Rowhammer attacks and DRAM side channel attacks require addresses that map to the same DRAM bank. Such addresses can be found using undocumented, reverse-engineered DRAM addressing functions. A recent large-scale Rowhammer study showed that existing reverse-engineering tools fail in about 50 % of real-world setups. These tools assume conventional setups with a power-of-two number of identical power-of-twosized DIMMs (PTID) but fail on asymmetric non-PTID setups.

In this paper, we discover that many non-PTID setups follow previously unknown conditional DRAM mappings, where different parts of memory obey different locally valid linear function sets. We present DREAMS, the first approach to recover DRAM bank addressing functions on non-PTID setups with such conditionally valid function sets. The key novelty is to model asymmetric mappings together with the conditions that select each function set, instead of assuming one globally valid linear function set. DREAMS detects bit-inconsistent behavior, i.e., cases where the influence of an address bit is not consistent across the address space, and uses this signal to infer whether the system is PTID or non-PTID. For non-PTID setups, DREAMS recovers the region- and channel-specific function sets and their selection conditions, and verifies the resulting conditional mapping entirely in software. For overlapping functions, DREAMS uses SAT constraints to model interactions between multiple candidate bits simultaneously, allowing the analytical recovery pipeline to handle functions that share bits. We evaluate DREAMS on 19 non-PTID DIMM configurations across 6 Intel and AMD DDR4/DDR5 systems, recovering mappings with up to 3 conditional function sets selected by address cutoffs and channel functions. We show that these reverse-engineered functions provide security-critical DRAM-bank information, e.g., for Rowhammer attacks, DRAM isolation mechanisms, and side-channel attacks. 

Tor is a privacy-enhancing technology that enables anonymous communication by leveraging onion routing. A client chooses a path of three Tor relays, known as a circuit, and encrypts the traffic for each relay in reverse order, sending it to the first relay. Each relay knows only its predecessor and successor, unaware of the entire circuit, thus enabling anonymous communication. Tor builds the circuit telescopically, i. e., the first relay establishes a TCP connection to the second, and the second establishes a TCP connection to the third. However, Tor allows cross-circuit interference (CCI), meaning that if two circuits share two consecutive relays, data transmitted over the same TCP connection interferes with each other.

In this paper, we demonstrate that CCI can be exploited as a side channel to conduct an off-path (non-MitM) website fingerprinting attack. An attacker builds a two-hop circuit between a shared link and measures the Round Trip Time (RTT), while the victim browses on the same link, visiting different websites. That creates a bottleneck, which reveals the website the victim was accessing. We conducted an open-world experiment and show that an attacker can distinguish between monitored and unmonitored websites, achieving an 𝐹1-score of 94.2 % in a single-class setup and 63.2 % in a multi-class setup, where we differentiate between all websites and unmonitored ones. Additionally, we conducted a closed-world experiment with different exit relays on the Tor network. We demonstrate that an attacker can achieve an 𝐹1-score of up to 66.7 % when distinguishing the top 95 websites using only 150 traces per website. We also show that the security settings in the Tor browser can be an effective countermeasure when set to safest, reducing the 𝐹1-score to 1.2 %, but making web surfing unusable. 

Although Vision Language Models (VLMs) have seen tremendous progress across all kinds of use cases, they still fall behind in answering questions regarding diagrams compared to photos. Although progress has been made in the area of bar charts, line charts and similar diagrams, there is still few research concerned with other types of diagrams, e.g. in the computer science domain. We identified a gap in research on visual question answering on UML class diagrams. Our objective is to fill the gap by analyzing the performance of popular open-weight VLMs on a self-constructed benchmark for visual question answering based on UML class diagrams which is both challenging and manageable. We further construct a large-scale training dataset with 16.000 image-question-an-swer triples based on real software repositories on GitHub. We focus on Java-based repositories and filter for project sizes that are small enough to fit on a single diagram with 4000x4000 pixels maximum in a readable manner. We ask questions based on 18 question templates. We show that a LoRA-based finetune of Qwen 2.5 VL 7B easily outperforms Qwen 3.5 27B, which is a recent and well-performing VLM in many other benchmarks.

Physical Unclonable Functions (PUFs) exploit inherent manufacturing variations in electronic devices to create unique hardware fingerprints, which are typically used as a source of randomness for generating device-specific cryptographic keys. In this work, however, we explore the possibility of repurposing PUFs as a secure storage mechanism for pre-existing keys. First, we evaluate existing RH-PUFs, introduce five novel RH-PUF constructions, and compare all of them with respect to their suitability for cryptographic key generation. Second, we propose DRAmGON, a novel, unconventional PUF-based approach that enables the direct encoding of cryptographic keys into Rowhammer-susceptible DRAM, thereby allowing persistent data storage in volatile memory. Our experiments using FlippyRAM show that 81 % of the tested systems exhibit Rowhammer susceptibility, establishing RH-PUFs as a viable hardware-based security primitive. 

This paper presents a numerical investigation and performance optimization of a large-scale, stratified thermal energy storage system integrated into a public research building. The system combines multiple renewable heat sources — including solar thermal collectors and a photovoltaic-powered power-to-heat unit — with various thermal heating loads. The methodology integrates both simultaneous and sequential building energy demand and generation modeling with transient CFD simulations in OpenFOAM® to analyze internal mixing and thermocline dynamics. A generally applicable performance evaluation is based on the internal temperature distribution, the temporal evolution of temperature gradients, Reynolds and Richardson number under various operating scenarios. Results confirm that carefully matched inlet temperatures and injection heights significantly enhance stratification stability. The best performance was observed during summer operation with reduced charging temperatures to better fit stratification levels while maintaining thermal power, and during winter with increased temperatures at reduced volumetric flow rates. These adjustments result in thermoclines up to 22% thinner during summer and up to 42% thinner during winter compared to sequential operation.

