{"id":"https://openalex.org/W7204555532","doi":"https://doi.org/10.48550/arxiv.2608.26402","title":"SILK: Closing the Time-of-Check-to-Time-of-Use Gap in RoT-Protected AI Systems","display_name":"SILK: Closing the Time-of-Check-to-Time-of-Use Gap in RoT-Protected AI Systems","publication_year":2026,"publication_date":"2026-08-26","ids":{"openalex":"https://openalex.org/W7204555532","doi":"https://doi.org/10.48550/arxiv.2608.26402"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2608.26402","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.26402","pdf_url":"https://arxiv.org/pdf/2608.26402","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2608.26402","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5136489711","display_name":"Ruichen Qi","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I27804330","display_name":"Brown University","ror":"https://ror.org/05gq02987","country_code":"US","type":"education","lineage":["https://openalex.org/I27804330"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Qi, Ruichen","raw_affiliation_strings":["Brown University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Brown University","institution_ids":["https://openalex.org/I27804330"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135385728","display_name":"Xinting Jiang","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I27804330","display_name":"Brown University","ror":"https://ror.org/05gq02987","country_code":"US","type":"education","lineage":["https://openalex.org/I27804330"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jiang, Xinting","raw_affiliation_strings":["Brown University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Brown University","institution_ids":["https://openalex.org/I27804330"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5148570049","display_name":"Ema Dimitrova","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I27804330","display_name":"Brown University","ror":"https://ror.org/05gq02987","country_code":"US","type":"education","lineage":["https://openalex.org/I27804330"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Dimitrova, Ema","raw_affiliation_strings":["Brown University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Brown University","institution_ids":["https://openalex.org/I27804330"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136187796","display_name":"Junyi Luo","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I27804330","display_name":"Brown University","ror":"https://ror.org/05gq02987","country_code":"US","type":"education","lineage":["https://openalex.org/I27804330"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Luo, Junyi","raw_affiliation_strings":["Brown University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Brown University","institution_ids":["https://openalex.org/I27804330"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5046207386","display_name":"Quan Cheng","orcid":"https://orcid.org/0000-0001-5519-3258","observed_orcids":["https://orcid.org/0000-0001-5519-3258"]},"institutions":[{"id":"https://openalex.org/I27804330","display_name":"Brown University","ror":"https://ror.org/05gq02987","country_code":"US","type":"education","lineage":["https://openalex.org/I27804330"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Cheng, Quan","raw_affiliation_strings":["Brown University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Brown University","institution_ids":["https://openalex.org/I27804330"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5007702824","display_name":"Mehdi Saligane","orcid":"https://orcid.org/0000-0003-0237-4690","observed_orcids":["https://orcid.org/0000-0003-0237-4690"]},"institutions":[{"id":"https://openalex.org/I27804330","display_name":"Brown University","ror":"https://ror.org/05gq02987","country_code":"US","type":"education","lineage":["https://openalex.org/I27804330"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Saligane, Mehdi","raw_affiliation_strings":["Brown University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Brown University","institution_ids":["https://openalex.org/I27804330"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I27804330"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9409000277519226,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9409000277519226,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12122","display_name":"Physical Unclonable Functions (PUFs) and Hardware Security","score":0.045499999076128006,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10951","display_name":"Cryptographic Implementations and Security","score":0.008899999782443047,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/root-of-trust","display_name":"root