# X-Ray Fault Injection Localization with a Shield on Powered and Unpowered Devices

P Grandamme, Stephanie Anceau, Nathalie Bochard, Luc Salvo, Lilian

Bossuet, Jean-Max Dutertre

► To cite this version:

P Grandamme, Stephanie Anceau, Nathalie Bochard, Luc Salvo, Lilian Bossuet, et al. X-Ray Fault Injection Localization with a Shield on Powered and Unpowered Devices. 2025 IEEE Physical Assurance and Inspection of Electronics (PAINE 2025), Oct 2025, Denver, CO, United States. hal-05282404

HAL Id: hal-05282404

https://hal.science/hal-05282404v1

Submitted on 25 Sep 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# X-Ray Fault Injection Localization with a Shield on Powered and Unpowered Devices

P. Grandamme<fnref n="1" />,<fnref n="4" />, S. Anceau<fnref n="2" />, N. Bochard<fnref n="1" />, L. Salvo<fnref n="3" />, L. Bossuet<fnref n="1" />, J.M. Dutertre<fnref n="4" />

**Abstract**—This study explores the use of X-ray fault injection localization techniques to evaluate the security of integrated circuits, particularly Flash memory in microcontrollers. Utilising a tungsten shield with an injection aperture, the experiments demonstrated precise targeting of the fault injection. The method was applied to both powered and unpowered devices, successfully discharging floating gate transistors in Flash memory, resulting in localised faults. The findings emphasise the effectiveness of the shield in localization X-ray exposure and highlight the vulnerabilities of critical integrated circuits to such attacks. The results obtained demonstrate the feasibility of injecting single bit faults into the Flash memory with X-ray of both powered and unpowered chips. This research contributes to the advancement of our understanding of X-ray fault injection mechanisms and underscores the importance of implementing robust security measures to counteract the emergence of novel threats.

***Index Terms***—X-ray, Permanent fault injection, Flash memory, Tungsten shield, Hardware security

## I. INTRODUCTION

For several years, physical attacks, and especially active attacks, have been employed as a means of evaluating the security and reliability of integrated circuits (ICs). Such attacks can be global in nature, affecting the entire chip, for instance through voltage or clock glitches [1]–[5]. Alternatively, they may be localised, targeting a specific part of the device. The two most prevalent forms of local physical attacks are electromagnetic and laser fault injection. They have been the subject of extensive study.

The initial observation of light's impact on microcontrollers was documented by Skorobogatov in 2003, who conducted experiments exposing circuits to flashlights and laser beams [6]. In the present era, laser fault injection is frequently regarded as the most efficient technique, due to its spatial and temporal accuracy. The fault model is well understood from the physical level up to the algorithmic level for the laser fault injection on the read operation in Flash memories [7], [8].

In 2009, Skorobogatov also demonstrated the erasure of bit values using a 650 nm wavelength laser by heating the memory cells of the embedded Flash of unpowered devices [9]. These results have been improved and the associated fault model has been defined recently [10].

In addition, electromagnetic fault injection attacks have been employed to modify the behaviour of electronic chips. The proposed methodology has been successfully demonstrated in experimental settings, exhibiting high temporal and spatial accuracy [11]–[13].

For several decades, X-rays have been utilised to simulate space or nuclear environments, as ionising radiation can damage ICs, particularly memories [14], [15]. Such techniques are now employed within the security framework. To date, only a limited number of studies have examined the effects of radiation on electronic circuits from a security perspective. These studies have ranged from a nanofocused source to laboratory sources, from powered to unpowered circuits, and across different technological nodes [16]–[19].

The objective of this paper is to present a detailed characterisation of the utilisation of a tungsten shield with dedicated injection hole, with the aim of locating the X-ray fault injection in a Flash memory of a commonly used microcontroller. Furthermore, the impact of power supply is evaluated by performing attacks on both powered and unpowered devices. This type of memory is used to store code and security features, such as cryptographic keys or access rights. Therefore, the evaluation of their susceptibility to X-ray fault injection represents a significant security concern.