Background

Methods

Results

Conclusions

Der Beitrag untersucht die gegenwärtige Renaissance des politischen Denkens Carl Schmitts im Umfeld US-amerikanischer Technolibertarians und analysiert deren Bedeutung für das Staats- und Politikverständnis während der zweiten Amtszeit Donald Trumps. Ausgangspunkt ist die Beobachtung, dass zentrale schmittsche Konzepte insbesondere das Freund-Feind-Kriterium, der Dezisionismus sowie der Begriff des Ausnahmezustands im Silicon Valley nicht lediglich rezipiert, sondern aktiv in eine technologiegetriebene Gesellschafts- und Herrschaftstheorie übersetzt werden. Anhand zentraler Akteure und Diskursstränge (u. a. Neoreactionary Movement, Dark Enlightenment, Network-State-Konzepte) zeigt der Beitrag, wie Schmitts Kritik am Liberalismus mit technolibertären Vorstellungen von Effizienz, Exit-Strategien und privater Souveränität verschränkt wird. Der Souverän erscheint dabei nicht mehr als staatliche Institution, sondern als Gründer, CEO oder Code-basierte Exekutivinstanz, während demokratische Verfahren durch marktbasierte Leistungs- und Outputlegitimation ersetzt werden. Der Artikel argumentiert, dass diese Transformation nicht nur eine ideologische Verschiebung innerhalb der Tech-Eliten darstellt, sondern auf eine tiefgreifende Reartikulation des Politischen zielt, in der Demokratie als Hindernis und Technologie als Medium autoritärer Ordnung fungiert. Abschließend wird gezeigt, dass die technolibertäre Fortschreibung Schmittscher Motive zu einem postdemokratischen, plutokratischen Politikmodell führt, das mit klassischen demokratischen Legitimitätsvorstellungen fundamental bricht.

Remote latency side channels reveal sensitive information by only observing latency variations in the attacker’s traffic with the victim. While these attacks are easy to mount and scale, there is no practical defense. Considering the more powerful attacker-in-the-middle scenarios, available mitigations require the cooperation of all communication partners for protection, and cause prohibitive overheads.

In this paper, we propose AckwardDelay, a new unilateral, purely client-side, and lightweight defense against remote latency side channels. In detail, we piece-wise apply constant-time principles on the latency side channel and computationally show that a fully remote attacker requires more than 250 samples to reduce the initial search space to below 1% with our recommended parameters, even in a scenario favoring the attacker. Based on our proof-of-concept AckwardDelay implementation with less than 1000 lines of code on Linux, we demonstrate that the accuracy of website- and video-fingerprinting attacks is reduced to random guessing in practice. With an increase of only 5.55% on website-loading times and a reduction of only 0.51% in transfer rates, we conclude that AckwardDelay is a practical, lightweight, and effective mitigation applicable to the vast number of client systems such as smart phones, tablets, and laptops.

Während die Quantisierung von Modellgewichten zum Sparen von Speicherplatz Normalität ist, war das starke Verkleinern des KV-Cache bisher eher exotisch. Ein Beitrag von Google hat das Thema nun in den Mainstream gerückt.

At the HUMAN’25 workshop, four members of the hypertext research community reflected on the “hypertext as method” argument; specifically, the idea that hypertext should be understood as a method of inquiry rather than as merely a type of system. These community members presented position statements to address challenges stemming from this proposed method, including designing interfaces for LLMs, supporting annotation and note-taking as cognitive tools, evaluating AI as a collaborator in intellectual work, and applying hypertext analysis to historical information networks. These positions and the subsequent discussion contained several common themes, including a preference for augmentation over automation and concerns that generative AI may encourage users to disengage from critical thinking.

This paper addresses the challenge of real-time tool condition monitoring in tapping processes using machine learning techniques, with a focus on cross-material generalization and robust fault detection. The study leverages a historical dataset from 1998, comprising 2,195 tapping experiments on two steel alloys - 16 MnCr 5 and 42 CrMo 4 - monitoring torque (Mz) signals to predict binary quality outcomes (good/bad) based on defined quality criteria. To overcome limitations in prior work, the authors introduce a feature extraction method that captures both amplitude and duration characteristics across distinct phases of the torque signal,. The evaluation framework includes increasingly challenging train/test splits: random, run-wise holdout, and cross-material (training on 16 MnCr 5, testing on 42 CrMo 4), enabling assessment of real-world generalizability.

Multiple machine learning models are tested using both raw time-series data (after cleaning and normalization) and engineered features. Results show Matthews Correlation Coefficients (MCC) of 0.40 - 0.41 under cross-material testing-indicating moderate but meaningful generalization across materials with different mechanical properties. This performance level suggests that fundamental physical regularities in successful tapping produce consistent torque signatures, enabling transferable detection of anomalies without retraining. Findings support the feasibility of plug-and-play monitoring systems in agile manufacturing environments, where minimal setup and broad applicability are essential.

Download-Link: Revisiting 1998 Torque Data: A Machine Learning Analysis of Time Series Data for Tapping Experiments