of trust","score":0.8579999804496765},{"id":"https://openalex.org/keywords/model-integrity-verification","display_name":"model integrity verification","score":0.6259999871253967},{"id":"https://openalex.org/keywords/hardware-security","display_name":"hardware security","score":0.5509999990463257},{"id":"https://openalex.org/keywords/xilinx-zcu102","display_name":"Xilinx ZCU102","score":0.7250000238418579}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7422999739646912},{"id":"https://openalex.org/C48105269","wikidata":"https://www.wikidata.org/wiki/Q1141160","display_name":"Header","level":2,"score":0.5526000261306763},{"id":"https://openalex.org/C2777735758","wikidata":"https://www.wikidata.org/wiki/Q817765","display_name":"Path (computing)","level":2,"score":0.5174000263214111},{"id":"https://openalex.org/C148417208","wikidata":"https://www.wikidata.org/wiki/Q4825882","display_name":"Authentication (law)","level":2,"score":0.5006999969482422},{"id":"https://openalex.org/C153180980","wikidata":"https://www.wikidata.org/wiki/Q19776675","display_name":"Commit","level":2,"score":0.47269999980926514},{"id":"https://openalex.org/C14036430","wikidata":"https://www.wikidata.org/wiki/Q3736076","display_name":"Function (biology)","level":2,"score":0.42309999465942383},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.38760000467300415},{"id":"https://openalex.org/C2778112365","wikidata":"https://www.wikidata.org/wiki/Q3511065","display_name":"Sequence (biology)","level":2,"score":0.3571999967098236},{"id":"https://openalex.org/C42935608","wikidata":"https://www.wikidata.org/wiki/Q190411","display_name":"Field-programmable gate array","level":2,"score":0.35670000314712524},{"id":"https://openalex.org/C108759981","wikidata":"https://www.wikidata.org/wiki/Q788590","display_name":"Authorization","level":2,"score":0.3546999990940094},{"id":"https://openalex.org/C176809094","wikidata":"https://www.wikidata.org/wiki/Q15401496","display_name":"Traverse","level":2,"score":0.3450999855995178},{"id":"https://openalex.org/C2778775528","wikidata":"https://www.wikidata.org/wiki/Q5135432","display_name":"Closing (real estate)","level":2,"score":0.34119999408721924},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.3366999924182892},{"id":"https://openalex.org/C33762810","wikidata":"https://www.wikidata.org/wiki/Q461671","display_name":"Data integrity","level":2,"score":0.32690000534057617},{"id":"https://openalex.org/C141492731","wikidata":"https://www.wikidata.org/wiki/Q1052621","display_name":"Message authentication code","level":3,"score":0.3221000134944916},{"id":"https://openalex.org/C197096303","wikidata":"https://www.wikidata.org/wiki/Q869887","display_name":"Probability mass function","level":3,"score":0.3174999952316284},{"id":"https://openalex.org/C199185054","wikidata":"https://www.wikidata.org/wiki/Q552299","display_name":"Chain (unit)","level":2,"score":0.3158000111579895},{"id":"https://openalex.org/C160633673","wikidata":"https://www.wikidata.org/wiki/Q355198","display_name":"Pixel","level":2,"score":0.30809998512268066},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.3070000112056732},{"id":"https://openalex.org/C113954288","wikidata":"https://www.wikidata.org/wiki/Q186885","display_name":"Timestamp","level":2,"score":0.29350000619888306},{"id":"https://openalex.org/C167927819","wikidata":"https://www.wikidata.org/wiki/Q1930567","display_name":"Shuffling","level":2,"score":0.29339998960494995},{"id":"https://openalex.org/C61797465","wikidata":"https://www.wikidata.org/wiki/Q1188986","display_name":"Term (time)","level":2,"score":0.27869999408721924},{"id":"https://openalex.org/C160403385","wikidata":"https://www.wikidata.org/wiki/Q220543","display_name":"Queue","level":2,"score":0.27639999985694885},{"id":"https://openalex.org/C187455244","wikidata":"https://www.wikidata.org/wiki/Q942353","display_name":"Boolean function","level":2,"score":0.2759999930858612},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.2745000123977661},{"id":"https://openalex.org/C9390403","wikidata":"https://www.wikidata.org/wiki/Q3966","display_name":"Computer hardware","level":1,"score":0.2736000120639801},{"id":"https://openalex.org/C48145219","wikidata":"https://www.wikidata.org/wiki/Q1335365","display_name":"Security token","level":2,"score":0.27129998803138733},{"id":"https://openalex.org/C157764524","wikidata":"https://www.wikidata.org/wiki/Q1383412","display_name":"Throughput","level":3,"score":0.2703000009059906},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.26260000467300415},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.2619999945163727},{"id":"https://openalex.org/C108087509","wikidata":"https://www.wikidata.org/wiki/Q1207171","display_name":"ATM