Dynamic Rowhammer Threshold Management: Temperature-Aware Threshold Degradation for In-DRAM Defenses

Jul 16, 2026

In-DRAM Rowhammer defenses that rely on a fixed mitigation threshold at manufacturing time degrade under real runtime conditions because the true Rowhammer Threshold (TRHD) changes with operating temperature. This work presents a defense-agnostic runtime layer, Dynamic Rowhammer Threshold Management, which updates each defense’s effective threshold once per epoch using a linear temperature model with a VRD-motivated guardband and projects results onto published threshold parameters. Evaluation against SALT-C, PRAC, and TRR shows PRAC 72 staleness breaches at 85°C drop to zero, with SALT-C reduced to zero at ≤5.1% latency cost, while exposing TRR’s capacity-limited failure mode.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages6

Reading Time15 min

Introduction

Background and Related Work

Dynamic Rowhammer Threshold Management

Temperature-driven degradation model

Per-epoch update procedure

Projection onto defense thresholds

Evaluation

Dynamic Rowhammer Threshold Management: Temperature-Aware Threshold Degradation for In-DRAM Defenses∗ Aziz Alajmi Hoeseok Yang Department of Electrical and Computer Engineering, Santa Clara University arXiv :2607 . 10392v1 [ cs .AR] 11 Jul 2026 In-DRAM Rowhammer defenses pin the mitigation threshold at manufacture time, yet the true Rowhammer Threshold (TRHD) varies with runtime temperature. We propose Dynamic Rowhammer Threshold Management, a defense-agnostic runtime layer that re-sources each defense’s threshold from the observed temperature once per epoch via a linear-T model with a VRD-motivated guardband g, projecting the result onto SALT-C, PRAC, and TRR through each defense’s threshold parameter. A decoupled oracle that scales physical TRHD per-DIMM by δ ∼ N (1, σ) breaks model self-consistency. The layer drives PRAC’s 72 staleness breaches at 85◦ C to zero; at σ=0 .10, sweeping g collapses PRAC breaches from 38.4 (g=1 .0) to 9.6 (g=0 .9). SALT-C drops from 10 nominal-static breaches to 2 (Dynamic) to 0 (bootstrap), at ≤5.1% latency. TRR is capacity-limited; the layer acts as a diagnostic. 1. Introduction The Rowhammer vulnerability [1] has worsened with each DRAM generation: the Rowhammer Threshold (TRHD)—the minimum activations needed to induce a bit flip—has decreased from ∼ 139K in 2014 [1] to below 4 .8K in modern DDR4 [2], and recent in-DRAM defenses already target sub-1K TRHD for DDR5 (e.g. SALT [3] provisions for TRHD as low as 500) . In-DRAM defenses such as Target Row Refresh (TRR, vendorproprietary; reverse-engineered model in [4]), Per-Row Activation Counting (PRAC) [5], and SALT-C [3] mitigate this threat by tracking row activations and refreshing potential victims when a threshold is exceeded. However, the defenses we evaluate, and many published counter-based Rowhammer defenses, are parameterized around a fixed assumed TRHD value rather than recomputing that value from runtime temperature. This is problematic because the true TRHD varies strongly with runtime operating conditions. Our linear regression on the aggregated SpyHammer [6] BER–temperature data across DDR4 chips from Micron, Hynix, and Nanya shows a near-linear T dependence with up to ∼3.3 × within-module BER span over the 50–95◦ C operational range. VRD [7] further shows that TRHD fluctuates stochastically over time, with minima appearing only after tens of thousands of measurements. As the gap between a defense’s configured threshold and the true (conditiondependent) TRHD widens, the defense becomes progressively less effective, creating an exploitable threshold staleness window. A defense calibrated for 65◦ C nominal operation silently under-mitigates when the system runs hot. Our contribution is not a new Rowhammer defense; it ∗ Presented at the Sixth Workshop on DRAM Security (DRAMSec 2026) . Emails: {aalajmi, [hoeseok.yang}@scu.edu](hoeseok.yang}@scu.edu) is a runtime threshold-management layer that retrofits counter-based defenses exposing a threshold parameter. Defense designers (SALT-C, PRAC, TRR) build correctness arguments around a single TRHD constant; we keep those arguments intact and replace the constant with a value re-sourced from T once per epoch. We make the following contributions: 1. A defense-agnostic threshold-management layer (§3) consisting of (a) a temperature-driven degradation model with a tunable VRD guardband (§3.1); (b) a per-epoch update procedure (§3.2); and (c) a mechanical projection of the effective TRHD onto each defense’s published threshold variable (§3.3) . No per-defense parameter is tuned; the layer only ever tightens the underlying defense’s threshold and never relaxes it. 2. A unified evaluation across three defense architectures (SALT-C, TRR, PRAC) against a common thresholdstaleness attack with a decoupled oracle that breaks model self-consistency. The layer eliminates PRAC’s 72 staleness breaches at 85◦ C (72→0), closes SALT-C’s 10-breach staleness gap at 5.1% latency cost

FAQs

Why do fixed TRHD-based in-DRAM Rowhammer defenses become less effective over time?

Because true TRHD varies with runtime temperature and other operating conditions, a defense calibrated to a nominal temperature can under-mitigate when the system runs hot, creating a threshold staleness window.

What is Dynamic Rowhammer Threshold Management in this paper?

It is a defense-agnostic runtime layer that re-sources each defense’s threshold from observed temperature once per epoch using a linear-T model with a VRD-motivated guardband, then projects the result onto each defense’s published threshold parameter.

What improvements does the layer achieve for PRAC, SALT-C, and TRR?

The layer drives PRAC’s 72 staleness breaches at 85°C to zero; it reduces SALT-C’s breaches from 10 nominal-static cases to two under the dynamic method and to zero for bootstrap, at ≤5.1% latency. For TRR, it reveals an architectural failure mode because the layer is capacity-limited.

Jul 16, 2026

Upload by Theodore