arXiv subjects

Martin Berger

Publications and source records attributed to Martin Berger.

At least 19 recordsLinked to original sources

arXiv2026

Mechanised operational semantics of Rowhammer

Rowhammer is a hardware vulnerability in dynamic random-access memory (DRAM) in which repeated accesses to aggressor rows can induce bit-flips in victim rows. This phenomenon violates a core assumption of conventional programming language semantics: reading or writing one memory location does not modify others. Despite the security importance of this phenomenon, there is no formal framework connecting Rowhammer faults with program behaviour. We present a probabilistic small-step operational semantics for an idealised imperative language subject to Rowhammer-style faults. The semantics abstracts from DRAM internals and semiconductor physics. A general probabilistic fault model parameterises the semantics, representing Rowhammer-style faults by assigning probabilities to bit-flips during read or write operations. The resulting distributions are propagated through programs using the standard monadic structure of probabilistic computation. As a case study, we formalise a well-known defence that places program variables sufficiently far apart in physical memory that an access to one variable cannot disturb another. We prove a distribution-independent semantic collapse theorem: for every finite execution, including prefixes of terminating and non-terminating executions, the protected projection of the probabilistic Rowhammer semantics is the Dirac distribution of the corresponding Rowhammer-free execution. We develop an observation-parametric account of secure information flow. Non-interference is expressed as a hyperproperty comparing the distributions of low observations from low-equivalent initial memories. Consequently, physical separation preserves non-interference for every admissible fault model, while every Rowhammer non-interference violation reflects a violation already present in the Rowhammer-free semantics. The development is fully mechanised in Lean using mathlib.

cs.PL↗

arXiv2026

PG-MDP: Profile-Guided Memory Dependence Prediction for Area-Constrained Cores

Memory Dependence Prediction (MDP) is a speculative technique to predict which stores, if any, a given load will depend on. Area-constrained cores are increasingly relevant in various applications such as energy-efficient or edge systems, and often have limited space for MDP tables. This leads to a high rate of false dependencies as memory independent loads alias with unrelated predictor entries, causing unnecessary stalls in the processor pipeline. The conventional way to address this problem is with greater predictor size or complexity, but this is unattractive on area-constrained cores. This paper demonstrates that targeting the predictor working set delivers the majority of available performance without scaling any hardware structures. We achieve this with profile-guided memory dependence prediction (PG-MDP), a hardware-software co-design to label consistently memory independent loads via their opcode and remove them from the MDP working set. These loads bypass querying the MDP and always issue as soon as possible. In the event that a labeled load incorrectly passes a store to the same address, a rollback is triggered as usual but no new MDP entry is created. Across the SPECspeed 2017 suites, PG-MDP reduces MDP load queries by 80%, false dependencies by 84%, and improves geomean IPC for a small (ROB=128) simulated core by 4.6% (to within 1.2% of the IPC when using 8x more predictor entries), with no area cost and no additional instruction bandwidth.

cs.PL↗

arXiv2025

GPU accelerated program synthesis: Enumerate semantics, not syntax!

Program synthesis is an umbrella term for generating programs and logical formulae from specifications. With the remarkable performance improvements that GPUs enable for deep learning, a natural question arose: can we also implement a search-based program synthesiser on GPUs to achieve similar performance improvements? In this article we discuss our insights on this question, based on recent works~. The goal is to build a synthesiser running on GPUs which takes as input positive and negative example traces and returns a logical formula accepting the positive and rejecting the negative traces. With GPU-friendly programming techniques -- using the semantics of formulae to minimise data movement and reduce data-dependent branching -- our synthesiser scales to significantly larger synthesis problems, and operates much faster than the previous CPU-based state-of-the-art. We believe the insights that make our approach GPU-friendly have wide potential for enhancing the performance of other formal methods (FM) workloads.

cs.PL↗

arXiv2025

Pydrofoil: accelerating Sail-based instruction set simulators

We present Pydrofoil, a multi-stage compiler that generates instruction set simulators (ISSs) from processor instruction set architectures (ISAs) expressed in the high-level, verification-oriented ISA specification language Sail. Pydrofoil shows a > 230x speedup over the C-based ISS generated by Sail on our benchmarks, and is based on the following insights. (i) An ISS is effectively an interpreter loop, and tracing just-in-time (JIT) compilers have proven effective at accelerating those, albeit mostly for dynamically typed languages. (ii) ISS workloads are highly atypical, dominated by intensive bit manipulation operations. Conventional compiler optimisations for general-purpose programming languages have limited impact for speeding up such workloads. We develop suitable domain-specific optimisations. (iii) Neither tracing JIT compilers, nor ahead-of-time (AOT) compilation alone, even with domain-specific optimisations, suffice for the generation of performant ISSs. Pydrofoil therefore implements a hybrid approach, pairing an AOT compiler with a tracing JIT built on the meta-tracing PyPy framework. AOT and JIT use domain-specific optimisations. Our benchmarks demonstrate that combining AOT and JIT compilers provides significantly greater performance gains than using either compiler alone.

