Hardware-Software Leakage Contracts
Hardware-software leakage contracts are a formalism for specifying the side-channel security guarantees that a modern processor provides to software. They are intended to define what information a processor implementation is allowed to leak through microarchitectural behavior, thereby giving a basis for checking whether hardware conforms to an expected security contract.[1]
Purpose
Modern processors contain complex microarchitectural features that can create side channels. Hardware-software leakage contracts address this problem by making side-channel guarantees explicit: the contract specifies which observations are permitted and which constitute leakage. This makes the contract a target for verification or testing of a processor design.[1]
A key motivation is that side-channel vulnerabilities such as Spectre are not ordinary functional-correctness bugs. Conventional hardware fuzzing techniques are typically designed to find functional errors, and therefore may miss information leaks that arise from microarchitectural behavior.[2]
Verification challenge
Although formal verification can provide strong guarantees, checking that a complex processor complies with a leakage contract remains difficult. Existing verification approaches have been reported to struggle with scalability when applied to industrial-sized hardware designs.[1] This scalability issue motivates complementary approaches such as contract-aware fuzzing.
Contract-guided fuzzing
Recent work proposes coverage-guided hardware-software contract fuzzing as a scalable approach for finding leakage-contract violations before silicon fabrication.[1] The approach adapts fuzzing to the security-contract setting rather than treating the processor only as a functional device under test.
The method uses a self-compositional framework in which information leakage is made directly observable as divergence in microarchitectural state.[2] In this setup, two related executions can be compared; if their microarchitectural states diverge in a way disallowed by the contract, the divergence indicates a possible leakage violation.
Self-Composition Deviation
A central metric introduced for contract-guided fuzzing is Self-Composition Deviation, abbreviated SCD.[1] SCD is described as a security-oriented coverage metric that guides the fuzzer toward execution paths likely to violate the leakage contract.[2] Unlike conventional coverage metrics aimed at exploring functional behavior, SCD is intended to prioritize microarchitectural behaviors relevant to leakage.
Evaluation on open-source processors
The cited coverage-guided fuzzing approach was evaluated on two open-source RISC-V cores:[2]
- Rocket Core — an in-order RISC-V core.
- BOOM — a more complex out-of-order RISC-V core.
The evaluation found that coverage-guided strategies outperformed unguided fuzzing. It also reported that increasing microarchitectural coverage led to faster discovery of security vulnerabilities in the BOOM core.[2]
Significance
Hardware-software leakage contracts provide a way to state side-channel guarantees at the hardware-software boundary. Their practical value depends not only on specification, but also on the ability to check real processor designs against them. Contract-aware fuzzing, especially with metrics such as SCD, has been proposed as a scalable complement to formal verification for discovering leakage-contract violations in complex processors.[1][2]
References
[1]: Gideon Geier, Pariya Hajipour, and Jan Reineke, “Coverage-Guided Pre-Silicon Fuzzing of Open-Source Processors based on Leakage Contracts,” arXiv:2511.08443, 2025. Evidence: 8fe148e7-2b0d-4615-9fb4-308252bcc1b3.
[2]: Abstract and metadata for Geier, Hajipour, and Reineke, “Coverage-Guided Pre-Silicon Fuzzing of Open-Source Processors based on Leakage Contracts,” arXiv:2511.08443v2, DOI: 10.48550/arXiv.2511.08443. Evidence: b91069a9-8d84-49e9-ba71-d16188a1c511.