Search papers, labs, and topics across Lattice.
This paper introduces WarpGuard, a novel composite Control-Flow Attestation (CFA) framework designed for heterogeneous CPU-GPU workloads, addressing the lack of runtime guarantees in existing GPU attestation methods. By integrating a unified control-flow graph that encompasses both CPU and GPU components, WarpGuard enables real-time verification of GPU kernel execution and monitors CPU-GPU interactions to detect potential security violations. Evaluation results demonstrate that WarpGuard effectively identifies GPU-side control-flow attacks with moderate overhead, making it a viable solution for safety-critical embedded systems.
Runtime attacks on GPU kernels can be effectively mitigated with WarpGuard, the first framework to provide joint attestation for CPU-GPU workloads.
Heterogeneous CPU-GPU workloads are increasingly used in safety-critical embedded systems, yet no existing approach provides joint attestation of their execution. Prior Control-Flow Attestation (CFA) techniques focus on CPU-side CFA, while GPU attestation is limited to static, load-time verification and does not provide runtime guarantees. As a result, runtime attacks on GPU kernels and violations of the CPU-GPU interaction contract remain unaddressed. We present WarpGuard, the first composite CFA framework for heterogeneous CPU-GPU workloads. WarpGuard verifies execution against a unified control-flow graph (CFG) that captures both CPU and GPU components. It extends prior CFA techniques in two ways: it enables runtime CFA of GPU kernels by tracing their execution against kernel-specific CFGs, and it monitors kernel launch events and enforces per-call site policies to detect violations at the CPU-GPU boundary. These extensions address challenges arising from GPU parallelism and cross-device interactions. We implement WarpGuard using software-based instrumentation, requiring no specialized hardware or binary modifications. Our evaluation on an NVIDIA Jetson Orin Nano shows that WarpGuard detects GPU-side control-flow and cross-boundary attacks. Across microbenchmarks, SPECAccel, and eight TensorRT inference workloads, WarpGuard incurs moderate overheads, suggesting practicality for embedded safety-critical settings.
NVIDIA