Characterizing the Variance Envelope: A Multi-Dimensional Analysis of Spectre Telemetry Across Architectures and Workloads

Abstract

Hardware attacks like Spectre exploit built-in processor vulnerabilities, leaving anomalous footprints in Hardware Performance Counter (HPC) metrics. While machine learning can detect these footprints in controlled settings, static models fail in the real world when confronted with background system noise, diverse attack variants, and adversarial traffic pacing. To close this gap, this paper characterizes the "variance envelope"-the full range of how attack signatures shift- across Intel, ARM, and AMD architectures. We evaluate an extensive experimental matrix encompassing three attack variants, four pacing modes, and four background-noise conditions. Our analysis proves that HPC signatures are highly fragile and easily warped by their execution environment. Furthermore, we expose a critical microarchitectural bottleneck: the persistent, hardware-level failure of Prime+Probe attacks on the AMD Jaguar. Ultimately, this comprehensive characterization demonstrates that reliable runtime detection requires architecture-aware, adaptive monitoring rather than static models.