arXiv subjects

Lorenzo Casalino

Publications and source records attributed to Lorenzo Casalino.

5 recordsLinked to original sources

arXiv2026

Double Strike: Breaking Approximation-Based Side-Channel Countermeasures for DNNs

Deep neural networks (DNNs), which support services such as driving assistants and medical diagnoses, undergo lengthy and expensive training procedures. Therefore, the training's outcome - the DNN weights - represents a significant intellectual property asset to protect. Side-channel analysis (SCA) has recently appeared as an effective approach to recover this confidential asset from DNN implementations. In response, researchers have proposed to defend DNN implementations through classic side-channel countermeasures, at the cost of higher energy consumption, inference time, and resource utilisation. Following a different approach, Ding et al. (HOST'25) introduced MACPRUNING, a novel SCA countermeasure based on pruning, a performance-oriented Approximate Computing technique: at inference time, the implementation randomly prunes (or skips) non-important weights (i.e., with low contribution to the DNN's accuracy) of the first layer, exponentially increasing the side-channel resilience of the protected DNN implementation. However, the original security analysis of MACPRUNING did not consider a control-flow dependency intrinsic to the countermeasure design. This dependency may allow an attacker to circumvent MACPRUNING and recover the weights important to the DNN's accuracy. This paper describes a preprocessing methodology to exploit the above-mentioned control-flow dependency. Through practical experiments on a Chipwhisperer-Lite running a MACPRUNING-protected Multi-Layer Perceptron, we target the first 8 weights of each neuron and recover 96% of the important weights, demonstrating the drastic reduction in security of the protected implementation. Moreover, we show how microarchitectural leakage improves the effectiveness of our methodology, even allowing for the recovery of up to 100% of the targeted non-important weights. Lastly, by adapting our methodology [continue in pdf].

cs.CR↗

arXiv2025

Knock-Knock: Black-Box, Platform-Agnostic DRAM Address-Mapping Reverse Engineering

Modern Systems-on-Chip (SoCs) employ undocumented linear address-scrambling functions to obfuscate DRAM addressing, which complicates DRAM-aware performance optimizations and hinders proactive security analysis of DRAM-based attacks; most notably, Rowhammer. Although previous work tackled the issue of reversing physical-to-DRAM mapping, existing heuristic-based reverse-engineering approaches are partial, costly, and impractical for comprehensive recovery. This paper establishes a rigorous theoretical foundation and provides efficient practical algorithms for black-box, complete physical-to-DRAM address-mapping recovery. We first formulate the reverse-engineering problem within a linear algebraic model over the finite field GF(2). We characterize the timing fingerprints of row-buffer conflicts, proving a relationship between a bank addressing matrix and an empirically constructed matrix of physical addresses. Based on this characterization, we develop an efficient, noise-robust, and fully platform-agnostic algorithm to recover the full bank-mask basis in polynomial time, a significant improvement over the exponential search from previous works. We further generalize our model to complex row mappings, introducing new hardware-based hypotheses that enable the automatic recovery of a row basis instead of previous human-guided contributions. Evaluations across embedded and server-class architectures confirm our method's effectiveness, successfully reconstructing known mappings and uncovering previously unknown scrambling functions. Our method provides a 99% recall and accuracy on all tested platforms. Most notably, Knock-Knock runs in under a few minutes, even on systems with more than 500GB of DRAM, showcasing the scalability of our method. Our approach provides an automated, principled pathway to accurate DRAM reverse engineering.

cs.CR↗

arXiv2022

Geometric approach to the definition of emission coordinates

We investigate a relativistic positioning system where the coordinates of the users are determined by the proper times broadcasted by clocks in motion in spacetime: these are the so-called emission coordinates. In particular, we focus on emission coordinates in flat spacetime: in this case, we show that these coordinates can be defined using an approach based on simple geometrical properties of geodesic triangles. We analyse the 2-dimensional case and then we show how the whole procedure can be applied to 4 dimensions, also in terms of ordinary three-dimensional spheres. An analytic solution for the coordinates of the receiver is obtained. The solution remains valid at almost any place, in particular when redundancy in the number of emitters can be exploited.

gr-qc↗

arXiv2020

Simple $Δ$V Approximation for Optimization of Debris-to-Debris Transfers

A method for the rapid estimation of transfer costs for the removal of debris in low Earth orbit is proposed. Debris objects among a population with similar inclination values are considered. The proposed approximate analysis can provide estimations of actual Deltav between any debris object pair as a function of time; these estimations allow for the rapid evaluation of the costs of large sequences of targets to be removed. The effect of Earth's oblateness perturbation (J2) is exploited to reduce transfer costs. The debris removal problem of the 9th edition of the Global Trajectory Optimization Competition is used to evaluate the estimation accuracy; Deltav estimations of the transfers between objects pairs are verified by comparing them with the GTOC9 solution proposed by the winning team from JPL. The comparison of the results demonstrates the very good accuracy of the simple approximation. Key words: Space debris; approximation; trajectory optimization; J2 perturbation

astro-ph.IM↗

arXiv2019

GTOC X: Solution Approach of Team Sapienza-PoliTo

This paper summarizes the solution approach and the numerical methods developed by the joint team Sapienza University of Rome and Politecnico di Torino (Team Sapienza-PoliTo) in the context of the 10th Global Trajectory Optimization Competition. The proposed method is based on a preliminary partition of the galaxy into several small zones of interest, where partial settlement trees are developed, in order to match a (theoretical) optimal star distribution. A multi-settler stochastic Beam Best-First Search, that exploits a guided multi-star multi-vessel transition logic, is proposed for solving a coverage problem, where the number of stars to capture and their distribution within a zone is assigned. The star-to-star transfers were then optimized through an indirect procedure. A number of refinements, involving settle time re-optimization, explosion, and pruning, were also investigated. The submitted 1013-star solution, as well as an enhanced 1200-point rework, are presented.

math.OC↗