Melanie Götz

• Sibai: A Few-Shot Meta-Classifier for Poisoning Detection in Federated Learning. Götz, Melanie; Krauß, Torsten; Dmitrienko, Alexandra; in to appear in International Conference on Computer Vision, ICCV 2025 (2025).
  • [ BibTeX ]
  • [ Download ]
  • [ BibSonomy-Post ]
  @article{gotz2025sibai, author = {Götz, Melanie and Krauß, Torsten and Dmitrienko, Alexandra}, journal = {to appear in International Conference on Computer Vision, ICCV 2025}, keywords = {sssgroup}, title = {Sibai: A Few-Shot Meta-Classifier for Poisoning Detection in Federated Learning}, year = 2025 }
• RLFuzz: Accelerating Hardware Fuzzing with Deep Reinforcement Learning. Götz, Raphael; Sendner, Christoph; Ruck, Nico; Rostami, Mohamadreza; Dmitrienko, Alexandra; Sadeghi, Ahmad-Reza; in IEEE HOST (2025 IEEE International Symposium on Hardware Oriented Security and Trust (HOST)) (2025).
  • [ Abstract ]
  • [ BibTeX ]
  • [ Download ]
  • [ BibSonomy-Post ]
  Once hardware is manufactured, it becomes immutable, and any design flaws or vulnerabilities are permanent. Therefore, comprehensive testing of hardware designs is essential before production. However, the increasing complexity of modern processors makes static analysis and formal verification increasingly challenging. Fuzzing is a highly effective technique for detecting software vulnerabilities but adapting it to hardware presents unique challenges due to the fundamental differences between software and hardware. However, the current state-of-the-art in hardware fuzzing still has significant limitations, particularly in terms of performance, practicality, and the need for human intervention. To address these issues, we introduce RLFuzz, a novel hardware fuzzer that employs reinforcement learning to explore processors autonomously, achieving faster and more comprehensive coverage. Reinforcement learning enables the fuzzer to learn from its interactions with the processor without requiring labeled data, allowing it to more effectively select modifications for test cases and target previously unexplored areas. RLFuzz uses an asynchronous training mechanism that permits concurrent fuzzing and neural network training. To optimize RLFuzz, we performed an extensive evaluation of various deep Q-learning optimization techniques and hyper-parameters. We then tested the optimized fuzzer on three complex RISC-V cores-the Rocket core, CVA6, and BOOM-and compared its performance to a current hardware fuzzer, TheHuzz [20]. Our results show that RLFuzz achieved up to 1.77% higher coverage, and on average 2.35 times faster, and demonstrated a maximum speedup of up to 6.93 times. For branch coverage, the average speedup was 7.85 times, with a peak speedup of 92.98 times. Additionally, RLFuzz needed less time to complete 100,000 test cases and did not require any human intervention.

  @article{noauthororeditorrlfuzz, abstract = {Once hardware is manufactured, it becomes immutable, and any design flaws or vulnerabilities are permanent. Therefore, comprehensive testing of hardware designs is essential before production. However, the increasing complexity of modern processors makes static analysis and formal verification increasingly challenging. Fuzzing is a highly effective technique for detecting software vulnerabilities but adapting it to hardware presents unique challenges due to the fundamental differences between software and hardware. However, the current state-of-the-art in hardware fuzzing still has significant limitations, particularly in terms of performance, practicality, and the need for human intervention. To address these issues, we introduce RLFuzz, a novel hardware fuzzer that employs reinforcement learning to explore processors autonomously, achieving faster and more comprehensive coverage. Reinforcement learning enables the fuzzer to learn from its interactions with the processor without requiring labeled data, allowing it to more effectively select modifications for test cases and target previously unexplored areas. RLFuzz uses an asynchronous training mechanism that permits concurrent fuzzing and neural network training. To optimize RLFuzz, we performed an extensive evaluation of various deep Q-learning optimization techniques and hyper-parameters. We then tested the optimized fuzzer on three complex RISC-V cores-the Rocket core, CVA6, and BOOM-and compared its performance to a current hardware fuzzer, TheHuzz [20]. Our results show that RLFuzz achieved up to 1.77% higher coverage, and on average 2.35 times faster, and demonstrated a maximum speedup of up to 6.93 times. For branch coverage, the average speedup was 7.85 times, with a peak speedup of 92.98 times. Additionally, RLFuzz needed less time to complete 100,000 test cases and did not require any human intervention.}, author = {Götz, Raphael and Sendner, Christoph and Ruck, Nico and Rostami, Mohamadreza and Dmitrienko, Alexandra and Sadeghi, Ahmad-Reza}, journal = {IEEE HOST (2025 IEEE International Symposium on Hardware Oriented Security and Trust (HOST))}, keywords = {sssgroup}, title = {RLFuzz: Accelerating Hardware Fuzzing with Deep Reinforcement Learning}, year = 2025 }