The operational mechanisms of Flash memories and the effects of radiation on them are detailed in Section II. Section III recalls some previous works. Section IV describes the experimental setup, while Section V presents and analyses the experimental results. Section VI discloses the encountered limitations and improvements to be made. Finally, Section VII concludes this article.

This work was supported by research grants of the projects POP ANR-21-CE39-0004 and MITIX ANR-20-CE39-0012 from the french Agence Nationale de la Recherche.

<footnote n="1">¹Université Jean Monnet Saint-Etienne, CNRS, Institut d'Optique Graduate School
Laboratoire Hubert Curien UMR 5516, F-42023, SAINT-ETIENNE, France
{paul.grandamme,nathalie.bochard,lilian.bossuet}@univ-st-etienne.fr</footnote>

<footnote n="2">²Univ. Grenoble Alpes, CEA Leti, F-38000 Grenoble, France
stephanie.anceau@cea.fr</footnote>

<footnote n="3">³Univ. Grenoble Alpes, CNRS UMR5266, Grenoble INP, Laboratoire SIMaP, 38000 Grenoble, France
luc.salvo@grenoble-inp.fr</footnote>

<footnote n="4">⁴Mines Saint-Etienne CEA, Leti, Centre CMP, F-13541 Gardanne, France
dutertre@emse.fr</footnote>
This section provides an overview of the operation of Flash memory and floating gate transistors, which are the primary components of this technology. Furthermore, this part delineates the impact of radiation on FGMOS, i.e. floating gate MOS, transistors.

### A. Floating gate transistors and Flash memories

The floating gate transistor is the basic cell unit in Flash memory, storing one bit of information. The floating gate, which serves as a charge-storage element, is situated within the oxide layer that exists between the control gate and the transistor's channel, as illustrated in Figure 1. The floating gate is electrically isolated from the remainder of the structure by the oxide.

<figure><img src="image_2.png" /><figcaption>Fig. 1: Cross-sectional view of a floating gate transistor. Extracted from [10].</figcaption></figure>

The storage of electrical charges in the floating gate results in the creation of an electrical field, which causes the energy bands in the oxide to bend. It follows that the carriers stored in the floating gate induce a shift in the current-voltage characteristics of the cell. For a specified $V_{read}$ voltage applied to the control gate, the current drawn by the cell is lower (respectively higher) if the floating gate is charged (respectively discharged). Therefore, the logical state of a floating gate transistor is determined by the electrical charges present in the floating gate, which affects its threshold voltage. Figure 2 depicts the I-V characteristics of charged and uncharged floating gate transistors.

<figure><img src="image_3.png" /><figcaption>Fig. 2: I-V characteristics of floating gate transistors. Extracted from [10].</figcaption></figure>

In order to read the content of a Flash memory cell, the control gate is biased at a fixed voltage, $V_{read}$, between the

threshold voltages of a charged and an uncharged floating gate transistor. The current drawn by the memory cell is then compared to a reference value, $I_{ref}$, by a sense amplifier.

### B. X-Ray effects on floating gate transistors

In the existing literature, three distinct processes have been identified as being responsible for the threshold voltage changes observed in floating gate transistors induced by the Total Ionization Dose (TID) effect resulting from X-ray exposure. These are illustrated in Figure 3 and described in further detail below:

(1) Electron-hole pairs generated by the radiation in the oxides are separated by the electric field. The electron are permitted to escape through the control gate, while the holes are injected into the floating gate. Subsequently, the latter can recombine with the charges stored in the floating gate. Consequently, the overall stored charge will be reduced,

(2) Charges can be trapped in the floating gate oxide,

(3) Charges stored in the floating gate obtain sufficient energy from the radiation to escape from the potential well. This phenomenon is referred to as *photoemission*.

