PhasePrint: Exposing Cloud FPGA Fingerprints by Inducing Timing Faults at Runtime

When you rent an FPGA in the cloud you cannot tell which physical chip you got, and vendors deliberately hide that — but knowing the exact chip matters for both attackers (to exploit data a previous tenant left behind) and defenders (to rotate away from over-exposed chips); this paper (Virginia Tech — Jubayer Mahmod and Matthew Hicks) presents PhasePrint, which turns an ordinary circuit into a fingerprint sensor by slightly sliding two clocks out of phase until the circuit starts making errors, and the exact point where it fails is unique to each chip's manufacturing quirks, identifying one of 300 cloud FPGAs with over 99 percent accuracy.

The argument in one glance

Problem

In the cloud you cannot tell which physical FPGA you rented

Cloud FPGAs — reconfigurable chips you rent on demand from AWS, Azure, or Alibaba to accelerate compute-heavy work like neural networks and video transcoding — give tenants unusually deep, hardware-level control. That control is powerful but dangerous: it enables attacks absent from ordinary compute instances, such as leaking a previous tenant's sensitive data through analog "data remanence" (physical after-effects that linger in the silicon), or building covert channels between tenants through shared power. Every one of these scenarios has a common prerequisite: the ability to identify and target one specific physical FPGA. If you cannot tell which chip you are on, you cannot exploit what a particular victim left behind, and you cannot deliberately co-locate with a target. This ability, called FPGA localization, matters for defenders too — knowing which physical chip you hold lets a defender rotate FPGA usage strategically, avoiding the prolonged exposure of one chip that leads to confidential data burning into it over time. But the cloud is designed to prevent exactly this. Vendors treat the physical identity of the underlying hardware as something to hide.
What people did

Block localization by hiding identifiers and banning oscillators

Cloud vendors go to considerable lengths to stop tenants from learning which physical FPGA they have. They restrict access to low-level, device-identifying information like eFuses and built-in fingerprints; they force designs through a vendor-controlled submission and binary-generation flow with a mandatory hardware "shell" that supplies the clocks and interfaces; they make the resulting FPGA image read-only; and they run design-rule checks that reject known fingerprinting primitives — especially self-oscillating circuits like ring oscillators — plus runtime monitoring that gates a circuit's clock if it draws too much power. Together these measures are meant to block any spatiotemporal tracking of a specific device.
Why it fell short

Compliant fingerprinting is slow, off-chip, or simply banned

The vendor restrictions defeat the obvious fingerprinting techniques and leave the compliant ones weak. Ring-oscillator fingerprints — the classic way to read a chip's manufacturing variation — are outright banned by the design-rule checks, because self-oscillating circuits are treated as malicious. Researchers found indirect methods that comply with the rules, but they are costly and fragile. A leading approach builds a Physical Unclonable Function from the retention behavior of the board's off-chip DRAM: it writes data, waits for it to decay without refresh, and reads back the pattern. That works, but it depends on a specific off-chip board component, and it is slow — it must sequentially load three separate FPGA binaries to obtain a single card's signature. So the state of things was a standoff: the direct, on-chip variation-reading trick (ring oscillators) is forbidden, and the compliant alternatives are slow and tied to off-chip hardware. What was missing was a way to read a chip's unique manufacturing variation entirely on-chip, using only ordinary, rule-compliant circuitry, without tripping any of the vendor's design-time or runtime defenses.
This paper's idea