cs.PL↗

arXiv2024

Improving Memory Dependence Prediction with Static Analysis

This paper explores the potential of communicating information gained by static analysis from compilers to Out-of-Order (OoO) machines, focusing on the memory dependence predictor (MDP). The MDP enables loads to issue without all in-flight store addresses being known, with minimal memory order violations. We use LLVM to find loads with no dependencies and label them via their opcode. These labelled loads skip making lookups into the MDP, improving prediction accuracy by reducing false dependencies. We communicate this information in a minimally intrusive way, i.e.~without introducing additional hardware costs or instruction bandwidth, providing these improvements without any additional overhead in the CPU. We find that in select cases in Spec2017, a significant number of load instructions can skip interacting with the MDP and lead to a performance gain. These results point to greater possibilities for static analysis as a source of near zero cost performance gains in future CPU designs.

cs.PL↗

arXiv2024

LTL learning on GPUs

Linear temporal logic (LTL) is widely used in industrial verification. LTL formulae can be learned from traces. Scaling LTL formula learning is an open problem. We implement the first GPU-based LTL learner using a novel form of enumerative program synthesis. The learner is sound and complete. Our benchmarks indicate that it handles traces at least 2048 times more numerous, and on average at least 46 times faster than existing state-of-the-art learners. This is achieved with, among others, novel branch-free LTL semantics that has $O(\log n)$ time complexity, where $n$ is trace length, while previous implementations are $O(n^2)$ or worse (assuming bitwise boolean operations and shifts by powers of 2 have unit costs -- a realistic assumption on modern processors).

cs.PL↗

arXiv2023

Correct and Optimal: the Regular Expression Inference Challenge

We propose regular expression inference (REI) as a challenge for code/language modelling, and the wider machine learning community. REI is a supervised machine learning (ML) and program optimisation task, and poses the problem of finding minimal regular expressions from examples: Given two finite sets of strings $P$ and $N$ and a cost function $cost(\cdot)$, the task is to generate an expression $r$ that accepts all strings in $P$ and rejects all strings in $N$, while no other such expression $r'$ exists with $cost(r')<cost(r)$. REI has advantages as a challenge problem: (i) regular expressions are well-known, widely used, and a natural idealisation of code; (ii) REI's asymptotic worst-case complexity is well understood; (iii) REI has a small number of easy to understand parameters (e.g. $P$ or $N$ cardinality, string lengths of examples, or the cost function); this lets us easily finetune REI-hardness; (iv) REI, with its emphasis on optimisation, is an unsolved problem for deep learning based ML. Recently, an REI solver was implemented on GPUs, using program synthesis techniques. This enabled, for the first time, fast generation of minimal regular expressions for complex REI instances. Building on this advance, we generate and publish the first large-scale datasets for REI, and devise and evaluate several initial heuristic and machine learning baselines. We invite the community to participate and explore ML methods that learn to solve REI problems. We believe that progress in REI directly translates to progress in code/language modelling.

cs.LG↗

arXiv2023

Search-Based Regular Expression Inference on a GPU

Regular expression inference (REI) is a supervised machine learning and program synthesis problem that takes a cost metric for regular expressions, and positive and negative examples of strings as input. It outputs a regular expression that is precise (i.e., accepts all positive and rejects all negative examples), and minimal w.r.t. to the cost metric. We present a novel algorithm for REI over arbitrary alphabets that is enumerative and trades off time for space. Our main algorithmic idea is to implement the search space of regular expressions succinctly as a contiguous matrix of bitvectors. Collectively, the bitvectors represent, as characteristic sequences, all sub-languages of the infix-closure of the union of positive and negative examples. Mathematically, this is a semiring of (a variant of) formal power series. Infix-closure enables bottom-up compositional construction of larger from smaller regular expressions using the operations of our semiring. This minimises data movement and data-dependent branching, hence maximises data-parallelism. In addition, the infix-closure remains unchanged during the search, hence search can be staged: first pre-compute various expensive operations, and then run the compute intensive search process. We provide two C++ implementations, one for general purpose CPUs and one for Nvidia GPUs (using CUDA). We benchmark both on Google Colab Pro: the GPU implementation is on average over 1000x faster than the CPU implementation on the hardest benchmarks.