<figure><img src="image_4.png" /><figcaption>Fig. 3: TID mechanisms in a charged floating gate transistor. Adapted from [20].</figcaption></figure>

The aforementioned mechanisms (1) and (3) contribute to a reduction in the number of charges stored in the floating gate.

Mechanism (1) facilitates the injection of holes from the oxides into the floating gate, where electrons are stored. The first mechanism necessitates the presence of an electric field within the oxide in order to separate the charges. Subsequently, some of the electron-hole pairs undergo recombination. The remaining charges accumulate in the oxide or in the vicinity of the $Si-SiO_2$ interfaces. The trapped charges result in a shift in the threshold voltage ($V_{th}$) and an increase in the transistor's leakage current. This first effect necessitates the existence of an electric field in order to disassociate the electron/hole pairs that are formed as a consequence of the irradiation. Consequently, this effect cannot be observed in unpowered chips.
The second mechanism is not particularly significant due to
the minimal thickness of the oxides.

The third mechanism permits the electrons stored in the
floating gate to tunnel over the potential barrier constituted by
the oxides and thereby escape. This is the phenomenon being
sought in attacks on unpowered devices.

### III. RELATED WORKS

Previous works have established that X-rays can be utilised
as a means of fault injection. The initial demonstration of the
utilisation of X-rays for the purpose of evaluating the security
of integrated circuits was conducted in 2017. In this work,
a nanofocused X-ray source is employed to corrupt a single
Flash memory cell [16]. The employment of a laboratory X-
ray source led to enhancements in the outcomes of these
experiments, thereby rendering them more accessible and
reproducible [17], [19]. Lastly, it has been demonstrated that
Flash memories and EEPROM memories of unpowered chips
are also sensitive to radiation [18]. In the latter case, the results
obtained suffer from a lack of precision in the injected faults
due to the characteristics of the irradiator. Indeed, the entire
chip is exposed to X-ray irradiation. The faults are attributed to
two primary causes: firstly, the irradiation of the Flash memory
cells, and secondly, the irradiation of the MOS transistors
that constitute the control and addressing logic. In the case
of the floating gate transistors that constitute Flash memory
cells, it is the third mechanism described in the Section II
that is responsible for the faults apparition. In floating gate
transistors, a fault is defined as occurring when there is a
sufficiently large shift in the threshold voltage, $V_{th}$, that falls
below the reference value, $V_{read}$. In this work, we propose to
use a tungsten shield in order to localize the injected faults
induced by an X-ray laboratory source. The objective of this
study is to utilise a drilled shield to fault only the floating
gate transistors without impacting the MOS transistors of the
control logic on powered and unpowered circuits.

### IV. EXPERIMENTAL SETUP

This section is dedicated to the description of the experi-
mental setup employed, including the X-ray source, the targets
and the shield.

#### A. X-Ray setup

The X-ray source used is a laboratory tomograph. X-ray
absorption tomography is a non-destructive imaging technique
that enables the reconstruction of cross-sectional images of an
object. It is composed of a Hamamatsu X-ray tube with a
tungsten anode and a diamond window to obtain a directed
X-ray beam. The source is operated at a voltage of 80 kV
and a current of 50 µA. The distance between the source
and the targeted IC is set at 10 mm and the irradiations are
conducted at room temperature. The setup can be seen in
Figure 4 including the target and the shield described in the
next subsections.

<figure><img src="image_5.png" /><figcaption>Fig. 4: Picture of the experimental setup.</figcaption></figure>

#### B. Target

The hardware target is a 32-bit microcontroller, the
STM32F100, placed on a custom board for a ChipWhisperer
platform [21]. It embeds 128 kB of NOR Flash memory orga-
nized in 2,048 bitlines and 512 wordlines, and manufactured
using 90 nm technology. The erased state is represented by
the value 0xFF at the byte level. The target's package was
prepared for laser fault injection, thus it was opened on its
backside. An image of the target obtained with the tomograph
can be seen in Figure 5a and an overlay of the previous image
with an infrared image of the target can be seen in Figure 5b.
The Flash memory of this microcontroller has already been
reverse-engineered [10], thus enabling the data to be located
in accordance with its address.

