Search papers, labs, and topics across Lattice.
This paper introduces GlitchLab, an innovative online hardware-in-the-loop platform designed to optimize physical fault injection for security testing. By employing RL-Q, a Q-learning-based reinforcement learning approach, and Structured-Outcome-Based Adaptive Search (SOBAS), the system significantly reduces the number of attempts and time required to discover and reproduce target faults in AES, password, and control-flow campaigns. The results show that GlitchLab outperforms baseline methods by up to 1,237 times in efficiency, highlighting its effectiveness in navigating complex fault landscapes.
GlitchLab achieves a staggering 2-85x reduction in attempts and 26-1,237x decrease in time for fault discovery compared to traditional methods.
Physical fault injection can turn brief hardware disturbances into security failures such as key recovery, authentication bypass, and unintended control flow. Finding effective faults is difficult because many interacting parameters create a large search space, successful settings are sparse and target-dependent, and each hardware attempt provides limited feedback. Under fixed testing time, efficient search is therefore critical for assessing fault sensitivity. We present GlitchLab, an online hardware-in-the-loop platform that treats delay as a timing gate, voltage and pulse duration as severity controls, and hardware outcomes as structured feedback. It implements RL-Q (Q-learning-based reinforcement learning), a structured bandit for discovery, and Structured-Outcome-Based Adaptive Search (SOBAS), a model-based policy for fault reproduction. Both policies find a target fault in every AES, password, and control-flow campaign. On AES and control flow, they require 2-85x fewer attempts and 26-1,237x less time than the baselines; on password, both succeed while the baselines fail within 5,000 attempts. After discovery, SOBAS reproduces faults 7.3-21x more often, while RL-Q identifies 30% more distinct AES settings.
