{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,23]],"date-time":"2026-01-23T15:49:13Z","timestamp":1769183353874,"version":"3.49.0"},"reference-count":57,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"2","license":[{"start":{"date-parts":[[2026,2,1]],"date-time":"2026-02-01T00:00:00Z","timestamp":1769904000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,2,1]],"date-time":"2026-02-01T00:00:00Z","timestamp":1769904000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,2,1]],"date-time":"2026-02-01T00:00:00Z","timestamp":1769904000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62372258"],"award-info":[{"award-number":["62372258"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100005089","name":"Beijing Natural Science Foundation","doi-asserted-by":"publisher","award":["4242026"],"award-info":[{"award-number":["4242026"]}],"id":[{"id":"10.13039\/501100005089","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","award":["2023RC71"],"award-info":[{"award-number":["2023RC71"]}],"id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Comput.-Aided Des. Integr. Circuits Syst."],"published-print":{"date-parts":[[2026,2]]},"DOI":"10.1109\/tcad.2025.3585078","type":"journal-article","created":{"date-parts":[[2025,7,2]],"date-time":"2025-07-02T13:45:05Z","timestamp":1751463905000},"page":"1075-1088","source":"Crossref","is-referenced-by-count":0,"title":["Exploiting ARMeD Channels By Reverse Engineering ARM Memory Disambiguation Unit"],"prefix":"10.1109","volume":"45","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1834-4958","authenticated-orcid":false,"given":"Chang","family":"Liu","sequence":"first","affiliation":[{"name":"Department of Computer Science and Technology, Tsinghua University, Beijing, China"}]},{"given":"Zhouyang","family":"Li","sequence":"additional","affiliation":[{"name":"Key Laboratory of Trustworthy Distributed Computing and Service, Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-0474-5030","authenticated-orcid":false,"given":"Haixia","family":"Wang","sequence":"additional","affiliation":[{"name":"Beijing National Research Center for Information Science and Technology, Tsinghua University, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-4043-2119","authenticated-orcid":false,"given":"Pengfei","family":"Qiu","sequence":"additional","affiliation":[{"name":"Key Laboratory of Trustworthy Distributed Computing and Service, Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6759-8949","authenticated-orcid":false,"given":"Gang","family":"Qu","sequence":"additional","affiliation":[{"name":"Department of Electrical and Computer Engineering and the Institute for Systems Research, University of Maryland, College Park, MD, USA"}]},{"given":"Dongsheng","family":"Wang","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Technology, Tsinghua University, Beijing, China"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00066"},{"key":"ref2","volume-title":"Arm Armv8-a architecture registers"},{"key":"ref3","first-page":"1","article-title":"Branch history injection: On the effectiveness of hardware mitigations against cross-privilege spectre-v2 attacks","volume-title":"Proc. USENIX Secur. Symp. (USENIX Secur.)","author":"Barberis"},{"key":"ref4","first-page":"1","article-title":"A systematic evaluation of transient execution attacks and defenses","volume-title":"Proc. USENIX Secur. Symp. (USENIX Secur.)","author":"Canella"},{"key":"ref5","first-page":"1","article-title":"GoFetch: Breaking constant-time cryptographic implementations using data memory-dependent prefetchers","volume-title":"Proc. USENIX Secur. Symp. (USENIX Secur.)","author":"Chen"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA57654.2024.00037"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3575693.3575719"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/ISCA.1998.694770"},{"key":"ref9","volume-title":"Arm cortex-A73 MPCore processor technical reference manual r1p0","year":"2024"},{"key":"ref10","volume-title":"ARM Cortex-a72 MPCore processor technical reference manual r0p3"},{"key":"ref11","volume-title":"Inside Intel\u00ae coreTM microarchitecture and smart memory access","author":"Doweck","year":"2006"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/3173162.3173204"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3411504.3421216"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179368"},{"key":"ref15","volume-title":"gem5","year":"2024"},{"key":"ref16","first-page":"955","article-title":"Translation leak-aside buffer: Defeating cache side-channel protections with TLB attacks","volume-title":"Proc. USENIX Secur. Symp. (USENIX Secur.)","author":"Gras"},{"key":"ref17","first-page":"1075","article-title":"AutoLock: Why cache attacks on ARM are harder than you think","volume-title":"Proc. USENIX Secur. Symp. (USENIX