Search papers, labs, and topics across Lattice.
This paper uncovers a novel class of CPU-to-GPU side-channel attacks on Apple Silicon by exploiting shared last-level cache (LLC) access patterns, enabling fine-grained monitoring of GPU workloads from an unprivileged CPU process. By reverse-engineering the Apple M1's cache indexing functions, the authors develop the CPrime+CProbe technique, which achieves significant improvements in covert-channel throughput through an accelerated variant, GPrime+CProbe. The practical implications are demonstrated through successful privacy attacks on Graph Neural Networks and language models, achieving high accuracy in recovering sensitive information, thus highlighting critical vulnerabilities in modern heterogeneous SoC designs.
Fine-grained access-driven side-channel attacks can extract sensitive information from GPU workloads with unprecedented accuracy, revealing serious vulnerabilities in Apple Silicon's cache architecture.
Modern heterogeneous System-on-Chip designs integrate CPU cores and a GPU that share a last-level cache (LLC) or system-level cache (SLC). This sharing exposes a new cross-domain attack surface, and existing attacks on integrated platforms either exploit coarse-grained cache-occupancy contention or require the adversary to co-reside on the GPU with the victim to obtain accurate timing measurements. In this work, we target Apple Silicon heterogeneous SoCs and discover that GPU memory accesses leave set-level footprints in the shared SLC, observable to an unprivileged CPU process. This keen observation enables the first fine-grained, access-driven, Prime+Probe-style CPU-to-GPU cache side-channel attacks against GPU workloads. We first reverse-engineer the Apple M1 SLC set-indexing functions and the interactions between local private caches and the SLC. Building on these findings, we construct the CPrime+CProbe SLC side-channel technique, which monitors GPU victim activity from the CPU at cache-set granularity. We then introduce an accelerated variant, GPrime+CProbe, in which an adversary leverages the GPU for faster SLC priming, yielding a 6.4x increase in the covert-channel throughput. Lastly, we demonstrate two end-to-end privacy attacks using the new side-channels: a graph-edge reconstruction attack on Graph Neural Networks (GNNs) that achieves 90% edge accuracy across five datasets, and an LLM privacy attack that recovers input keywords with up to 94.8% accuracy and model responses with up to 88.9% accuracy across TinyLlama and GPT-2 Medium models. Our results reveal a new class of microarchitectural vulnerabilities in Apple Silicon and call for secure system cache designs for heterogeneous SoCs.
