AI 中文总结
研究针对内存中行锤防御阈值随温度变化的问题，提出动态行锤阈值管理方法，通过线性-T模型和保护带调整各防御阈值，经实验验证能降低PRAC和SALT-C的突破次数，对TRR起诊断作用，且延迟较低。
AI 中文摘要
内存中行锤防御在制造时固定缓解阈值，但真正的行锤阈值（TRHD）会随运行时温度变化。我们提出了动态行锤阈值管理，这是一个与防御无关的运行时层，它通过带有VRD激励保护带g的线性-T模型，每轮从观测温度重新调整各防御的阈值，通过各防御的阈值参数将结果投影到SALT-C、PRAC和TRR上。一个解耦预言机按δ~N(1,σ)缩放每个DIMM的物理TRHD会破坏模型自一致性。该层将PRAC在85°C时的72次陈旧性突破降至零；在σ =0.10时，扫描g将PRAC突破从38.4（g =1.0）降至9.6（g =0.9）。SALT-C从10次名义静态突破降至2次（动态）再到0次（自举），延迟≤5.1%。TRR受容量限制，该层起诊断作用。
英文摘要
In-DRAM Rowhammer defenses pin the mitigation threshold at manufacture time, yet the true Rowhammer Threshold (TRHD) varies with runtime temperature. We propose Dynamic Rowhammer Threshold Management, a defense-agnostic runtime layer that re-sources each defense's threshold from the observed temperature once per epoch via a linear-$T$ model with a VRD-motivated guardband $g$, projecting the result onto SALT-C, PRAC, and TRR through each defense's threshold parameter. A decoupled oracle that scales physical TRHD per-DIMM by $δ\sim \mathrm{N}(1, σ)$ breaks model self-consistency. The layer drives PRAC's 72 staleness breaches at 85$^\circ$C to zero; at $σ{=}0.10$, sweeping $g$ collapses PRAC breaches from 38.4 ($g{=}1.0$) to 9.6 ($g{=}0.9$). SALT-C drops from 10 nominal-static breaches to 2 (Dynamic) to 0 (bootstrap), at $\leq$5.1\% latency. TRR is capacity-limited; the layer acts as a diagnostic.
CommentsPresented at the Sixth Workshop on DRAM Security (DRAMSec 2026), June 2026
