CPU-Auth: Device Fingerprinting for Authentication via DVFS Side-Channel

Ryan Swift

cs.CROct 7, 2026

CPU-Auth: Device Fingerprinting for Authentication via DVFS Side-Channel

Authors: Ryan Swift

Organizations: University of California, Davis

Abstract

Lack of effective authentication has resulted in numerous security and privacy breaches, including unauthorized access to protected information, identity theft, and fraud. One approach to mitigating such attacks is Multi-Factor Authentication (MFA), in which users must provide multiple pieces of information for authentication. Some secondary authentication factors include SMS text verification codes, biometrics, and tokens. Each contains at least one notable flaw: SMS is notoriously insecure; biometrics rely upon access to sensitive personal data; and tokens require dependence on third-party providers (e.g. OAuth providers). This work explores CPU-Auth, a novel authentication mechanism based on unique variations in the physical characteristics of the CPU of a computing device. By measuring the behavior of the Dynamic Voltage and Frequency Scaling (DVFS) governor remotely from within a browser, unique properties of the CPU can be leveraged to establish a hardware-based device fingerprint for use in CPU-Auth. The performance of CPU-Auth is evaluated on over 50,000 data traces using distance-based and deep learning methods. CPU-Auth is part of a larger research project, and the results provided in this report reflect only the contributions made to the project by members of this group.

Figures & tables

Base Model	Model Parameters (incl. classifier)	Accuracy	F1 Score	Precision	Recall
DTW	N/A	0.6914	0.6918	0.6909	0.6926
MLP	2,181,505	0.9500	0.9474	0.9000	1.0000
FCN	33,090,433	0.9250	0.9455	0.8966	1.0000
ResNet	8,255,297	0.5250	0.6885	0.5385	0.9545

Table 1: Results of CPU-Auth using different base models.

Appendix figures & tables3 assets

Supplementary material from the paper’s appendix.

Appendix

	Train	Validation
Number of Pairs in Split	88,072	9,448

Appendix

Table 2: Number of total pairs in Train and Validation splits. The 80/20 split on devices between Train and Validation resulted in approximately a 90/10 split in pairs.

DTW Threshold

71200.0

Appendix

Table 3: The threshold learned from the Train split and used to achieve the results in Validation for classification based on DTW.

	MLP	FCN	ResNet
Learning rate (base model)	1e-5	2e-7	1e-6
Learning rate (classifier)	1e-4	1e-6	1e-6
Weight decay (base model)	1e-1	1e-2	1e-3
Weight decay (classifier)	1e-1	1e-2	1e-4
Batch size	64	64	64
Epochs	5	4	5

Appendix

Table 4: Hyperparameters used to achieve final results for each combination of base model and classifier in the three CPU-Auth implementations.

Explore similar work

Scalable Secure Biometric Authentication without Auxiliary Identifiers
Apr 27, 2026Alexander Bienstock, Daniel Escudero, Antigoni Polychroniadou +5Biometric Identification
JPMorganChase, New York, NY, USA. · D.E. is now at TACEO.
Rendering on Real Silicon: GPU Render-Timing as a Passive, AI-Resistant CAPTCHA Signal
Jul 25, 2026David Noever, Forrest McKeeCybersecurity
PeopleTec, Inc.
ThermalTap: Passive Application Fingerprinting in VR Headsets via Thermal Side Channels
May 13, 2026Mahsin Bin Akram, A H M Nazmus Sakib, OFM Riaz Rahman Aranya +3Virtual Reality
University of Texas at San Antonio San Antonio, Texas, USA

Apr 27, 2026, cs.CRJ/K move · Enter open · S save

Scalable Secure Biometric Authentication without Auxiliary Identifiers

Alexander Bienstock, Daniel Escudero, Antigoni Polychroniadou, Zhen Zeng+4

JPMorganChase, New York, NY, USA. · D.E. is now at TACEO.

Biometric Identification

Open paper AskPDF arXiv

The prevalence of biometric authentication has been on the rise due to its ease of use and elimination of weak passwords. To date, most biometric authentication systems have been designed for on-device authentication of the device owner (e.g., smartphones and laptops). Recently, biometric authentication systems have started to emerge that are designed to authenticate users against cloud databases storing representations of biometrics for large numbers of users (potentially millions), such as those facilitating biometric payments. However, the use of a large cloud database introduces a significant attack vector, as a breach of the database could lead to the compromise of all enrolled users' sensitive biometric data. Indeed, all such existing systems either do not adequately protect against such a breach, or are impractical to deploy and use due to their high computational overhead. In this work, we present a new biometric authentication system that provides provable security guarantees against data breaches, while remaining scalable and performant. To do so, we marry artificial intelligence with advanced cryptographic techniques in a novel fashion, providing several optimizations along the way. Our work is the first to show that real-world scalable privacy-preserving biometric authentication without auxiliary identifiers is feasible, and we believe that it will spur widespread industrial adoption and further research in this area.

Abstract

Explore similar work

Scalable Secure Biometric Authentication without Auxiliary Identifiers

Rendering on Real Silicon: GPU Render-Timing as a Passive, AI-Resistant CAPTCHA Signal

ThermalTap: Passive Application Fingerprinting in VR Headsets via Thermal Side Channels