Security model for AI-generated programs

The CPU speculatively executes instructions ahead of branch resolution to improve performance. The attack uses a bounds-check guard as the target: by repeatedly calling with valid indices, the attacker trains the branch predictor to expect index < array.length to be true. Then passing an out-of-bounds index causes the CPU to speculatively execute the body — reading beyond the array into memory which should be inaccessible — before the check resolves and the branch is rolled back.

The CPU rolls back before the program ever sees the value. But before the speculative read, the attacker sets up a 256-page probe array. The speculative path uses the secret byte as an index into it:

if index < array.length:          # guard — attacker mistrains branch predictor to predict true
    secret = array[index]          # out-of-bounds, speculative — rolled back
    _ = probeArray[secret * 4096]  # encodes secret into which cache line is warmed

After rollback, secret is gone from any accessible variable. But one of the 256 probe pages is now in cache. The attacker times all 256 accesses — the fast one reveals the byte:

for i in 0..256:
    t0 = performance.now()
    _ = probeArray[i * 4096]
    t1 = performance.now()
    if t1 - t0 is fast: secret = i   # cache hit — this i is the secret byte

The value is never read directly — it is inferred entirely through which memory access is fast. This is the side channel.