Slide two clocks out of phase until the chip reveals itself

PhasePrint turns an ordinary, functionally valid circuit into a fingerprint sensor by deliberately inducing timing faults at runtime and reading the resulting error pattern. The idea rests on how synchronous logic works: a signal launches from one register on the edge of a "launch" clock, propagates through some logic, and must be latched into a "capture" register on the edge of a "capture" clock. Normally there is enough time between the two edges for the signal to arrive and settle — the circuit passes timing analysis at design time and is perfectly valid. PhasePrint uses the FPGA's own internal clock synthesizer to generate the launch and capture clocks with a strict, adjustable phase relationship, and then, at runtime, gradually slides the capture edge earlier — narrowing the gap — until the signal no longer has time to propagate and the circuit starts producing wrong answers. The precise phase at which each path first fails is chip-specific, because it depends on the propagation delay through that path, which in turn depends on the tiny manufacturing variations unique to each physical chip. In effect PhasePrint transforms any circuit into a time-to-digital converter, bubbling analog manufacturing variation up into digital error patterns. A specially crafted circuit samples many logical paths; the fault locations become a feature vector, and a support-vector-machine classifier turns those vectors into device signatures. Trained on 300 unique FPGAs across four AWS regions, this entirely on-chip method identifies a chip with over 99 percent accuracy, runs 13 times faster, and costs 92 percent less than the prior state of the art — while staying within the vendor's timing, power, and design rules.

Why this problem is worth solving

FPGA localization is the hinge that many cloud-FPGA attacks and defenses turn on, so a reliable way to do it reshapes the whole threat model.

Cloud FPGAs are unusual among rented compute because they expose the hardware itself, and that exposure creates a class of physical-layer attacks: reading data a prior tenant left behind as analog remanence, or opening covert channels through shared power rails. Almost all of these depend on one capability — knowing you are on a particular physical chip. An attacker who can localize can wait for a victim, land on the same silicon, and harvest what remains; without localization, the attack is a shot in the dark. The same capability is defensively decisive: a provider or a security-conscious tenant who can tell which physical chip they hold can rotate away from chips that have been used too long, before sensitive values burn into the silicon and become recoverable. So localization is not a niche trick; it is the enabling primitive that determines whether a whole family of cloud-FPGA threats is practical, and whether the corresponding defenses are even possible. Precisely because it is so pivotal, vendors invest in blocking it. Demonstrating that localization can be done anyway — cheaply, quickly, and within the rules — is what makes the result important: it shows the barrier is porous, which matters to attackers and defenders alike.

The core insight is that you do not need forbidden components to read a chip’s identity — you can coax it out of an ordinary circuit by squeezing its timing.

Every physical chip is slightly different because manufacturing is imperfect: identical designs come out with subtly different transistor and wire delays. That variation is a natural fingerprint, and the classic way to read it is a ring oscillator, whose frequency reflects delay — which is exactly why vendors ban ring oscillators. PhasePrint’s insight is that you do not need a special oscillator to sense delay; any circuit already encodes its delays in how long its signals take to propagate, and you can measure that by putting the circuit under timing stress. By generating two clocks with a controllable phase offset and slowly closing the gap, PhasePrint asks the circuit a physical question — “can your signal make it across in this little time?” — and the answer, the exact phase at which each path fails, is a direct readout of that path’s delay and therefore of the chip’s manufacturing variation. The elegance is threefold: the circuit is functionally valid and passes design-time timing analysis, so it does not look malicious; the clocks come from the FPGA’s own sanctioned synthesizer, so no banned primitive is used; and the whole thing is on-chip and low-power, so it slips under runtime monitoring. It converts a defended, off-limits measurement into an ordinary-looking computation that quietly leaks the same secret.

What people did before, and where it broke

Ring-oscillator fingerprints. Build self-oscillating circuits whose frequency reveals the chip’s delay and thus its manufacturing variation. Where it broke. Cloud design-rule checks ban self-oscillating circuits as malicious, so this direct method is simply not allowed.
Off-chip DRAM PUF. Fingerprint the card via the retention/decay behavior of the board’s DRAM without refresh. Where it broke. It depends on a specific off-chip board component and is slow, needing three FPGA binaries loaded in sequence to get one signature.
Read vendor identifiers (eFuses, device fingerprints). Query the built-in low-level identity of the chip. Where it broke. Vendors restrict access to exactly this information to prevent localization.
Track a device across allocations directly. Use the shell, clocks, or image to observe which physical chip you have. Where it broke. The vendor-controlled shell, read-only images, and monitoring block spatiotemporal tracking.
The gap. No compliant method read a chip’s manufacturing variation entirely on-chip, quickly, using only ordinary rule-passing circuitry — leaving localization seemingly blocked in practice.

