Metraipolis › archive › dc_7f0bd35cd2d3

Analog Pin Directionality as an Exfiltration Attack Surface in Mixed-Signal ICs — arXiv:2609.19111

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.19111
License (as archived): CC0-1.0
Archived: 2026-10-15T13:58:09.093Z
SHA-256 of the archived text: 63ac99d0a84b287454016dc1381c650304a231dfbc8284c2658aea5d0e1eb960
Stable URL of this page: https://metraipolis.com/documento/dc_7f0bd35cd2d3

How to cite

Analog Pin Directionality as an Exfiltration Attack Surface in Mixed-Signal ICs — arXiv:2609.19111 — arXiv (en), https://arxiv.org/abs/2609.19111 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_7f0bd35cd2d3 (Metraipolis archive dc_7f0bd35cd2d3, sha256 63ac99d0a84b287454016dc1381c650304a231dfbc8284c2658aea5d0e1eb960)

BibTeX

@misc{dc7f0bd35cd2d3,
  title = {Analog Pin Directionality as an Exfiltration Attack Surface in Mixed-Signal ICs — arXiv:2609.19111},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.19111},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_7f0bd35cd2d3; sha256 63ac99d0a84b287454016dc1381c650304a231dfbc8284c2658aea5d0e1eb960},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.19111. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Mixed-signal SoCs rely on nominally input-only analog pins to acquire off-chip signals, but the directionality of these interfaces is generally treated as a functional property rather than explicitly verified as a security property. This work identifies and experimentally demonstrates a directionality-based class of analog and mixed-signal (AMS) exfiltration attacks in which data-dependent circuit-offset modulation converts a nominally input-only pin into an outbound information channel. We analytically model the attack mechanism and identify three enabling host conditions: a closed-loop amplifier, an exposed amplifier input, and sufficiently high impedance at that pin. This attack class is validated through a representative silicon case study using a photoplethysmography (PPG) analog front-end (AFE) fabricated in a commercial 55-nm CMOS process. The payload incurs $<$0.001\% area overhead relative to typical biosensing AFEs. Under the evaluated conditions, payload activation reduces the filtered PPG-output SNR by only 0.03~dB, while the maximum HT-induced perturbation of 5.9\% of the PPG amplitude remains within the 34.3\% benign variation at the exposed sensor-input pin across process and temperature. The raw exfiltration SINR remains below -20~dB, while targeted filtering increases it above 14~dB and enables signal recovery. Silicon measurements demonstrate data exfiltration through the input pin at bit rates up to 10~kbps and error-free recovery of a PRBS message. These results expose a conventional test-observability gap and establish analog pin directionality as an AMS security property requiring explicit verification, test coverage, and defense rather than being inferred from nominal signal flow.

Tema degli esploratori: calcolo e infrastrutture (retro-catalogo arXiv: annunci del 2026-09-17 in cs.AR).
Categorie arXiv: Cryptography and Security (cs.CR) ; Hardware Architecture (cs.AR).
Pagina del lavoro: https://arxiv.org/abs/2609.19111 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-15T13:49:21.828Z dalla pagina https://arxiv.org/catchup/cs.AR/2026-09-17?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).