#### C. Shield

The area exposed to X-ray is larger than the target device.
As a result, without protection the entire circuit would be
irradiated and defects would appear throughout the target,
which is unhelpful for characterising and attacking. This is
why it is necessary to use a shield with an injection hole.
The purpose of this shield is to stop incident radiation over
the entire circuit, except for a reduced area corresponding
to the exposure window. Given that X-rays are produced by
a source with a tungsten target, this material is the optimal
choice for radiation blockage. The shield is a tungsten disc,
measuring 1 mm in thickness and featuring a central hole with
a diameter of 25 µm. The fabrication of small-diameter holes
in thick shields to block radiation is constrained by shield
manufacturing processes.

The tomograph spectrum is illustrated in blue in Figure 6.
For comparison, the spectrum when filtered by our shield
is shown in green. The numerical simulation, conducted in
Python with the SpekPy library, incorporates the diamond
window filter. A distinct decrease in differential fluence,
particularly at low energies up to approximately 40 keV is
<figure><img src="image_6.png" /><figcaption>Fig. 5: Images obtained of the target with the tomograph without (a) and with (b) the overlay of the IR image.</figcaption></figure>

observed with the shield. It should be noted that the simulation does not take into account the small hole in the shield.

In the simulation, for the chosen parameters, the attenuation of the shield was found to be approximately 99.99 %.

## V. EXPERIMENTAL RESULTS

In the course of our experiments, two different configurations were considered:

* configuration @: powered microcontroller with the shield at three different positions,

* configuration Ⓔ: unpowered microcontroller with the shield at two different positions.

Each configuration was carried out on different instances of the same microcontroller.

Prior research has already examined the impact of X-rays generated by this tomograph on powered integrated circuits [17], which is why this is the chosen starting point for our experiments. Subsequently, the objective was to ascertain whether it was feasible to inject faults into unpowered integrated circuits using the same experimental apparatus. As described in [10], the fault injection in unpowered integrated circuits has two main implications. Firstly, the obtained faults can be exploited in a persistent fault analysis framework. Secondly, it renders actives protections, such as sensors, unable to detect these injections.

<figure><img src="image_7.png" /><figcaption>Fig. 6: Simulated tomograph spectrum obtained with a tube voltage of 80 kV, a current of 50 µA and a distance of 5 cm with or without shield filtering (W) with a thickness of 1 mm.</figcaption></figure>

In all experiments, the axis origin is taken at the intersection of the bonding wires of the right edge and the bottom edge of the image as illustrated by the white arrows in the Figure 5a. In order to evaluate the possibility of localising the fault injection, several positions are exposed to radiation in each configuration and the target's Flash memory is initially filled with zeroes (i.e. it is fully programmed). Indeed, the objective of the present study is to determine the presence of bitsets, that is to say, the discharge of floating-gate transistors.

### A. Configuration @

In this configuration, the chip is powered during X-ray exposure. Three different positions were tested in this configuration:

* position ①: (x,y)=(0.6 mm, 1.1 mm),

* position ②: (x,y)=(0.6 mm, 1.2 mm),

* position ③: (x,y)=(0.7 mm, 1.2 mm).

The tomograph image obtained at position ② is shown in Figure 7. It can be seen that the image of the chip is much less visible than in Figure 5a because the shield absorbs the incident photons. On the other hand, the hole in the shield is much more visible.