card","level":3,"score":0.26170000433921814},{"id":"https://openalex.org/C2776330181","wikidata":"https://www.wikidata.org/wiki/Q18358244","display_name":"Maximization","level":2,"score":0.2535000145435333},{"id":"https://openalex.org/C77553402","wikidata":"https://www.wikidata.org/wiki/Q13222579","display_name":"Upper and lower bounds","level":2,"score":0.25189998745918274}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2608.26402","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.26402","pdf_url":"https://arxiv.org/pdf/2608.26402","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2608.26402","doi":"https://doi.org/10.48550/arxiv.2608.26402","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2608.26402","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2608.26402","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.26402","pdf_url":"https://arxiv.org/pdf/2608.26402","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7204555532.pdf","grobid_xml":"https://content.openalex.org/works/W7204555532.grobid-xml"},"referenced_works_count":1,"referenced_works":["https://openalex.org/W4387042817"],"related_works":["https://openalex.org/W7163529103","https://openalex.org/W4313645430","https://openalex.org/W4212968594","https://openalex.org/W2886677293","https://openalex.org/W4412082534","https://openalex.org/W4409737888","https://openalex.org/W3093385444","https://openalex.org/W7220840435","https://openalex.org/W4384948590","https://openalex.org/W7117078628"],"abstract_inverted_index":{"Root-of-trust":[0],"(RoT)":[1],"authentication":[2,103],"verifies":[3,63],"a":[4,46,87,117,177,185,205,210,213],"DNN":[5],"model":[6,42],"at":[7,67,159,196,224],"load":[8],"time,":[9],"but":[10],"weights":[11,35,112],"may":[12],"subsequently":[13],"traverse":[14],"DRAM,":[15],"DMA,":[16],"interconnect,":[17],"and":[18,80,105,133,166,174],"prefetch":[19],"paths":[20],"before":[21],"reaching":[22,114],"the":[23,34,40,64,68,122,128,139,188,200,227],"compute":[24],"engine.":[25],"Post-verification":[26],"tampering":[27],"along":[28],"this":[29],"path":[30],"can":[31],"therefore":[32],"alter":[33],"actually":[36],"consumed":[37],"while":[38,172,209],"leaving":[39],"authenticated":[41],"image":[43],"unchanged,":[44],"creating":[45],"time-of-check-to-time-of-use":[47],"(TOCTOU)":[48],"integrity":[49,60,78,92],"gap.":[50],"We":[51],"present":[52],"SILK":[53,72,142],"(Streaming":[54],"Inline":[55],"Lightweight":[56],"Keying),":[57],"an":[58],"in-place":[59],"mechanism":[61],"that":[62],"weight":[65,84],"stream":[66],"final":[69],"pre-compute":[70],"boundary.":[71],"repurposes":[73],"quantized-weight":[74],"LSBs":[75],"as":[76],"secret-keyed":[77],"bits":[79],"chains":[81],"dependencies":[82],"across":[83,163,169],"bytes,":[85],"so":[86],"local":[88],"modification":[89],"perturbs":[90],"multiple":[91],"checks.":[93],"A":[94],"lightweight":[95],"streaming":[96],"checker":[97],"recomputes":[98],"these":[99],"checks":[100],"without":[101],"separate":[102],"tags":[104],"uses":[106],"commit":[107],"gating":[108],"to":[109,158],"prevent":[110],"unverified":[111],"from":[113],"computation.":[115],"Under":[116],"secure":[118],"pseudorandom":[119],"function":[120],"(PRF),":[121],"forgery":[123,216],"probability":[124],"decreases":[125],"exponentially":[126],"with":[127,212],"number":[129],"of":[130,199,204,218,226],"affected":[131],"checks,":[132],"measured":[134],"miss":[135],"rates":[136],"closely":[137],"track":[138],"analytical":[140],"bound.":[141],"detects":[143],"every":[144],"stream-modifying":[145],"instance":[146],"in":[147],"our":[148],"functional":[149],"attack":[150],"suite.":[151],"For":[152],"INT8,":[153],"it":[154],"limits":[155],"quality":[156],"loss":[157],"most":[160],"0.76":[161],"pp":[162],"evaluated":[164],"CNNs":[165],"0.17":[167],"perplexity":[168],"eight":[170],"LLMs,":[171],"INT4":[173],"MXFP4":[175],"provide":[176],"configurable":[178],"security-quality":[179],"tradeoff":[180],"through":[181],"check":[182],"sparsity.":[183],"On":[184],"Xilinx":[186],"ZCU102,":[187],"synthesized":[189],"reference":[190],"pipelined":[191],"implementation":[192],"sustains":[193,221],"756":[194],"MB/s":[195,223],"only":[197],"1.00%":[198],"equivalent":[201],"area":[202],"cost":[203],"Caliptra":[206],"2.x":[207],"RoT,":[208],"configuration":[211],"conservative":[214],"per-attempt":[215],"bound":[217],"2^-128":[219],"still":[220],"678":[222],"6.15%":[225],"RoT":[228],"cost.":[229]},"counts_by_year":[],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2026-08-29T00:00:00"}