Microarchitectural Security

Welcome to the fall 2026 website of CMU’s 17-435 / 17-715 – Microarchitectural Security course (previously called “Advanced Topics in Hardware Security”).

What is microarchitectural security?

Microarchitectural security studies how hardware complexity impacts software security, including how this complexity opens up new vulnerabilities, how these vulnerabilities undermine software security, and how to build systems that are secure against these vulnerabilities.

Why study microarchitectural security?

  • Microarchitectural (μarch) security is an increasingly important subfield of system security. Traditionally, system security focused primarily on software vulnerabilities. Today, software developers can no longer assume that the underlying hardware is secure. This shift has had significant implications for software from operating systems to web browsers and from hand-held devices to large-scale cloud infrastructures.

  • Microarchitectural security is an exciting research topic, with papers frequently published at the top computer security (IEEE S&P, USENIX Security, NDSS, CCS) and computer architecture (ISCA, ASPLOS, MICRO, HPCA) conferences.

  • Finally, microarchitectural security is fun. If you enjoy understanding how systems (really) work behind abstractions layers, thinking of how to make systems behave beyond their intended specification, or you’re just a curious student who is intrigued by the topic and likes solving puzzles, this class will be right up your alley.

Who is this class for?

This course is designed for students (undergrads, masters, and PhD) who want to learn about how to design more secure software and hardware systems. Students who are interested in computer security, computer architecture, or computer systems in general will find it appealing too.

While we will review these topics at the beginning of the course, familiarity with the fundamentals of computer systems (15/18-213 or equivalent) and computer security (15/18-330 or equivalent) is recommended. This includes threat models, trusted computing base, basics of cryptography, caching, multi-core systems, and memory systems.

NB: lectures and homeworks are the same between 17-715 and 17-715. However, 17-715 has additional requirements not shared by 17-435 (for more information, see the syllabus).

Official course description

Advances in hardware have been playing a pivotal role in driving technological progress; however, they have come at the cost of unprecedented levels of complexity. In this course, we study how this complexity opens up new vulnerabilities, how these vulnerabilities undermine software security, and how to build systems that are secure against these vulnerabilities. Topics include microarchitectural side-channel attacks and defenses, transient execution attacks and defenses, trusted execution environments, fault attacks and defenses, and emerging hardware security threats such as leaks due to data-dependent CPU and GPU optimizations and remote power side channels. The course consists of hands-on lab assignments, lectures and guest lectures on each topic, and discussions of recent papers from the hardware security literature.

How this course fits into various programs

This course counts as an elective in many undergraduate and graduate programs. It can be used to fulfill the depth requirement of the undergraduate concentration in security and privacy in both Computer Science and in Electrical & Computer Engineering.

Course staff

Logistics