Technical Summary: uGen: An Agentic Framework for Generating Microarchitectural Attack PoCs

Problem Statement

Microarchitectural side-channel attacks (e.g., Prime+Probe, Spectre) represent a fundamental challenge to computer security. While reference Proof-of-Concept (PoC) implementations exist, adapting them to new microarchitectures, victim functions, or execution environments is notoriously difficult. This process requires deep expertise in low-level hardware behaviors, precise instruction ordering, and fine-grained timing calibration. Consequently, vulnerability assessment remains labor-intensive, non-scalable, and often limited to expert researchers.

Recent advances in Large Language Models (LLMs) suggest a potential avenue for automating code generation. However, the paper identifies a critical gap: LLMs lack the specific microarchitectural reasoning required to synthesize functional attack code. The authors hypothesize that current models frequently misgenerate or misplace critical attack primitives (such as serialization barriers or controlled delays), leading to syntactically correct but functionally inert code. Furthermore, existing training corpora contain few end-to-end attack implementations, leaving models with insufficient exposure to the structural invariants of such exploits.

Methodology: The uGen Framework

To address these limitations, the authors introduce uGen, the first Retrieval-Augmented Generation (RAG) driven, multi-agent framework designed to automate the synthesis of microarchitectural attack PoCs. The framework operates through four distinct stages:

1. Knowledge Gap Profiler (S1): This stage systematically identifies where and why LLMs fail. By disabling RAG and forcing models to rely on internal knowledge, the framework decomposes attacks into "attack metrics" (minimal, semantically meaningful building blocks). It compares generated code against ground-truth implementations to identify missing, misconstructed, or misplaced metrics.
2. RAG Document Generator (S2): Based on the gaps identified in S1, the framework generates targeted RAG documents. These documents are not generic attack descriptions but specific guides for individual metrics, detailing their significance, implementation steps, and precise placement constraints within the code. The generation process is hierarchical, indexed by both attack vector and LLM family, acknowledging that different models require different types of guidance.
3. RAG Validation & Refinement (S3): This stage empirically validates the generated RAG documents. A "Programmer Agent" attempts to patch PoC templates using the retrieved guidance. If the patch fails, a "Feedback Agent" initiates a refinement cycle, potentially involving a domain expert to clarify constraints or remove misleading details. This loop continues until the RAG document reliably guides the synthesis of the target metric.
4. Deployment (S4): In the final stage, a non-expert user can specify a victim function and attack vector. The Programmer Agent synthesizes a PoC from scratch, sequentially retrieving and integrating the validated RAG documents for each required metric. The code is then validated by a "Reflector Agent" using hardware-derived signals (e.g., cache latency, performance counters) to ensure functional correctness.

Key Architectural Components:

• Multi-Agent Design: uGen employs specialized agents (Programmer, Reflector, Gap Analyzer, Synthesizer, Feedback) to decouple code generation from validation, mitigating the "self-evaluation bias" where a single agent rationalizes its own failures.
• Tool-Grounded Execution: Agents are coupled with specialized system-level tools (e.g., hw_info, hpc, cache_thres) that provide machine-verifiable execution signals. This prevents agents from hallucinating successful leakage and forces iterative refinement based on actual hardware feedback.
• Persistent Knowledge Hub: RAG documents are stored in a persistent vector database with pre-computed embeddings to ensure deterministic and reproducible retrieval across experiments.

Key Contributions

1. First Analysis of LLMs for Microarchitectural Attacks: The paper presents a systematic study of state-of-the-art models (GPT-4o, Claude Sonnet-4, Qwen3-Coder), identifying recurring reasoning and instruction-placement errors that prevent successful PoC synthesis.
2. The uGen Framework: A novel, retrieval-augmented, multi-agent framework that explicitly profiles LLM knowledge gaps and injects attack-specific guidance to enable reliable synthesis of complex microarchitectural attacks.
3. Metric-Driven Evaluation: The authors propose a methodology that decomposes attacks into granular metrics, providing the first reproducible benchmark for assessing LLM capabilities in this domain.

Experimental Results

The framework was evaluated across three hardware platforms (Intel Tiger Lake, AMD Ryzen 9, ARM Neoverse-N1) and two attack classes (Spectre-v1, Prime+Probe).

• Baseline Performance: Without RAG augmentation, LLMs achieved success rates of 0% to 20% for generating functional PoCs, primarily failing due to incorrect instruction ordering and missing microarchitectural primitives.
• Impact of RAG: With uGen, success rates improved significantly.
  • Spectre-v1: Claude Sonnet-4 achieved a 90% success rate (up from 0% in some metric-specific tests), and Qwen3-Coder achieved 70%.
  • Prime+Probe: Qwen3-Coder achieved an 80% success rate, while Claude and GPT-4o achieved 70%.
• Efficiency: uGen can generate a successful PoC in under four minutes (e.g., 351s for Spectre-v1 on Claude) with a cost as low as $1.25 (using Qwen3-Coder).
• Portability: The framework demonstrated cross-architecture portability, successfully adapting attacks to AArch64 (ARM) and x86 platforms by utilizing microarchitecture-specific profiling tools and RAG documents.
• Generalization: The system successfully adapted to five different variants of vulnerable victim functions without manual re-engineering of the attack logic.

Significance and Claims

The paper claims that uGen transforms vulnerability assessment from a manual, expert-bound process into a systematic and scalable one. By combining retrieval augmentation, role-specialized reasoning, and hardware-grounded feedback, uGen bridges the gap between LLM capabilities and the rigorous requirements of microarchitectural exploitation.

The authors position uGen primarily as a defensive tool. They argue that while the framework lowers the barrier for generating attack code, it is more beneficial for defenders to systematically test their systems for susceptibility than for attackers to rely on it for building novel exploits. The paper notes that attackers would still face significant hurdles in adopting uGen for real-world malicious campaigns, as the framework is designed for controlled, isolated environments and relies on known attack vectors rather than discovering new vulnerabilities. The work underscores the necessity of understanding LLM limitations in security-critical domains and provides a framework for mitigating those limitations through structured, tool-augmented reasoning.