cs.PL↗

arXiv2023

A modest proposal: explicit support for foundational pluralism

Whilst mathematicians assume classical reasoning principles by default they often context switch when working, restricting themselves to various forms of subclassical reasoning. This pattern is especially common amongst logicians and set theorists, but workaday mathematicians also commonly do this too, witnessed by narrative notes accompanying a proof -- "the following proof is constructive", or "the following proof does not use choice", for example. Yet, current proof assistants provide poor support for capturing these narrative notes formally, an observation that is especially true of systems based on Gordon's HOL, a classical higher-order logic. Consequently, HOL and its many implementations seem ironically more committed to classical reasoning than mainstream mathematicians are themselves, limiting the mathematical content that one may easily formalise. To facilitate these context switches, we propose that mathematicians mentally employ a simple tainting system when temporarily working subclassically -- an idea not currently explored in proof assistants. We introduce a series of modest but far-reaching changes to HOL, extending the standard two-place Natural Deduction relation to incorporate a taint-label, taken from a particular lattice, and which describes or limits the "amount" of classical reasoning used within a proof. Taint can be seen either as a simple typing system on HOL proofs, or as a form of static analysis on proof trees, and partitions our logic into various fragments of differing expressivity, sitting side-by-side. Results may pass from a "less classical" fragment into a "more classical" fragment of the logic without modification, but not vice versa, with the flow of results between worlds controlled by an inference rule akin to a subtyping or subsumption rule.

cs.LO↗

arXiv2023

Classifying Linear Matrix Inequalities via Abstract Operator Systems

We systematically study how properties of abstract operator systems help classifying linear matrix inequality definitions of sets. Our main focus is on polyhedral cones, the 3-dimensional Lorentz cone, where we can completely describe all defining linear matrix inequalities, and on the cone of positive semidefinite matrices. Here we use results on isometries between matrix algebras to describe linear matrix inequality definitions of relatively small size. We conversely use the theory of operator systems to characterize special such isometries.

math.FA↗

arXiv2022

ALARM: Active LeArning of Rowhammer Mitigations

Rowhammer is a serious security problem of contemporary dynamic random-access memory (DRAM) where reads or writes of bits can flip other bits. DRAM manufacturers add mitigations, but don't disclose details, making it difficult for customers to evaluate their efficacy. We present a tool, based on active learning, that automatically infers parameter of Rowhammer mitigations against synthetic models of modern DRAM.

cs.CR↗

arXiv2022

Cluster-Based Autoencoders for Volumetric Point Clouds

Autoencoders allow to reconstruct a given input from a small set of parameters. However, the input size is often limited due to computational costs. We therefore propose a clustering and reassembling method for volumetric point clouds, in order to allow high resolution data as input. We furthermore present an autoencoder based on the well-known FoldingNet for volumetric point clouds and discuss how our approach can be utilized for blending between high resolution point clouds as well as for transferring a volumetric design/style onto a pointcloud while maintaining its shape.

cs.CV↗

arXiv2021

Systematic Analysis of Programming Languages and Their Execution Environments for Spectre Attacks

In this paper, we analyze the security of programming languages and their execution environments (compilers and interpreters) with respect to Spectre attacks. The analysis shows that only 16 out of 42 execution environments have mitigations against at least one Spectre variant, i.e., 26 have no mitigations against any Spectre variant. Using our novel tool Speconnector, we develop Spectre proof-of-concept attacks in 8 programming languages and on code generated by 11 execution environments that were previously not known to be affected. Our results highlight some programming languages that are used to implement security-critical code, but remain entirely unprotected, even three years after the discovery of Spectre.

cs.CR↗

arXiv2021

Abstract Operator Systems over the Cone of Positive Semidefinite Matrices

There are several important abstract operator systems with the convex cone of positive semidefinite matrices at the first level. Well-known are the operator systems of separable matrices, of positive semidefinite matrices, and of block positive matrices. In terms of maps, these are the operator systems of entanglement breaking, completely positive, and positive linear maps, respectively. But there exist other interesting and less well-studied such operator systems, for example those of completely copositive maps, doubly completely positive maps, and decomposable maps, which all play an important role in quantum information theory. We investigate which of these systems is finitely generated, and which admits a finite-dimensional realization in the sense of the Choi-Effros Theorem. We answer this question for all of the described systems completely. Our main contribution is that decomposable maps form a system which does not admit a finite-dimensional realization, though being finitely generated, whereas the system of doubly completely positive maps is not finitely generated, though having a finite-dimensional realization. This also implies that there cannot exist a finitary Choi-type characterization of doubly completely positive maps.