• GNN-Based Code Annotation Logic for Establishing Security Boundaries in C Code. Gadey, Varun; Goetz, Raphael; Sendner, Christoph; Sovio, Sampo; Dmitrienko, Alexandra; in ArXiv | arXiv:2411.11567 (2024).
  • [ Abstract ]
  • [ BibTeX ]
  • [ URL ]
  • [ BibSonomy-Post ]
  Securing sensitive operations in today's interconnected software landscape is crucial yet challenging. Modern platforms rely on Trusted Execution Environments (TEEs), such as Intel SGX and ARM TrustZone, to isolate security sensitive code from the main system, reducing the Trusted Computing Base (TCB) and providing stronger assurances. However, identifying which code should reside in TEEs is complex and requires specialized expertise, which is not supported by current automated tools. Existing solutions often migrate entire applications to TEEs, leading to suboptimal use and an increased TCB. To address this gap, we propose Code Annotation Logic (CAL), a pioneering tool that automatically identifies security sensitive components for TEE isolation. CAL analyzes codebases, leveraging a graph-based approach with novel feature construction and employing a custom graph neural network model to accurately determine which parts of the code should be isolated. CAL effectively optimizes TCB, reducing the burden of manual analysis and enhancing overall security. Our contributions include the definition of security sensitive code, the construction and labeling of a comprehensive dataset of source files, a feature rich graph based data preparation pipeline, and the CAL model for TEE integration. Evaluation results demonstrate CAL's efficacy in identifying sensitive code with a recall of 86.05%, an F1 score of 81.56%, and an identification rate of 91.59% for security sensitive functions. By enabling efficient code isolation, CAL advances the secure development of applications using TEEs, offering a practical solution for developers to reduce attack vectors.

  @article{gadey2024gnnbased, abstract = {Securing sensitive operations in today's interconnected software landscape is crucial yet challenging. Modern platforms rely on Trusted Execution Environments (TEEs), such as Intel SGX and ARM TrustZone, to isolate security sensitive code from the main system, reducing the Trusted Computing Base (TCB) and providing stronger assurances. However, identifying which code should reside in TEEs is complex and requires specialized expertise, which is not supported by current automated tools. Existing solutions often migrate entire applications to TEEs, leading to suboptimal use and an increased TCB. To address this gap, we propose Code Annotation Logic (CAL), a pioneering tool that automatically identifies security sensitive components for TEE isolation. CAL analyzes codebases, leveraging a graph-based approach with novel feature construction and employing a custom graph neural network model to accurately determine which parts of the code should be isolated. CAL effectively optimizes TCB, reducing the burden of manual analysis and enhancing overall security. Our contributions include the definition of security sensitive code, the construction and labeling of a comprehensive dataset of source files, a feature rich graph based data preparation pipeline, and the CAL model for TEE integration. Evaluation results demonstrate CAL's efficacy in identifying sensitive code with a recall of 86.05%, an F1 score of 81.56%, and an identification rate of 91.59% for security sensitive functions. By enabling efficient code isolation, CAL advances the secure development of applications using TEEs, offering a practical solution for developers to reduce attack vectors.}, author = {Gadey, Varun and Goetz, Raphael and Sendner, Christoph and Sovio, Sampo and Dmitrienko, Alexandra}, journal = {ArXiv | arXiv:2411.11567}, keywords = {sssgroup}, title = {GNN-Based Code Annotation Logic for Establishing Security Boundaries in C Code}, year = 2024 }

