Search papers, labs, and topics across Lattice.
This paper introduces WarpGuard, a novel framework for control-flow attestation (CFA) that addresses the security gaps in heterogeneous CPU-GPU workloads, particularly in safety-critical embedded systems. By integrating runtime verification for GPU kernels with a unified control-flow graph that encompasses both CPU and GPU components, WarpGuard effectively detects runtime attacks and violations of CPU-GPU interaction contracts. Evaluation on an NVIDIA Jetson Orin Nano demonstrates its capability to identify GPU-side control-flow attacks with moderate overhead, highlighting its practicality for real-world applications.
Runtime attacks on GPU kernels are now detectable, bridging a critical security gap in heterogeneous CPU-GPU systems.
Heterogeneous CPU-GPU workloads are increasingly used in safety-critical embedded systems, yet no existing approach provides joint attestation of their execution. Prior Control-Flow Attestation (CFA) techniques focus on CPU-side CFA, while GPU attestation is limited to static, load-time verification and does not provide runtime guarantees. As a result, runtime attacks on GPU kernels and violations of the CPU-GPU interaction contract remain unaddressed. We present WarpGuard, the first composite CFA framework for heterogeneous CPU-GPU workloads. WarpGuard verifies execution against a unified control-flow graph (CFG) that captures both CPU and GPU components. It extends prior CFA techniques in two ways: it enables runtime CFA of GPU kernels by tracing their execution against kernel-specific CFGs, and it monitors kernel launch events and enforces per-call site policies to detect violations at the CPU-GPU boundary. These extensions address challenges arising from GPU parallelism and cross-device interactions. We implement WarpGuard using software-based instrumentation, requiring no specialized hardware or binary modifications. Our evaluation on an NVIDIA Jetson Orin Nano shows that WarpGuard detects GPU-side control-flow and cross-boundary attacks. Across microbenchmarks, SPECAccel, and eight TensorRT inference workloads, WarpGuard incurs moderate overheads, suggesting practicality for embedded safety-critical settings.
NVIDIA