The state of the Flash memory after 80 minutes exposure is shown in Figure 8a. Each dot represents a bit in Flash memory, i.e. a floating gate transistor. White dots represent '0' bits and black dots represent '1' bits. There are 37 faults at the position of the hole in the shield. After 1 hour of exposure at position ②, about ten faults appeared at a new position, as shown in Figure 8b. Irradiation at position ② is conducted subsequent to irradiation at position ①. Finally, the shield was placed at position ③ and irradiation was carried out for 3 hours. The state of the Flash memory is shown in Figure 8c. At the end of the exposure there are approximately 320 faults in the new position of the shield.
<figure><img src="image_8.png" /><figcaption>Fig. 7: Tomograph image of the target with shield at position ②.</figcaption></figure>

<figure><img src="image_9.png" /><figcaption>(a) State of the Flash memory after 80 min exposure at position ①.</figcaption></figure>

<figure><img src="image_10.png" /><figcaption>(b) State of the Flash memory after 80 min at position ① followed by 60 min exposure at position ②.</figcaption></figure>

<figure><img src="image_11.png" /><figcaption>(c) State of the Flash memory after 80 min exposure at position ① followed by 60 min at position ② and 180 min exposure at position ③.</figcaption></figure>

<caption>Fig. 8: States of the Flash memory after X-ray exposures in configuration @.</caption>

From this configuration, it can be concluded that a 1 mm thick shield is effective in localising the fault injection, as all the faults are localised under the hole and no faults are present at any other location under the shield.

Figure 9 illustrates the evolution of the number of faults induced during radiation exposure at position ③ in configuration @, i.e. on a powered device.

<figure><img src="image_12.png" /><figcaption>Fig. 9: Evolution of the number of faults in the Flash memory during exposure at position ③ in configuration @.</figcaption></figure>

It is observable that the initial faults appear for an exposure time of approximately 3,600 s, thus indicating a linear correlation between the exposure time and the number of faults injected. Subsequent to the interruption of the irradiations, the number of faults remains constant at approximately 320 faulty bits.

## B. Configuration @

In this configuration, a new chip is unpowered during the irradiation process. Two distinct positions are subjected to radiation exposure:

* position ①: $(x,y)=(0.6 \text{ mm}, 1.2 \text{ mm})$,

* position ②: $(x,y)=(0.6 \text{ mm}, 1.1 \text{ mm})$.

For position ①, two prolonged irradiations lasting approximately 30 minutes are conducted, whereas for position ②, an initial irradiation of 30 minutes is performed, subsequently followed by multiple shorter irradiations.

The states of the Flash memory following irradiations at the two aforementioned positions is illustrated in Figure 10. The set of faults on the left corresponds to the irradiation at position ①, while the set of faults on the right corresponds to the irradiation at position ②.

<figure><img src="image_13.png" /><figcaption>Fig. 10: State of the Flash memory after 60 min X-ray exposure at position ① followed by 1 h 15 min X-ray exposure at position ② in configuration @.</figcaption></figure>

Following a total exposure of 3,600 s at position ①, i.e. 1 h, approximately 70 faults were observed in a concentrated
<figure><img src="image_14.png" /><figcaption>Fig. 11: Evolution of the number of faults in the Flash memory during exposure at position ② in configuration ⑥.</figcaption></figure>

<figure><img src="image_15.png" /><figcaption>Fig. 12: Evolution of the number of faults in the Flash memory during exposure at position ③ in configuration @ in blue and at position ② in configuration ⑥ in red. The number of faults is expressed on a logarithmic scale.</figcaption></figure>

cluster at position ①. Subsequently, after a second total exposure of 4,500 s, i.e. 1 h 15 min, approximately 65 faults were observed in a concentrated cluster at position ②.

Figure 11 illustrates the evolution of the number of faults induced in the Flash memory as a function of exposure time at position ② in configuration ⑥. Note that no dosimetry was conducted on the tomograph, thus rendering it impossible to represent the evolution of the number of faults as a function of the dose deposited.

### C. Synthesis

The shield, which has a simulated attenuation of 99.99%, effectively shields the target area from X-ray-induced faults except for the part under the injection aperture.