• Ensuring Integrity of NVMe Offloaded Data in Large-Scale Machine Learning. Götz, Raphael; Thesis; Master Thesis. (2023, January).
  • [ Abstract ]
  • [ BibTeX ]
  • [ Download ]
  • [ BibSonomy-Post ]
  Machine learning is increasingly used in security-critical domains and therefore has become an attractive target for attackers. In a targeted poisoning attack, the machine learning model is trained to behave normally on benign input, however, when a certain trigger is present in the input, an attacker-chosen misbehavior is triggered. At the same time, neural networks are constantly increasing in size, especially in the natural language processing domain, because more parameters can achieve higher accuracy. In recent years, there have been impressive innovations that have led to networks such as the Megatron-Turing NLG 530B with 530 billion parameters. DeepSpeed is an open-source deep learning optimization library that enables the training of such large networks. One of many innovations it implements is a Non-Volatile Memory Express (NVMe) offload that increases memory efficiency by moving data from expensive GPU and CPU memory to cheap NVMe memory. However, this mechanism opens a potential attack surface that could be exploited to perform poisoning attacks. Therefore, this thesis investigates the security of the NVMe offload mechanism and improves it. To achieve this, first, untargeted poisoning attack scenarios are tested to show that the NVMe offload is actually vulnerable. Then a security extension, able to guarantee the integrity and freshness of the data offloaded to the NVMe is designed and extensively evaluated. During this process, various trade-offs between security and performance impact are carefully considered through the implementation and benchmarking of several different versions of the extension. Based on the experimental results, the security extension is then further improved. Furthermore, this thesis also investigates if multithreading and the use of previously generated hash tables can reduce the performance impact.

  @mastersthesis{gotz2023ensuring, abstract = {Machine learning is increasingly used in security-critical domains and therefore has become an attractive target for attackers. In a targeted poisoning attack, the machine learning model is trained to behave normally on benign input, however, when a certain trigger is present in the input, an attacker-chosen misbehavior is triggered. At the same time, neural networks are constantly increasing in size, especially in the natural language processing domain, because more parameters can achieve higher accuracy. In recent years, there have been impressive innovations that have led to networks such as the Megatron-Turing NLG 530B with 530 billion parameters. DeepSpeed is an open-source deep learning optimization library that enables the training of such large networks. One of many innovations it implements is a Non-Volatile Memory Express (NVMe) offload that increases memory efficiency by moving data from expensive GPU and CPU memory to cheap NVMe memory. However, this mechanism opens a potential attack surface that could be exploited to perform poisoning attacks. Therefore, this thesis investigates the security of the NVMe offload mechanism and improves it. To achieve this, first, untargeted poisoning attack scenarios are tested to show that the NVMe offload is actually vulnerable. Then a security extension, able to guarantee the integrity and freshness of the data offloaded to the NVMe is designed and extensively evaluated. During this process, various trade-offs between security and performance impact are carefully considered through the implementation and benchmarking of several different versions of the extension. Based on the experimental results, the security extension is then further improved. Furthermore, this thesis also investigates if multithreading and the use of previously generated hash tables can reduce the performance impact.}, author = {Götz, Raphael}, keywords = {sssgroup}, month = {01}, publisher = {Master Thesis}, school = {University of Würzburg}, title = {Ensuring Integrity of NVMe Offloaded Data in Large-Scale Machine Learning}, type = {Master Thesis}, year = 2023 }
• Security of NVMe Offloaded Data in Large-Scale Machine Learning. Krauß, Torsten; Götz, Raphael; Dmitrienko, Alexandra; in European Symposium on Research in Computer Security (ESORICS) (2023).
  • [ BibTeX ]
  • [ URL ]
  • [ Download ]
  • [ BibSonomy-Post ]
  @article{krauss2024security, author = {Krauß, Torsten and Götz, Raphael and Dmitrienko, Alexandra}, journal = {European Symposium on Research in Computer Security (ESORICS)}, keywords = {Private_AI}, title = {Security of NVMe Offloaded Data in Large-Scale Machine Learning}, year = 2023 }

