","author":"Yan"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3470496.3527429"},{"key":"ref14","first-page":"621","article-title":"SPOILER: Speculative load hazards boost Rowhammer and cache attacks","volume-title":"Proc. USENIX Secur.","author":"Islam"},{"key":"ref15","first-page":"991","article-title":"Foreshadow: Extracting the keys to the Intel SGX kingdom with transient out-of-order execution","volume-title":"Proc. USENIX Secur.","author":"Bulck"},{"key":"ref16","first-page":"663","article-title":"Frontal attack: Leaking control-flow in SGX via the CPU frontend","volume-title":"Proc. USENIX Secur.","author":"Puddu"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00020"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/3307650.3322228"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/ISCA52012.2021.00024"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA.2003.1183532"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA47549.2020.00040"},{"key":"ref22","first-page":"2109","article-title":"ret2spec: Speculative execution using return stack buffers","volume-title":"Proc. CCS","author":"Giorgi"},{"key":"ref23","first-page":"557","article-title":"Inferring fine-grained control flow inside SGX enclaves with branch shadowing","volume-title":"Proc. USENIX Secur.","author":"Lee"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3649329.3655932"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/ICCD50377.2020.00095"},{"key":"ref26","first-page":"249","article-title":"A systematic evaluation of transient execution attacks and defenses","volume-title":"Proc. USENIX Secur.","author":"Chowdhuryy"},{"volume-title":"Intel\u00ae 64 and IA-32 architectures software developer\u2019s manual.","year":"2019","key":"ref27"},{"key":"ref28","first-page":"719","article-title":"FLUSH+RELOAD: A high resolution, low noise, L3 cache side-channel attack","volume-title":"Proc. USENIX Secur.","author":"Yarom"},{"key":"ref29","first-page":"1","article-title":"Spectre returns! Speculation attacks using the return stack buffer","volume-title":"Proc. WOOT","author":"Koruyeh"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1145\/2370816.2370865"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO.2018.00042"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/3352460.3358314"},{"volume-title":"Intel analysis of speculative execution side channels, Revision 3.0","year":"2021","key":"ref33"},{"volume-title":"Software Techniques for Managing Speculation on AMD Processors, Revision 5.09.23","year":"2023","key":"ref34"},{"volume-title":"Cache Speculation Side-Channels, Revision 2.5","year":"2020","key":"ref35"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.24466"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00011"},{"key":"ref38","article-title":"oo7: Low-overhead defense against spectre attacks via binary analysis","author":"Wang","year":"2018","journal-title":"arXiv:1807.05843"},{"key":"ref39","first-page":"1481","article-title":"SpecFuzz: Bringing spectre-type vulnerabilities to the surface","volume-title":"Proc. USENIX Secur.","author":"Oleksenko"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.5555\/3361338.3361385"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00089"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363219"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354252"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00087"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/isca52012.2021.00035"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA.1999.744314"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO50266.2020.00070"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1145\/1028176.1006727"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1145\/342001.339678"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/2870632"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/3373376.3378453"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/DAC18074.2021.9586089"}],"container-title":["IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/43\/11044910\/10829581.pdf?arnumber=10829581","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,20]],"date-time":"2025-06-20T17:28:14Z","timestamp":1750440494000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10829581\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,7]]},"references-count":52,"journal-issue":{"issue":"7"},"URL":"https:\/\/doi.org\/10.1109\/tcad.2025.3526544","relation":{},"ISSN":["0278-0070","1937-4151"],"issn-type":[{"type":"print","value":"0278-0070"},{"type":"electronic","value":"1937-4151"}],"subject":[],"published":{"date-parts":[[2025,7]]}}}