{
  "schema_version": 1,
  "builder_plan": {
    "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.",
    "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.",
    "baseline": "Your existing checks with the same tasks, permissions, and tool responses.",
    "steps": [
      "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.",
      "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.",
      "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.",
      "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test."
    ],
    "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.",
    "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation."
  },
  "builder_review": null,
  "arxiv_id": "2610.30798",
  "title": "Amplifying Latency and Cost of LLM Inference via Rowhammer Attack",
  "summary": "LLVMhammer replaces nothing in the reader's stack; it is an attack that flips a DRAM bit in Triton's target-independent compilation pipeline so the compiler emits a functionally identical but slower GPU kernel, which then persists via Triton's on-disk kernel cache. There is no adoption cost because it is not a capability; the relevant defensive cost is operational: ECC memory, integrity checks or cache invalidation for compiled kernels, and restricting untrusted code co-residency on inference hosts. The attack itself can fail against ECC-equipped hardware, and defenses can fail if kernel caches are trusted blindly or if third-party API infrastructure (outside the reader's control) is the actual exposure point.",
  "rationale": "The reader cannot use this offensively and its practical relevance is limited to hardening self-hosted inference, so awareness plus low-cost mitigations (ECC, kernel-cache verification) is the appropriate posture rather than adoption or testing.",
  "technique": "Rowhammer bit-flip attack on Triton JIT compilation",
  "family": "seguranca_e_guardrails",
  "recommendation": "observar",
  "published": "2026-10-22",
  "as_of": "2026-10-23",
  "editorial_status": "indexed",
  "source_url": "https://arxiv.org/abs/2610.30798",
  "independent_implementations": 0,
  "total_implementations": 1,
  "stars": 0,
  "citations": null,
  "claims": [
    {
      "claim_id": "claim-01",
      "statement": "LLVMhammer replaces nothing in the reader's stack; it is an attack that flips a DRAM bit in Triton's target-independent compilation pipeline so the compiler emits a functionally identical but slower GPU kernel, which then persists via Triton's on-disk kernel cache. There is no adoption cost because it is not a capability; the relevant defensive cost is operational: ECC memory, integrity checks or cache invalidation for compiled kernels, and restricting untrusted code co-residency on inference hosts. The attack itself can fail against ECC-equipped hardware, and defenses can fail if kernel caches are trusted blindly or if third-party API infrastructure (outside the reader's control) is the actual exposure point.",
      "basis": "inferred",
      "result": "",
      "baseline": "",
      "conditions": "",
      "source_url": "https://arxiv.org/abs/2610.30798",
      "source_page": null,
      "source_excerpt": ""
    }
  ],
  "exposure_map": [
    {
      "dimension": "quality",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "compute",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "latency",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "operations",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "compatibility",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "security",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "data_and_training",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "reproducibility",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    }
  ],
  "risks": [],
  "minimum_test": [],
  "open_questions": [],
  "independent_tests": [],
  "lab_reproductions": [],
  "report_available": false,
  "validation_tier": "unknown",
  "evidence_tier": "unknown",
  "infrastructure_basis": "unknown",
  "equations": [],
  "equations_status": "not_fetched",
  "core_kind": "",
  "equations_fetched_at": "",
  "equations_source_url": "",
  "equations_source_sha256": "",
  "exposures_reviewed_at": "",
  "exposures_source_sha256": ""
}