In addition, our findings demonstrate that it is feasible to locate the fault injection resulting from exposure to irradiation on both powered and unpowered devices.

Figure 12 shows the temporal progression of the number of faults in Flash memory at position ③ in configuration @, i.e. in a powered chip, is depicted in blue, while the corresponding data for position ② in configuration ⑥, i.e. in a non-powered chip, is shown in red. It has been observed that single bit faults can be injected into the Flash memory in both configurations. Figure 12 also demonstrates that the initial faults emerge around 3,500 s when the chip is powered and around 2,700 s when the chip is unpowered. The number of faults increases at the same rate for the unpowered target and for the powered target. Furthermore, Figure 12 demonstrates the feasibility of injecting single bit faults into the Flash memory of both powered and unpowered chips by utilising a tungsten shield. As evidenced in Figure 12, the exposure time required for the first faults to appear is of the same order of magnitude for a powered and an unpowered device. This suggests the presence of common underlying mechanisms, whereby the same physical effects occur in both scenarios. In Section II, three distinct mechanisms have been identified as being responsible for the TID effect in FGMOS transistors. The first mechanism, electron-hole pair generation, cannot occur in unpowered devices. However, the two others, the charge trapping and the photoemission, can occur in both powered and unpowered devices. Consequently, it can be deduced that these two phenomena are the root cause of the observed faults in both scenarios.

## VI. DISCUSSION

The results presented in this article are constrained by the absence of a focused X-ray source. This study demonstrated the effectiveness of a localising mask in the containment of fault injections. Despite the success in injecting single bit faults into flash memory of powered and unpowered devices, the ability to select the first faulted bit from those present under the shield hole remains elusive. One area of investigation would be the design of more sophisticated masks or systems with the objective of enhancing this localization. On the one hand, the area of the hole in the shield is approximately 490 µm². On the other hand, a floating gate transistor occupies approximately 0.8 µm². Consequently, around 610 floating gate transistors can be found beneath the hole in the shield and are thus exposed to X-ray radiation. The first faulty bit can be any of the 610 transistors under the hole in the shield.

Furthermore, conventional MOS transistors are employed in the control logic of Flash memories, encompassing functions such as addressing and access transistors, among others. No effect on these transistors was observed in these experiments. In the event that this had been the case, it would have been possible to observe entire faulty columns or rows. It is therefore reasonable to hypothesise that all the access transistors are located at the periphery of the Flash memory. All faults were caused by discharging the floating gate transistors as described in subsection II-B.

## VII. CONCLUSION

The findings of this study highlight the potential of localised X-ray fault injection as a powerful and precise technique for
the assessment of the security vulnerabilities of integrated circuits, with particular relevance to Flash memory in microcontrollers. It has been reported that X-ray irradiation makes it possible to discharge the floating gates of the unit cell transistor of embedded Flash memories. We obtained a bitset fault model and the experiments demonstrated the efficiency of tungsten shields with varying configurations in localising fault injections. The results indicated that a shield thickness of 1 mm is a good parameter for concentrating the injected faults to targeted regions under the experimental conditions outlined in this article. It was also confirmed that the injection of single bit faults was possible, despite the presence of a shield hole that exposed a greater number of floating gate transistors. This represents an advancement in fault injection techniques, enabling the implementation of localised testing without compromising the overall circuit integrity and without requiring a focused X-ray source such as synchrotons. It has been demonstrated that such attacks can be executed on both powered and unpowered devices. In the latter scenario, the target is rendered incapable of detecting and reacting to the attack.

Moreover, this work demonstrates the potential for applying localised X-ray techniques beyond microcontroller Flash memory. It demonstrates the broader implications for testing and evaluating other critical components in hardware systems, such as those used in cryptographic applications. To illustrate, random number generators and other sensitive circuitry in reconfigurable devices, such as FPGAs, could benefit from the precision and insights provided by localised X-ray fault injection.

