Technical Summary: SLAC – Access-Driven CPU-to-GPU Side-channel Attacks via System-Level Cache on Apple Silicon

Problem Statement

Modern heterogeneous System-on-Chip (SoC) designs, particularly Apple Silicon, integrate CPU cores and GPUs that share a System-Level Cache (SLC) or Last-Level Cache (LLC). This shared resource creates a cross-domain attack surface where an unprivileged CPU process can potentially infer sensitive information from GPU workloads. While prior research has demonstrated GPU-to-CPU side-channels (e.g., Leaky Buddies on Intel) and coarse-grained CPU-to-GPU occupancy attacks on Apple Silicon, a fine-grained, access-driven, Prime+Probe-style CPU-to-GPU side-channel has remained unexplored.

The primary challenges in realizing such an attack on Apple Silicon are:

1. Cache Inclusivity Asymmetry: The SLC is exclusive with respect to CPU private caches (L1/L2) but has a Non-Inclusive Non-Exclusive (NINE) relationship with GPU private caches. This means CPU data accesses do not directly populate the SLC; they must first fill the L2 and evict older lines into the SLC. Conversely, GPU accesses can directly populate the SLC.
2. Lack of Architectural Knowledge: The specific set-indexing functions of the Apple M1 SLC are not publicly documented and differ significantly from traditional CPU caches, making the construction of eviction sets (a prerequisite for Prime+Probe) non-trivial.
3. Observability: The CPU adversary must reliably observe SLC state changes caused by GPU victim activity without co-residing on the GPU.

Methodology

The paper presents SLAC, a framework that overcomes these challenges through reverse engineering and novel side-channel techniques.

1. Reverse Engineering the Apple M1 SLC

The authors developed a methodology to recover the SLC's set-indexing functions and characterize cache interactions:

• Data Transition Analysis: They identified three scenarios for shared data movement. Crucially, they found that GPU reads of data residing in CPU private caches do not populate the SLC; instead, the GPU reads directly from the CPU L2, leaving the SLC untouched. However, if data is already in the SLC, GPU access maintains it there. Furthermore, GPU writes do not allocate cache lines into the SLC (no-write-allocate behavior), meaning a GPU write alone cannot prime the SLC.
• Collision-Profile Clustering: Traditional iterative pruning for eviction-set construction fails on Apple Silicon due to the large candidate space (all 12 set-index bits are hashed) and measurement noise. The authors replaced this with collision-profile clustering. By filling the SLC with a "filler" buffer from the GPU and probing with a "test" buffer, they analyzed which filler lines were evicted. Lines mapping to the same SLC set produce identical eviction patterns (collision profiles), allowing them to be clustered into eviction sets.
• Function Recovery: Using the clustered eviction sets, they recovered 12 linearly independent XOR-based hash functions that map physical address bits (7–32) to the 12-bit SLC set index. They also confirmed the SLC uses an LRU replacement policy.

2. Side-Channel Techniques

Based on the reverse-engineered knowledge, the authors constructed two Prime+Probe variants:

• CPrime+CProbe (CPU-only Priming):

  • Mechanism: Since the SLC is exclusive to CPU caches, the CPU cannot directly prime the SLC. Instead, the attacker loads a large eviction set (SLC_ES) into the CPU L2 cache. As the L2 fills, older lines are evicted into the SLC. A second set (L2_ES) is then loaded to saturate the L2, pushing the SLC_ES lines fully into the SLC.
  • Optimization: To minimize the L2 footprint and priming time, the authors constrained specific address bits to reduce the number of L2 sets affected by the SLC eviction set.
  • Probing: The CPU re-accesses the eviction set to measure latency. High latency indicates an SLC miss (victim accessed the set); low latency indicates an SLC hit.

