---
title: Electromagnetic Fault Injection (EMFI)
url: https://www.emergentmind.com/topics/electromagnetic-fault-injection-emfi
type: topic
---

# Electromagnetic Fault Injection (EMFI)

Electromagnetic Fault Injection (EMFI) is a noninvasive and highly precise physical attack methodology that leverages rapidly varying electromagnetic fields to induce transient faults in microelectronic circuits. EMFI has been extensively utilized to corrupt instruction flow, data path, or analog sensor feedback in both legacy microcontrollers and complex modern SoCs, threatening the integrity of cryptographic implementations, secure boot logic, device authentication, and closed-loop control systems. Due to its spatial and temporal locality, EMFI remains a uniquely powerful tool for both offensive and defensive hardware security research.

## 1. Physical Principles and Coupling Mechanisms

EMFI exploits Faraday’s law of induction. A pulsed or high-frequency current through a coil probe generates a time-varying magnetic flux density $\mathbf{B}(t)$, which induces a voltage $V_{\text{ind}}(t) = -\frac{d\Phi(t)}{dt} = -\frac{d}{dt} \iint_{A} \mathbf{B}(t) \cdot d\mathbf{A}$ across on-chip loops (interconnects, rails, or sensors) [2411.14878], [1402.6421]. The induced voltage is a function of the magnetic field gradient, mutual inductance $M$ of coil and victim, and the rise/fall time of the injected pulse.

In typical EMFI setups, the probe is positioned $\sim$0.1–0.5 mm above the package, aligned with critical power, clock, or signal domains [2407.6019], [1910.11566], [2209.09835]. The spatial decay of induced field strength is rapid, with $B(r) \sim \mu_0 I / (2\pi r)$, and the coupling coefficient $k = M/\sqrt{L_\text{probe} L_\text{victim}}$ governs injection efficiency [1910.11566].

On analog or sensor feedback lines (e.g., power converter sensor loops), the incident $E(t)$ field is demodulated by nonlinearities, producing persistent DC offsets; for digital logic, sub-nanosecond timing is required to align the glitch with the circuit’s setup/hold or latch windows [2305.06901].

## 2. Experimental Platforms and Parameterization

EMFI systems integrate a programmable pulse generator (tens to hundreds of volts, nanosecond-scale rise/fall times) and a small near-field coil probe (typically 0.5–2 mm diameter, ferrite-cored for focused flux) on a precision XYZ translation stage [2209.09835], [1510.01537], [1402.6421]. Automated setups achieve sub-10 µm repeatability and are scalable from microcontrollers to full package SoCs [2209.09835].

Table: Representative EMFI Parameter Ranges

| Parameter            | Typical Range               | Notes                                               |
|----------------------|----------------------------|-----------------------------------------------------|
| Pulse amplitude, $V$ | ±100–500 V                 | Higher $|V|$ increases set-1 bias/area affected      |
| Pulse width, $\Delta t$ | 1.5–1000 ns              | 1.5–10 ns for digital logic; up to $\mu$s for analog|
| Rise/fall time       | ≈2 ns (as low as 200 ps)   | Sets edge sharpness; critical for cache/fetch attack |
| Probe–die distance, $d$ | 0.1–0.7 mm              | Strong spatial dependence; optimal via cartography   |
| Timing jitter        | <5 ps (intrinsic), <3 ns (system) | Essential for reproducibility at high f$_{\text{clk}}$ |
| Positioning grid     | 0.5–1 mm step (SoC), 20µm (MCU) | Used to identify “hot spots”                         |

Control and monitoring typically use GPIO/trigger signals from test firmware, high-speed oscilloscopes for pulse/response validation, and JTAG/UART for result extraction [1510.01537], [2204.06153].

## 3. Fault Models and Induced Behaviors

Fault manifestations in EMFI span a spectrum determined by the electrical/architectural context of the disturbed operation.

**Instruction fetch/decode faults** are prevalent in slow-Flash-based MCUs, where the EM pulse overlaps with bus fetch or decode windows, yielding single-instruction skips, opcode replacements, or exceptions; the output Hamming weight increases with $|V|$ due to set-1 bias [1407.6019], [1402.6421]. In high-speed SoCs, pulse alignment with instruction or L1I cache refill induces sticky instruction skips or persistent instruction word corruption [1910.11566], [1510.01537].

**Data-path faults** comprise bit flips or multi-bit “set-1” faults associated with data fetches, especially from off-chip or slow memories during LDR-type instructions, often modeled as $f^{(\text{set1})}_I(x) = x \vee M_I$ for affected bit mask $M_I$ [1402.6421].

**Cache and microarchitectural faults** in complex SoCs include instruction-cache refill faults (“4-skip + 4-replay” model), L2 block relocations, and MMU page-table entry (PTE) bit-flips or address remapping (e.g., $PT\_entry' = PT\_entry \oplus S$ for a shift mask $S$) [1510.01537], [1910.11566].

**Special subsystem faults** are enabled by EMFI on sensor feedback in power conversion devices, causing $\sim$1–2% output voltage/control errors or catastrophic battery damage via spoofed sensor DC offset $\Delta V_{\rm attack} \propto {P_T}/{d^2}$ [2305.06901].

**Side-channel and message injection faults** have been demonstrated on differential signaling buses (CAN, USB, HDMI) via common-mode field injection, enabling up to 90% bit-flip rates for optimal RF frequency/amplitude [2208.00343].

## 4. Case Studies: EMFI in Embedded Systems and Secure Processors

**Microcontrollers:** Classical experiments on Cortex-M3 at 56 MHz with 10 ns, ±200 V pulses document nearly 100% corruption at fetch/decode timing windows; statistical models parameterize bit flip/skew probabilities as functions of $(V_p, \Delta t, t_i)$, facilitating predictive attack development [1402.6421].

