arXiv: Automated Template-free Synthesis of Instruction-Centric Leakage Contracts for Black-Box CPUs

This paper, published on arXiv, introduces a novel method for automatically generating "leakage contracts" for black-box CPUs without relying on pre-defined templates. A leakage contract formally specifies what information a processor might inadvertently expose through side channels, such as timing or power consumption. The key change is that this approach can analyze any CPU model, including proprietary or undocumented ones, by observing its behavior and inferring potential data leaks, rather than requiring manual analysis or vendor-provided specifications.

The primary affected organizations are those developing or deploying AI systems, particularly in sectors like finance, healthcare, and critical infrastructure where data confidentiality is paramount. Hardware vendors, cloud service providers, and any entity using third-party CPUs for sensitive workloads should also take note. This technique could reveal previously unknown vulnerabilities in processors, impacting compliance with regulations like the EU AI Act, which mandates robust security and transparency for high-risk AI systems.

Compliance teams should first assess whether their organization relies on CPUs that are not fully documented or are from less transparent vendors. Next, they should engage with hardware security teams to evaluate if this automated analysis could be applied to their current processors, especially for high-risk AI applications. Finally, they should monitor for any resulting vulnerability disclosures and update their risk assessments and supply chain due diligence processes accordingly, ensuring that any identified leakage contracts are addressed in their security and compliance documentation.