math.OA↗

arXiv2021

A program logic for fresh name generation

We present a program logic for Pitts and Stark's {\nu}-calculus, an extension of the call-by-value simply-typed {\lambda}-calculus with a mechanism for the generation of fresh names. Names can be compared for (in)-equality, producing programs with subtle observable properties. Hidden names produced by interactions between generation and abstraction are captured logically with a second-order quantifier over type contexts. We illustrate usage of the logic through reasoning about well-known difficult cases from the literature.

cs.LO↗

arXiv2018

Deep Neural Networks for ECG-free Cardiac Phase and End-Diastolic Frame Detection on Coronary Angiographies

Invasive coronary angiography (ICA) is the gold standard in Coronary Artery Disease (CAD) imaging. Detection of the end-diastolic frame (EDF) and, in general, cardiac phase detection on each temporal frame of a coronary angiography acquisition is of significant importance for the anatomical and non-invasive functional assessment of CAD. This task is generally performed via manual frame selection or semi-automated selection based on simultaneously acquired ECG signals - thus introducing the requirement of simultaneous ECG recordings. We evaluate the performance of a purely image based workflow based on deep neural networks for fully automated cardiac phase and EDF detection on coronary angiographies. A first deep neural network (DNN), trained to detect coronary arteries, is employed to preselect a subset of frames in which coronary arteries are well visible. A second DNN predicts cardiac phase labels for each frame. Only in the training and evaluation phases for the second DNN, ECG signals are used to provide ground truth labels for each angiographic frame. The networks were trained on 17800 coronary angiographies from 3900 patients and evaluated on 27900 coronary angiographies from 6250 patients. No exclusion criteria related to patient state, previous interventions, or pathology were formulated. Cardiac phase detection had an accuracy of 97.6%, a sensitivity of 97.6% and a specificity of 97.5% on the evaluation set. EDF prediction had a precision of 97.4% and a recall of 96.9%. Several sub-group analyses were performed, indicating that the cardiac phase detection performance is largely independent from acquisition angles and the heart rate of the patient. The average execution time of cardiac phase detection for one angiographic series was on average less than five seconds on a standard workstation.

cs.CV↗

arXiv2018

Viewpoint Planning for Quantitative Coronary Angiography

In coronary angiography the condition of myocardial blood supply is assessed by analyzing 2-D X-ray projections of contrasted coronary arteries. This is done using a flexible C-arm system. Due to the X-ray immanent dimensionality reduction projecting the 3-D scene onto a 2-D image, the viewpoint is critical to guarantee an appropriate view onto the affected artery and, thus, enable reliable diagnosis. In this work we introduce an algorithm computing optimal viewpoints for the assessment of coronary arteries without the need for 3-D models. We introduce the concept of optimal viewpoint planning solely based on a single angiographic X-ray image. The subsequent viewpoint is computed such that it is rotated precisely around a vessel, while minimizing foreshortening. Our algorithm reduces foreshortening substantially compared to the input view and completely eliminates it for 90 degree rotations. Rotations around iso-centered foreshortening-free vessels passing the isocenter are exact. The precision, however, decreases when the vessel is off-centered or foreshortened. We evaluate worst case boundaries, providing insight in the maximal inaccuracies to be expected. This can be utilized to design viewpoints guaranteeing desired requirements, e.g. a true rotation around the vessel of at minimum 30 degree.

physics.med-ph↗

arXiv2018

Phase-Sensitive Region-of-Interest Computed Tomography

X-Ray Phase-Contrast Imaging (PCI) yields absorption, differential phase, and dark-field images. Computed Tomography (CT) of grating-based PCI can in principle provide high-resolution soft-tissue contrast. Recently, grating-based PCI took several hurdles towards clinical implementation by addressing, for example, acquisition speed, high X-ray energies, and system vibrations. However, a critical impediment in all grating-based systems lies in limits that constrain the grating diameter to few centimeters. In this work, we propose a system and a reconstruction algorithm to circumvent this constraint in a clinically compatible way. We propose to perform a phase-sensitive Region-of-Interest (ROI) CT within a full-field absorption CT. The biggest advantage of this approach is that it allows to correct for phase truncation artifacts, and to obtain quantitative phase values. Our method is robust, and shows high-quality results on simulated data and on a biological mouse sample. This work is a proof of concept showing the potential to use PCI in CT on large specimen, such as humans, in clinical applications.

physics.med-ph↗