**Instruction cache attacks:** On ARMv7-M, near-cycle-precise 1.5 ns pulses induce high-probability ($\sim$96%) “4-skip + 4-replay” instruction-cache faults within a ~2 ns window of the cache-refill period, bypassing multiple-instruction skip countermeasures and enabling one-shot DFA, BellCoRe CRT-RSA, and unmasking attacks [1510.01537].

**Trusted Execution Environments:** EMFI allows privilege escalation and bypass of secure boot, range-check, or cryptographic checks in ARM TrustZone, QSEE, or AMD-SP platforms. Critical events include bit flips in secure memory, instruction-skips in control logic, TLB/caches corruption, and register value faults [2411.14878], [2209.09835]. For AMD-SP, 500 V, 73 ns pulses at 0.1 mm lift-off, precisely timed to the signature-compare event, skip the conditional branch to boot/halt with a 22% success rate over $10^4$ attempts [2209.09835].

**Memory authentication bypass:** For eMMC Replay Protected Memory Block (RPMB), $200$ V, $100$ ns pulses injected at ±10 ns within a $0.6\,\mu$s “HMAC-check” window can skip single instructions in the comparison loop, allowing arbitrary RPMB writes with no effect on user data, at a success rate as high as 2% per attempt [2511.22340].

**Clock frequency dependence:** EMFI attack success probability $P_\text{success}$ increases monotonically with processor clock frequency $f_\text{clk}$, as shorter clock periods reduce timing margins and increase susceptibility. A plausible implication is that dynamic frequency scaling or coarse clock jitter can significantly lower $P_\text{success}$ [2310.13389].

## 5. Countermeasures and Mitigation Strategies

Countermeasures are multi-layered, tailored to attack primitives and the underlying hardware/software.

**Hardware-level:**
- *Spatial hardening:* On-die/domain EM shielding (Faraday cages or $\mu$-metal), minimizing mutual inductance and attenuating stray fields [2209.09835], [2411.14878].
- *Redundant logic/datapath:* Dual-rail or duplicated execution for signature and control flow checks; parity/ECC on buses; error-detecting codes for cache lines [1910.11566].
- *On-die sensors:* Ring-oscillator or LC-tank devices to detect transient field/voltage spikes, activating reset or secure shutdown if threshold exceeded ($\sim$99% detection for $\geq$300 V/10 ns) [2411.14878].
- *Clock/supply domain management:* Dynamic frequency scaling, clock jitter/randomization, decoupling capacitors, and hardened localized supply [2310.13389].

**Software-level:**
- *Temporal redundancy (triplication):* Triplicate sensitive instructions, aligning copies to avoid single fetch overlap; triplication reduces fault coverage to $<1\%$ from baseline $>20\%$ under optimal EMFI [1407.6019].
- *Duplication + compare:* Duplicate critical operations with compare/branch error handlers; robust to instruction/data-path faults except for tightly packed instructions (if both are affected, undetectable) [1407.6019].
- *Bit-slicing redundancy:* For cryptographic kernels (e.g., Dilithium NTT), intra-register duplication and lockstep operation detect $>60\%$ of exploitable EMFI-induced faults in practice, with a $49\times$ performance and $2.1\times$ code-size overhead [2204.06153].
- *Control flow and integrity checks:* Canaries, checksums, and runtime validation of counters/branches [2310.13389].

**Protocol-level:**
- *Authentication, MAC, and error-coding*: For memory and bus transactions, utilize constant-time compare and multi-round authentication, raising Hamming-weight for “pass” constants or interleaving redundant verification [2511.22340], [2208.00343].

**Analog/sensor protection:**
- Faraday-cage enclosure, RF filter stages, sensor line redundancy, and real-time challenge/response verification. Simple envelope detectors alert to suspicious $>$MHz EM events [2305.06901].

## 6. Measurement, Calibration, and Attack Optimization

High-precision EMFI requires extensive calibration and statistical analysis. Effective attack campaigns iterate over spatial grids, timing offsets, pulse amplitudes and widths—with up to $10^4$ injections per target window—recording outcome distributions (e.g., skip, set-1, crash, unaffected) [1510.01537], [2209.09835]. Temporal alignment error $<3$ ns RMS is attainable; spatial repositioning error $<10$ μm over 50 mm is demonstrated for advanced SoC rigs [2209.09835].

Peak fault windows typically span 1–3 ns for instruction-cache refill, $0.6\,\mu$s for HMAC comparison, or $\sim100$ ns for data fetch, depending on subsystem and platform [2511.22340], [1510.01537], [1910.11566]. Attack optimization involves identifying “hot spots” through coarse then fine grid scanning, followed by parametric sweeps in the aligned window.

## 7. Future Directions and Security Implications

EMFI continues to expose new attack surfaces in high-performance SoCs, analog feedback systems, and secure architectures. Integration of microarchitectural fault models in proofs for OS/hypervisor security is needed [1910.11566]. Enhanced co-design between hardware/package/board shielding, dynamic multi-layer detection, and continuous EMFI-driven certification testing (<$10^{-8}$ success rate per critical function) are required for robust future TEEs and critical infrastructure [2411.14878].

Despite advances in countermeasures, no single protection is fool-proof; attackers can leverage timing, spatial focus, and system-specific vulnerabilities. Security engineers must employ holistic, defense-in-depth strategies, continuous red-team evaluation, and adherence to updated threat models calibrated with state-of-the-art EMFI capabilities.

Source: https://www.emergentmind.com/topics/electromagnetic-fault-injection-emfi