# Towards Reinforcement Learning for Exploration of Speculative Execution Vulnerabilities

arXiv: https://arxiv.org/abs/2502.16756 · HTML: https://mlsanity.com/paper/2502.16756/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in RL training of language and agent models, one of 15 directions in Deep reinforcement learning methods.
- Builds on 4 of its 14 references that are in the map.
- First posted on arXiv 24 Feb 2025.

## Placed in

- Deep reinforcement learning methods / [RL training of language and agent models](https://mlsanity.com/deeprl/rl-training-of-language-and-agent-models/)

## Builds on (most cited first, 4 of 4)

- [Spectre Attacks: Exploiting Speculative Execution](https://mlsanity.com/paper/1801.01203/) (2018)
- [AutoCAT: Reinforcement Learning for Automated Exploration of Cache-Timing Attacks](https://mlsanity.com/paper/2208.08025/) (2022)
- [Hardware-Software Contracts for Secure Speculation](https://mlsanity.com/paper/2006.03841/) (2020)
- [Revizor: Testing Black-box CPUs against Speculation Contracts](https://mlsanity.com/paper/2105.06872/) (2021)

## Abstract (arXiv)

Speculative attacks such as Spectre can leak secret information without being discovered by the operating system. Speculative execution vulnerabilities are finicky and deep in the sense that to exploit them, it requires intensive manual labor and intimate knowledge of the hardware. In this paper, we introduce SpecRL, a framework that utilizes reinforcement learning to find speculative execution leaks in post-silicon (black box) microprocessors.