# Spectre Attacks: Exploiting Speculative Execution

arXiv: https://arxiv.org/abs/1801.01203 · HTML: https://mlsanity.com/paper/1801.01203/

## Key facts

- Cited by 47 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 3 Jan 2018.

## Built on by (most cited first, 30 of 47)

- [WaveFake: A Data Set to Facilitate Audio Deepfake Detection](https://mlsanity.com/paper/2111.02813/) (2021)
- [On the Societal Impact of Open Foundation Models](https://mlsanity.com/paper/2403.07918/) (2024)
- [Unleashing the Power of Continual Learning on Non-Centralized Devices: A Survey](https://mlsanity.com/paper/2412.13840/) (2024)
- [No Privacy Left Outside: On the (In-)Security of TEE-Shielded DNN Partition for On-Device ML](https://mlsanity.com/paper/2310.07152/) (2023)
- [LLMs and the Future of Chip Design: Unveiling Security Risks and Building Trust](https://mlsanity.com/paper/2405.07061/) (2024)
- [Auditing Prompt Caching in Language Model APIs](https://mlsanity.com/paper/2502.07776/) (2025)
- [Selective KV-Cache Sharing to Mitigate Timing Side-Channels in LLM Inference](https://mlsanity.com/paper/2508.08438/) (2025)
- [Interactive Speculative Planning: Enhance Agent Efficiency through Co-design of System and User Interface](https://mlsanity.com/paper/2410.00079/) (2024)
- [Secure Aggregation for Federated Learning in Flower](https://mlsanity.com/paper/2205.06117/) (2022)
- [secureTF: A Secure TensorFlow Framework](https://mlsanity.com/paper/2101.08204/) (2021)
- [Dynamic Speculative Agent Planning](https://mlsanity.com/paper/2509.01920/) (2025)
- [HW-V2W-Map: Hardware Vulnerability to Weakness Mapping Framework for Root Cause Analysis with GPT-assisted Mitigation Suggestion](https://mlsanity.com/paper/2312.13530/) (2023)
- [When Speculation Spills Secrets: Side Channels via Speculative Decoding In LLMs](https://mlsanity.com/paper/2411.01076/) (2024)
- [ZeroLeak: Using LLMs for Scalable and Cost Effective Side-Channel Patching](https://mlsanity.com/paper/2308.13062/) (2023)
- [Towards Automated Classification of Attackers' TTPs by combining NLP with ML Techniques](https://mlsanity.com/paper/2207.08478/) (2022)
- [Reward Delay Attacks on Deep Reinforcement Learning](https://mlsanity.com/paper/2209.03540/) (2022)
- [SHARKS: Smart Hacking Approaches for RisK Scanning in Internet-of-Things and Cyber-Physical Systems based on Machine Learning](https://mlsanity.com/paper/2101.02780/) (2021)
- [VET Your Agent: Towards Host-Independent Autonomy via Verifiable Execution Traces](https://mlsanity.com/paper/2512.15892/) (2025)
- [AgenticCache: Cache-Driven Asynchronous Planning for Embodied AI Agents](https://mlsanity.com/paper/2604.24039/) (2026)
- [Edge Security: Challenges and Issues](https://mlsanity.com/paper/2206.07164/) (2022)
- [TEESlice: Protecting Sensitive Neural Network Models in Trusted Execution Environments When Attackers have Pre-Trained Models](https://mlsanity.com/paper/2411.09945/) (2024)
- [Towards Secure MLOps: Surveying Attacks, Mitigation Strategies, and Research Challenges](https://mlsanity.com/paper/2506.02032/) (2025)
- [Measuring and Exploiting Contextual Bias in LLM-Assisted Security Code Review](https://mlsanity.com/paper/2603.18740/) (2026)
- [Perun: Secure Multi-Stakeholder Machine Learning Framework with GPU Support](https://mlsanity.com/paper/2103.16898/) (2021)
- [SecFSM: Knowledge Graph-Guided Verilog Code Generation for Secure Finite State Machines in Systems-on-Chip](https://mlsanity.com/paper/2508.12910/) (2025)
- [From Firewalls to Frontiers: AI Red-Teaming is a Domain-Specific Evolution of Cyber Red-Teaming](https://mlsanity.com/paper/2509.11398/) (2025)
- [A Survey and Perspective on Artificial Intelligence for Security-Aware Electronic Design Automation](https://mlsanity.com/paper/2204.09579/) (2022)
- [Short Paper: Static and Microarchitectural ML-Based Approaches For Detecting Spectre Vulnerabilities and Attacks](https://mlsanity.com/paper/2210.14452/) (2022)
- [Props for Machine-Learning Security](https://mlsanity.com/paper/2410.20522/) (2024)
- [Differentially Private Learned Indexes](https://mlsanity.com/paper/2410.21164/) (2024)

## Abstract (arXiv)

Modern processors use branch prediction and speculative execution to maximize performance. For example, if the destination of a branch depends on a memory value that is in the process of being read, CPUs will try guess the destination and attempt to execute ahead. When the memory value finally arrives, the CPU either discards or commits the speculative computation. Speculative logic is unfaithful in how it executes, can access to the victim's memory and registers, and can perform operations with measurable side effects. Spectre attacks involve inducing a victim to speculatively perform operations that would not occur during correct program execution and which leak the victim's confidential information via a side channel to the adversary. This paper describes practical attacks that combine methodology from side channel attacks, fault attacks, and return-oriented programming that can read arbitrary memory from the victim's process. More broadly, the paper shows that speculative execution implementations violate the security assumptions underpinning numerous software security mechanisms, including operating system process separation, static analysis, containerization, just-in-time (JIT) compilation, and countermeasures to cache timing/side-channel attacks. These attacks represent a serious threat to actual systems, since vulnerable speculative execution capabilities are found in microprocessors from Intel, AMD, and ARM that are used in billions of devices. While makeshift processor-specific countermeasures are possible in some cases, sound solutions will require fixes to processor designs as well as updates to instruction set architectures (ISAs) to give hardware architects and software developers a common understanding as to what computation state CPU implementations are (and are not) permitted to leak.