How PhasePrint works

Turning an ordinary circuit into an on-chip fingerprint sensor

↓ →
new
↓ →
new
↓ →
new
↓ →
new
↓ →
new

The idea

Read the chip’s hidden physical variation out of an ordinary circuit. PhasePrint extracts a low-level, physical property — the manufacturing variation that makes each chip’s delays unique — that the vendor tries to keep inaccessible, by turning timing behavior into a measurable signal. Coaxing secret, hardware-level information out of a chip by exploiting a physical side effect that ordinary operation exposes, rather than through a sanctioned interface, is the same move the work on exploiting power-domain separation to steal on-chip data (SRAM Has No Chill) covered elsewhere on this site makes, reaching the physical layer the abstraction is supposed to hide. PhasePrint’s lever is propagation delay surfaced through induced timing faults, turning a functional circuit into a delay sensor.

Aim the capability at the attack and defense that need to know the chip. The whole point of localization is that identifying a specific physical FPGA is what makes residual-data attacks and rotation defenses possible in the first place. The threat it directly serves — recovering confidential information a prior tenant left burned into a cloud FPGA’s silicon — is exactly the danger the work on data remanence in cloud FPGAs (Pentimento) covered elsewhere on this site demonstrates, where lingering physical state leaks across tenants. PhasePrint supplies the missing prerequisite for both sides: an attacker needs to know they are on the victim’s chip to harvest that remanence, and a defender needs to know which chip to rotate away from before burn-in accumulates.

Slip the measurement past the cloud vendor’s isolation and monitoring. PhasePrint works entirely on-chip with low power, uses only the sanctioned clock synthesizer, and keeps the circuit within design-time timing rules — so it evades the very security regime built to stop it. Operating within the tightly-controlled, monitored environment of a shared cloud FPGA while still achieving something the platform’s isolation is meant to prevent is the same tension the work on shielded enclaves for cloud FPGAs (SHEF) covered elsewhere on this site engages from the defensive side, wrestling with what security guarantees are possible on rented reconfigurable hardware. PhasePrint shows the offensive counterpart: a rule-compliant circuit that quietly defeats the anti-localization defenses.

Following a fingerprinting run through PhasePrint

Fingerprinting one rented cloud FPGA

A trace, drawn from the paper, of how PhasePrint identifies the physical chip behind a cloud instance.

Step 1 of 5

Load a valid launch-capture circuit onto the rented FPGA

PhasePrint deploys a functionally valid circuit whose logic sits between a launch register and a capture register, clocked by two phase-related clocks derived from the FPGA's internal synthesizer. It passes the vendor's design-rule and timing checks.

No ring oscillators, no forbidden primitives, no off-chip components.

Why it works

Manufacturing variation makes delay a natural fingerprint. Two chips of the same design are never physically identical → but their transistor and wire delays differ slightly → so the phase at which a path fails uniquely marks the chip.
Timing stress reads delay without a banned oscillator. Ring oscillators that sense delay are forbidden → but any circuit already encodes its delays in propagation time → so squeezing the clock gap measures delay from ordinary logic.
A valid, low-power, on-chip circuit evades the defenses. The vendor blocks malicious or high-power or off-chip methods → but PhasePrint stays within timing rules, uses the sanctioned synthesizer, and draws little power → so it slips past design-time and runtime monitoring.
Many sampled paths give a rich, robust signature. A single path could be noisy or ambiguous → but sampling many paths into a feature vector → so a classifier separates 300 chips with over 99 percent accuracy and tolerates voltage and temperature noise.
Fully on-chip extraction is fast and cheap. Prior methods needed off-chip DRAM and three sequential binaries → but one on-chip circuit reads the signature directly → so PhasePrint runs 13 times faster and costs 92 percent less.