• GPrime+CProbe (GPU-Accelerated Priming):

  • Mechanism: The attacker leverages GPU parallelism to prime the SLC directly. A two-kernel approach is used: first, a GPU write kernel invalidates any stale CPU L2 copies (due to coherency) but does not populate the SLC; second, a GPU read kernel loads the eviction set directly into the SLC.
  • Advantage: This bypasses the complex two-step CPU L2 saturation process, utilizing the GPU's massive parallelism.

3. Noise Mitigation and Differential Tracing

To distinguish victim activity from background noise, the authors employ:

• Differential Tracing: Collecting a "Baseline Trace" (idle kernel) and a "Target Trace" (victim kernel) and subtracting the former from the latter.
• Multi-run Averaging: Averaging traces over thousands of runs to smooth variance.
• Superset Aggregation: Grouping 64 cache sets into "supersets" to trade spatial resolution for signal clarity, particularly effective for LLM attacks where embedding tables have regular memory layouts.

Key Contributions

1. Reverse Engineering: First public characterization of the Apple M1 SLC set-indexing functions (12-bit hashed indices) and the asymmetric residency policies between CPU, GPU, and SLC.
2. Novel Attack Vectors:
   • CPrime+CProbe: The first access-driven CPU-to-GPU side-channel on Apple Silicon that requires no GPU access from the adversary.
   • GPrime+CProbe: An accelerated variant using GPU priming, achieving a 6.4× increase in covert-channel throughput.
3. End-to-End Privacy Attacks:
   • GNN Edge Recovery: Reconstructing graph structures (edges) from Graph Neural Network inference.
   • LLM Privacy Attack: Recovering input keywords and output tokens from Large Language Model inference.

Experimental Results

Covert Channel Performance

• CPrime+CProbe: Achieved a throughput of 62.5 Kbps.
• GPrime+CProbe: Achieved a throughput of 400 Kbps (6.4× improvement).

Application-Specific Accuracy

• GNN Edge Recovery:

  • Tested on five datasets (Cora, Citeseer, Pubmed, Computers, Photo).
  • GPrime+CProbe achieved >90% edge accuracy across all datasets, with precision reaching 99.9% on Cora and 99.2% on Pubmed.
  • CPrime+CProbe achieved >90% recall and precision above 86% after full-graph reconstruction.

• LLM Input/Output Recovery:

  • Tested on TinyLlama and GPT-2 Medium models.
  • Input Keyword Recovery: GPrime+CProbe achieved up to 94.8% accuracy (TinyLlama/FinancialQA) and 93.4% (GPT-2/MedQuad). CPrime+CProbe reached up to 81.2%.
  • Output Token Recovery: GPrime+CProbe achieved up to 88.9% accuracy (GPT-2/FinancialQA) and 78.7% (TinyLlama/FinancialQA). CPrime+CProbe reached up to 85.3%.

Significance and Claims

The paper claims that SLAC reveals a new class of microarchitectural vulnerabilities in Apple Silicon and, by extension, heterogeneous SoCs. The significance lies in demonstrating that:

1. Shared SLC is a Critical Attack Surface: The shared cache in unified memory architectures allows unprivileged CPU processes to perform fine-grained, access-driven attacks against sensitive GPU workloads, a capability previously thought to require GPU co-residency or limited to coarse-grained observation.
2. Feasibility of Fine-Grained Attacks: Despite the complexity of the SLC indexing and exclusivity policies, fine-grained secrets (like ML model inputs, outputs, and graph structures) can be recovered with high accuracy.
3. Call for Redesign: The results necessitate a careful architectural redesign of cache hierarchies and coherence protocols in heterogeneous systems to mitigate access-driven side-channels. The authors note that while their techniques are specific to M1, the underlying principles likely apply to M1 Pro/Max and M2, and potentially other platforms with non-inclusive GPU caches (e.g., Intel iGPUs, AMD APUs), though specific implementations would differ.

The authors remain modest regarding the scope, noting that their work is a proof-of-concept for Apple Silicon and that future work is needed to broaden this attack family to other M-series chips (e.g., M3 with Dynamic Caching) and other heterogeneous platforms.