Secur.)","author":"Green"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.11"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/HOST49136.2021.9702290"},{"key":"ref20","volume-title":"Store-to-load forwarding and memory disambiguation in x86 processors","author":"","year":"2014"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-09484-2_7"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2025.230208"},{"key":"ref23","first-page":"1","article-title":"FLOP: Breaking the apple M3 CPU via false load output predictions","volume-title":"Proc. USENIX Secur. Symp. (USENIX Secur.)","author":"Kim"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00098"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO.2018.00083"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00002"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/DAC18074.2021.9586226"},{"key":"ref28","first-page":"1","article-title":"Attack directories on ARM big.LITTLE processors","volume-title":"Proc. 41st IEEE\/ACM Int. Conf. Comput.-Aided Design (ICCAD)","author":"Kou"},{"key":"ref29","volume-title":"Counter-based memory disambiguation techniques for selectively predicting load\/store conflicts","author":"Krimer","year":"2009"},{"key":"ref30","first-page":"1","article-title":"ARMageddon: Cache attacks on mobile devices","volume-title":"Proc. USENIX Secur. Symp. (USENIX Secur.)","author":"Lipp"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/3676641.3716004"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/DAC56929.2023.10247985"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA57654.2024.00014"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179391"},{"key":"ref35","first-page":"1","article-title":"Rage against the machine clear: A systematic analysis of machine clears and their implications for transient execution attacks","volume-title":"Proc. USENIX Secur. Symp. (USENIX Secur.)","author":"Ragab"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/3470496.3527429"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354197"},{"key":"ref38","first-page":"723","article-title":"Efficient invisible speculative execution through selective delay and value prediction","volume-title":"Proc. Annu. Int. Symp. Comput. Archit. (ISCA)","author":"Sakalis"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3623124"},{"key":"ref40","volume-title":"Pteditor","author":"Schwarz","year":"2018"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/3560834.3563823"},{"key":"ref42","article-title":"Understanding LSTM\u2013a tutorial into long short-term memory recurrent neural networks","author":"Staudemeyer","year":"2019","journal-title":"arXiv:1909.09586"},{"key":"ref43","volume-title":"Why raspberry pi isn\u2019t vulnerable to spectre or meltdown","author":"Upton","year":"2018"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833570"},{"key":"ref45","first-page":"1","article-title":"ScatterCache: Thwarting cache attacks via cache set randomization","volume-title":"Proc. USENIX Secur. Symp. (USENIX Secur.)","author":"Werner"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/TC.2022.3222083"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA57654.2024.00012"},{"key":"ref48","volume-title":"XUANTIE-RV, openc910","year":"2025"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO.2018.00042"},{"key":"ref50","first-page":"719","article-title":"FLUSH+RELOAD: A high resolution, low noise, L3 cache side-channel attack","volume-title":"Proc. USENIX Secur. Symp. (USENIX Secur.)","author":"Yarom"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/3620666.3651382"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179415"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/tdsc.2025.3525628"},{"key":"ref54","article-title":"TruSpy}: Cache side-channel information leakage from the secure world on ARM devices","author":"Zhang","year":"2016"},{"key":"ref55","first-page":"1","article-title":"MWAIT for it: Bridging the gap between microarchitectural and architectural side channels","volume-title":"Proc. USENIX Secur. Symp. (USENIX Secur.)","author":"Zhang"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978360"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA57654.2024.00039"}],"container-title":["IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/43\/11360509\/11063390.pdf?arnumber=11063390","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,22]],"date-time":"2026-01-22T21:02:16Z","timestamp":1769115736000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11063390\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,2]]},"references-count":57,"journal-issue":{"issue":"2"},"URL":"https:\/\/doi.org\/10.1109\/tcad.2025.3585078","relation":{},"ISSN":["0278-0070","1937-4151"],"issn-type":[{"value":"0278-0070","type":"print"},{"value":"1937-4151","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,2]]}}}