What it costs (trade-offs and scope)

It is a dual-use capability. PhasePrint enables defenders to rotate away from over-exposed chips, but the same localization empowers attackers to target a victim’s specific FPGA for remanence or covert-channel attacks; the authors responsibly disclosed it to AWS Security.
It targets identification, not the downstream attack. PhasePrint tells you which physical chip you are on; actually exploiting residual data or a covert channel is a separate step, so its value is as an enabling primitive rather than a complete exploit.
It depends on the specific cloud environment. The method was built and validated on AWS FPGAs and their clock synthesizer, shell, and rules; other platforms differ, and vendors could change design-rule checks or monitoring in response.
Signatures must be enrolled. The classifier is trained on a database of known chips (300 here), so recognizing a specific device requires having previously fingerprinted it; it identifies within a known set rather than reading a universal serial number.
Reported figures are on a specific dataset. The over-99-percent accuracy, 13-times speedup, 92-percent cost reduction, and over-50-percent allocation overlap come from 300 FPGAs across four AWS regions under the paper’s conditions; results elsewhere may differ.

The comparison

Fingerprinting a specific cloud FPGA

Property	Ring-oscillator fingerprint	Off-chip DRAM PUF	PhasePrint
Allowed by cloud rules
Where it runs
What it senses
Speed and cost
Accuracy

A comparison of ways to fingerprint a specific cloud FPGA. Ring-oscillator fingerprints read manufacturing variation directly but are banned; off-chip DRAM PUFs comply but are slow and board-dependent. PhasePrint induces timing faults in an ordinary, valid circuit by sliding two clocks out of phase, reading each chip's unique delays entirely on-chip and within the vendor's rules — identifying one of 300 FPGAs with over 99 percent accuracy, 13 times faster and 92 percent cheaper than prior work. Exact figures should be read from the paper.Underlined values explain themselves when clicked.

Where this stops working

What to keep in mind

This explainer is based on the paper’s full text (the authors’ Virginia Tech VTechWorks copy). The described system is the paper’s: PhasePrint is a cloud FPGA localization method that induces dynamic timing faults in a functionally valid circuit and infers chip-specific delay characteristics from the resulting error pattern, without using information sources cloud vendors block. It uses the FPGA’s internal clock synthesizer to derive a launch and capture clock pair with a strict, adjustable phase relationship, and at runtime narrows the phase gap so signals fail to propagate in time, causing timing faults whose onset phase reflects manufacturing variation. A crafted circuit samples many logical paths; fault locations become feature vectors, and a support-vector-machine multi-class classifier identifies chips. Evaluated on 300 unique FPGAs across four AWS geographic regions (in the United States and Europe), the entirely on-chip method reports over 99 percent identification accuracy, 13 times faster operation, and 92 percent lower cost than the state of the art, plus robustness to voltage and temperature noise over 24-hour tests, and it observed over 50 percent overlap between consecutive FPGA allocations. The work was responsibly disclosed to AWS Security (February 2024) and open-sourced. Background on synchronous logic (launch and capture registers), manufacturing variation, ring-oscillator and DRAM-PUF fingerprinting, data remanence, and cloud FPGA security is standard context provided to make the approach intuitive. The step-by-step walkthrough is an illustration of the described mechanism. Exact circuit design, the phase-sweep and classification details, and the full evaluation should be read from the paper.

Background

Why shared physical hardware in the cloud keeps leaking through its analog layer

It helps to see PhasePrint within a broad pattern in cloud security: whenever physical hardware is shared among mutually distrusting tenants, the analog and physical layer beneath the clean digital abstraction tends to leak. The cloud sells the illusion that your instance is isolated and interchangeable, but the silicon is real, individual, and shared over time, and its physical properties — power draw, temperature, timing, residual charge, manufacturing quirks — carry information across the boundaries the abstraction promises. Attackers and defenders alike keep discovering that these physical channels defeat isolation that looks airtight at the logical level, and that identifying or co-locating with a specific piece of hardware is often the first step. FPGAs are an especially rich case because they hand tenants direct control of the fabric, but the phenomenon is general. This recurring lesson — that shared physical infrastructure in the public cloud leaks through side channels despite the isolation the platform advertises — is the same terrain the work showing last-level-cache side-channel attacks are feasible in the modern public cloud (LLC side channels) covered elsewhere on this site occupies, extracting cross-tenant information the abstraction was supposed to seal off. PhasePrint’s particular contribution is to show that even the physical identity of a rented chip, which vendors work hard to hide, can be read out cheaply and within the rules by turning an ordinary circuit into a delay sensor — a capability that reshapes both attacks and defenses on cloud FPGAs.

