[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-85885-en":3,"doc-seo-85885-105":29,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},85885,687197207639,"Asher","https://ap-avatar.wpscdn.com/davatar_a8503ba1806abce46bf441b54a3ca4cd",8,"Research & Report","Mechanised operational semantics of Rowhammer","Rowhammer is a DRAM vulnerability where repeated accesses to aggressor rows can cause bit-flips in nearby victim rows, breaking the locality assumption behind conventional programming language memory semantics. To enable rigorous reasoning about defences, the work presents a probabilistic small-step operational semantics for an idealised imperative language with Rowhammer-style faults. It parameterises faults with probabilities, propagates distributions via a monadic structure, and formalises physical separation as a case study. A mechanised Lean proof establishes distribution-independent semantic collapse and secure information-flow properties via observation-parametric non-interference.","arXiv :2607 . 103 14v 1 [ cs .PL] 11 Jul 2026  \nMechanised operational semantics of Rowhammer  \nMARTIN BERGER, University of Sussex, UK and Montanarius Ltd, UK AMIR NASEREDINI, Huawei R&D UK Ltd, UK  \nRowhammer is a hardware vulnerability in dynamic random-access memory (DRAM) in which repeated accesses to one or more aggressor rows can induce bit-flips in nearby victim rows. This phenomenon violatesa core assumption of conventional programming language semantics: that reading from or writing to one memory location does not modify others. Despite the security importance of this phenomenon, there is no widely established formal framework connecting Rowhammer faults with program behaviour. This makes it difficult to reason rigorously about the efficacy of proposed Rowhammer defences and the program-level guarantees they provide. To address this gap, we present a probabilistic small-step operational semantics for an idealised imperative language subject to Rowhammer-style faults. The semantics is high-level in that it abstracts from DRAM internals and semiconductor physics. A general probabilistic fault model parameterisesthe semantics, representing Rowhammer-style faults by assigning probabilities to bit-flips during read or write operations within a specified victim region. The resulting distributions are propagated through programs using the standard monadic structure of probabilistic computation. As a case study, we formalise physical separation, a well-known defence that places program variables sufficiently far apart in physical memory that an access to one variable cannot disturb another. We prove a distribution-independent semantic collapse theorem: for every finite execution, including prefixes of terminating and non-terminating executions, the protected projection of the probabilistic Rowhammer semantics is the Dirac distribution of the corresponding Rowhammer-free execution. Furthermore, we develop an observation-parametric account of secure information flow. Non-interference is expressed as a hyperproperty comparing the distributions of low observations from low-equivalent initial memories. Under physical separation, ordinary non-interference and probabilitysensitive Rowhammer non-interference coincide for every observer of protected behaviour. Consequently, physical separation preserves non-interference for every admissible fault model, while every Rowhammer noninterference violation reflects a violation already present in the Rowhammer-free semantics. The development is fully mechanised in Lean using mathlib, relying on no unfinished proofs or problem-specific axioms.  \nCCS Concepts: • Theory of computation → Program semantics; • Software and its engineering → Formal methods; • Security and privacy → Information flow control; Systems security; Logic and verification.  \nAdditional Key Words and Phrases: Probability theory, Probabilistic fault models, Rowhammer, Programming language semantics, Operational semantics, Relational safety, Mechanised verification, Lean 4, Secure information flow, Non-interference.  \n1 Introduction  \nMost reasoning about software relies on a locality assumption about memory access effects:  \nReading or writing one memory location does not modify other locations.  \nRowhammer violates this assumption. Repeated activation of one or more aggressor rows in dynamic random-access memory (DRAM) can induce bit-flips in physically nearby victim rows [16, 35]. The resulting mismatch between the memory model assumed by software semantics and the behaviour of its semiconductor implementation creates a semantic gap: hardware research describes disturbance mechanisms, address mappings, and mitigations, whereas software verification reasons about commands, stores, traces, observations, and security properties. This gap is particularly important for security. Rowhammer is usually presented as an integrity failure, but corruption of a high-security value can alter control flow or a later low-security output,","cbCaiqS2pZT8W0PM","https://ap.wps.com/l/cbCaiqS2pZT8W0PM","pdf",1465633,1,35,"English","en",105,"# Introduction\n## The semantic view: abstracting memory access\n## Research questions and contributions","[{\"question\":\"What core programming language semantics assumption does Rowhammer violate?\",\"answer\":\"It violates the assumption that reading or writing one memory location does not modify other locations. Rowhammer creates non-local memory effects via bit-flips in victim rows.\"},{\"question\":\"How does the paper model Rowhammer in operational semantics?\",\"answer\":\"It introduces a probabilistic small-step operational semantics for an imperative language, using a fault model that assigns probabilities to bit-flips during read or write operations within a victim region.\"},{\"question\":\"What defence is formalised, and what theorem is proved about it?\",\"answer\":\"The paper formalises physical separation, placing variables far enough apart in memory to prevent disturbance. It proves a distribution-independent semantic collapse theorem stating that protected semantics match the corresponding Rowhammer-free execution’s Dirac distribution for any finite execution.\"}]",1784206943,88,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":27},"mechanised-operational-semantics-of-rowhammer","",{"@graph":35,"@context":85},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/mechanised-operational-semantics-of-rowhammer/85885/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-23","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What core programming language semantics assumption does Rowhammer violate?","Question",{"text":75,"@type":76},"It violates the assumption that reading or writing one memory location does not modify other locations. Rowhammer creates non-local memory effects via bit-flips in victim rows.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How does the paper model Rowhammer in operational semantics?",{"text":80,"@type":76},"It introduces a probabilistic small-step operational semantics for an imperative language, using a fault model that assigns probabilities to bit-flips during read or write operations within a victim region.",{"name":82,"@type":73,"acceptedAnswer":83},"What defence is formalised, and what theorem is proved about it?",{"text":84,"@type":76},"The paper formalises physical separation, placing variables far enough apart in memory to prevent disturbance. It proves a distribution-independent semantic collapse theorem stating that protected semantics match the corresponding Rowhammer-free execution’s Dirac distribution for any finite execution.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":45,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":45,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":45,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":45,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":45,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":45,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":45,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]