• Survey on the Evaluation of Self-Aware Computing Systems. Götz, Raphael; Krupitzer, Christian; Kounev, Samuel; (2020).
  • [ Abstract ]
  • [ BibTeX ]
  • [ BibSonomy-Post ]
  Software is becoming larger and more complex. In 2001 IBM published a manifest in which they stated that the increase in complexity is a major obstacle to progress for the IT industry. A solution to this looming complexity crisis is self-aware computing systems. These systems learn models that, help them to capture knowledge on themselves and their environment, and use these to consider actions in accoradnce with to act in accordance with higher level goals [3]. This enables them to act according to their knowledge and reason. One open issue in the field of self-aware computing systems is the growing demand for evaluation methods that make these systems comparable [4]. The main problem when evaluating self-aware computing systems is that traditional software metrics, such as re- sponse time or throughput, are not sufficient, as they cannot capture all relevant aspects of self-awareness. This thesis addresses the problems and challenges of evaluating self-aware computing systems and their related concepts, by providing an overview over the currently available evaluation methods for these systems. For this purpose, 37 papers dealing with the evaluation of self-aware computing systems and their related concepts are analyzed and classified using a taxonomy. This answers five research questions. Namely, the questions how and when the evaluation of self-aware computing systems is performed, and which parts of the systems are evaluated most frequently. The question whether the available methods of evaluation do address overshooting, oscillations an the level of self-awareness is also addressed. Answering these research questions results in the identification of research gaps. Namely, the insight that there is a lack of research concerned with the evaluation of the design of self-aware systems and proactive adaptation. Other observations are, that the sets of metrics and quality attributes found in the literature have surprisingly little overlap, suggesting that the do not cover all the relevant facets of self-adaptation and self-awareness, and that the evaluation of the level of self-awareness without access to the internals of the system is still rather difficult. Based on these insights improvements and best practices for future research are suggested.

  @mastersthesis{noauthororeditor, abstract = {Software is becoming larger and more complex. In 2001 IBM published a manifest in which they stated that the increase in complexity is a major obstacle to progress for the IT industry. A solution to this looming complexity crisis is self-aware computing systems. These systems learn models that, help them to capture knowledge on themselves and their environment, and use these to consider actions in accoradnce with to act in accordance with higher level goals [3]. This enables them to act according to their knowledge and reason. One open issue in the field of self-aware computing systems is the growing demand for evaluation methods that make these systems comparable [4]. The main problem when evaluating self-aware computing systems is that traditional software metrics, such as re- sponse time or throughput, are not sufficient, as they cannot capture all relevant aspects of self-awareness. This thesis addresses the problems and challenges of evaluating self-aware computing systems and their related concepts, by providing an overview over the currently available evaluation methods for these systems. For this purpose, 37 papers dealing with the evaluation of self-aware computing systems and their related concepts are analyzed and classified using a taxonomy. This answers five research questions. Namely, the questions how and when the evaluation of self-aware computing systems is performed, and which parts of the systems are evaluated most frequently. The question whether the available methods of evaluation do address overshooting, oscillations an the level of self-awareness is also addressed. Answering these research questions results in the identification of research gaps. Namely, the insight that there is a lack of research concerned with the evaluation of the design of self-aware systems and proactive adaptation. Other observations are, that the sets of metrics and quality attributes found in the literature have surprisingly little overlap, suggesting that the do not cover all the relevant facets of self-adaptation and self-awareness, and that the evaluation of the level of self-awareness without access to the internals of the system is still rather difficult. Based on these insights improvements and best practices for future research are suggested.}, author = {Götz, Raphael and Krupitzer, Christian and Kounev, Samuel}, keywords = {raphaelgoetz}, title = {Survey on the Evaluation of Self-Aware Computing Systems}, year = 2020 }