If you remember only three things

1. Cloud FPGAs are rented reconfigurable chips that give tenants deep hardware-level access, which enables physical-layer attacks like recovering a prior tenant's data through analog remanence or building covert channels through shared power. Every such attack, and its corresponding defense (rotating away from over-exposed chips before data burns in), depends on one primitive: identifying the specific physical FPGA you are on, called localization. Cloud vendors deliberately block localization — hiding low-level identifiers like eFuses, forcing a controlled shell and read-only images, banning ring oscillators via design-rule checks, and gating high-power circuits at runtime. Prior compliant fingerprinting was either forbidden (ring oscillators) or slow and off-chip (a DRAM-retention PUF needing three sequential binaries).
2. PhasePrint turns an ordinary, functionally valid circuit into a fingerprint sensor by inducing timing faults. Synchronous logic launches a signal on one clock edge and latches it on another; PhasePrint uses the FPGA's own clock synthesizer to make a launch and capture clock pair with an adjustable phase relationship, then at runtime slides the capture edge earlier until signals no longer have time to propagate and the circuit produces errors. The exact phase at which each path fails is chip-specific, because it reflects that path's propagation delay, which is set by the chip's unique manufacturing variation. A crafted circuit samples many paths, the fault locations become a feature vector, and a support-vector-machine classifier maps vectors to chips. Because the circuit is valid, low-power, and entirely on-chip using the sanctioned synthesizer, it slips past the vendor's design-time and runtime defenses.
3. On 300 unique FPGAs across four AWS regions, PhasePrint identifies a chip with over 99 percent accuracy, runs 13 times faster, and costs 92 percent less than the state of the art, staying robust to voltage and temperature noise over 24 hours — and it found that starting a new set of FPGAs shortly after terminating a previous one yields over 50 percent overlap, meaning you often get the same physical chips back. The trade-offs and scope: it is dual-use (aiding both attackers and defenders, and was responsibly disclosed to AWS), it provides identification rather than the downstream attack itself, it is tied to the specific cloud environment and its rules, and it identifies within an enrolled database rather than reading a universal serial number. This explainer is based on the paper's full text.

Check yourself

Check your understanding

1. Why does identifying a specific physical cloud FPGA (localization) matter, and why do vendors block it?
2. How does PhasePrint read a chip's manufacturing variation without a banned ring oscillator?
3. Why does PhasePrint evade the cloud vendor's security measures?
4. What does PhasePrint achieve, and what are the limits and implications?

Sources

The paper is “PhasePrint: Exposing Cloud FPGA Fingerprints by Inducing Timing Faults at Runtime” by Jubayer Mahmod and Matthew Hicks (Virginia Tech), published at ASPLOS 2025, DOI 10.1145/3676641.3716012. A full-text copy is available in Virginia Tech’s VTechWorks repository, and the implementation is open-sourced.

This explainer is written from the paper’s full text (the authors’ repository copy). PhasePrint localizes a specific cloud FPGA by inducing dynamic timing faults in a functionally valid circuit and inferring chip-specific delay from the error pattern, using the FPGA’s internal clock synthesizer to make a launch and capture clock pair whose phase gap is narrowed at runtime until signals fail to propagate. Fault locations across sampled paths become feature vectors for a support-vector-machine classifier. Evaluated on 300 FPGAs across four AWS regions, the paper reports over 99 percent accuracy, 13 times faster operation, and 92 percent lower cost than the state of the art, robustness to voltage and temperature noise, and over 50 percent overlap between consecutive allocations; it was responsibly disclosed to AWS Security. Background on synchronous logic, manufacturing variation, and cloud FPGA security is standard context. The numbers are the paper’s own; exact mechanisms and full results should be confirmed in the paper.