Spec-LAMP: Robust Spectre Attack Detection Under Web-Based LLM Workload via L1D Miss Pending Event

Area of Science:

• Computer Science
• Cybersecurity
• Hardware Security

Background:

• Large Language Models (LLMs) are increasingly used in web environments.
• LLM workloads introduce microarchitectural noise, challenging hardware security.
• Existing hardware security mechanisms struggle with LLM-induced interference.

Purpose of the Study:

• To investigate the impact of concurrent web-based LLM workloads on Spectre attack detection accuracy.
• To propose a novel detection method resilient to LLM interference.

Main Methods:

• Constructed a dataset by running web-accessible LLMs (DeepSeek, Kimi, Doubao, Qwen) concurrently with Spectre attacks.
• Evaluated traditional Hardware Performance Counter (HPC)-based detectors (branch prediction, Last-Level Cache events).
• Proposed Spec-LAMP, augmenting HPC features with the L1D Miss Pending event.

Main Results:

• Traditional HPC detectors showed significant accuracy degradation due to LLM noise.
• The L1D Miss Pending event effectively captures Spectre attack characteristics under LLM interference.
• Spec-LAMP increased average detection accuracy from 85.15% to 98.43%.

Conclusions:

• LLM-induced noise significantly impacts Spectre attack detection.
• Augmenting HPC features with L1D Miss Pending enhances detection robustness.
• Spec-LAMP offers superior performance in realistic web-based LLM scenarios.