This study makes a contribution to the development of robust testing frameworks by advancing the understanding of fault injection mechanisms and the role of shielding in enhancing precision. This establishes X-ray fault injection as a practical tool for advancing hardware security and ensuring the resilience of integrated circuits against emerging physical attacks.

## REFERENCES

[1] M. Agoyan, J. Dutertre, D. Naccache, B. Robisson, and A. Tria, "When clocks fail: On critical paths and clock faults," in *Smart Card Research and Advanced Application, 9th IFIP WG 8.8/11.2 International Conference, CARDIS 2010, Passau, Germany, April 14-16, 2010. Proceedings* (D. Gollmann, J. Lanet, and J. Iguchi-Cartigny, eds.), vol. 6035 of *Lecture Notes in Computer Science*, Springer, 2010.

[2] J. Balasch, B. Gierlichs, and I. Verbauwhede, "An in-depth and black-box characterization of the effects of clock glitches on 8-bit MCUs," in *2011 Workshop on Fault Diagnosis and Tolerance in Cryptography, FDTC 2011, Tokyo, Japan, September 29, 2011* (L. Breveglieri, S. Guil-ley, I. Koren, D. Naccache, and J. Takahashi, eds.), IEEE Computer Society, 2011.

[3] L. Zussa, J. Dutertre, J. Clédière, and B. Robisson, "Analysis of the fault injection mechanism related to negative and positive power supply glitches using an on-chip voltmeter," in *2014 IEEE International Symposium on Hardware-Oriented Security and Trust, HOST 2014, Arlington, VA, USA, May 6-7, 2014*, IEEE Computer Society, 2014.

[4] C. O'Flynn, "Fault injection using crowbars on embedded systems," *IACR Cryptol. ePrint Arch.*, 2016.

[5] C. Bozzato, R. Focardi, and F. Palmarini, "Shaping the glitch: Optimizing voltage fault injection attacks," *IACR Trans. Cryptogr. Hardw. Embed. Syst.*, vol. 2019, 2019.

[6] S. P. Skorobogatov and R. J. Anderson, "Optical fault induction attacks," in *Cryptographic Hardware and Embedded Systems - CHES 2002, 4th International Workshop, Redwood Shores, CA, USA, August 13-15, 2002, Revised Papers* (B. S. K. Jr., Ç. K. Koç, and C. Paar, eds.), vol. 2523 of *Lecture Notes in Computer Science*, Springer, 2002.

[7] B. Colombier, A. Menu, J. Dutertre, P. Moëlic, J. Rigaud, and J. Danger, "Laser-induced single-bit faults in flash memory: Instructions corruption on a 32-bit microcontroller," in *IEEE International Symposium on Hardware Oriented Security and Trust, HOST 2019, McLean, VA, USA, May 5-10, 2019*, IEEE, 2019.

[8] A. Menu, J. Dutertre, J. Rigaud, B. Colombier, P. Moëlic, and J. Danger, "Single-bit laser fault model in NOR flash memories: Analysis and exploitation," in *17th Workshop on Fault Detection and Tolerance in Cryptography, FDTC 2020, Milan, Italy, September 13, 2020*, IEEE, 2020.

[9] S. P. Skorobogatov, "Local heating attacks on flash memory devices," in *IEEE International Workshop on Hardware-Oriented Security and Trust, HOST 2009, San Francisco, CA, USA, July 27, 2009. Proceedings* (M. Tehranipoor and J. Plusquellic, eds.), IEEE Computer Society, 2009.

[10] P. Grandamme, P. Tissot, L. Bossuet, J. Dutertre, B. Colombier, and V. Grosso, "Switching off your device does not protect against fault attacks," *IACR Trans. Cryptogr. Hardw. Embed. Syst.*, vol. 2024, no. 4, 2024.

[11] D. Samyde, S. P. Skorobogatov, R. J. Anderson, and J. Quisquater, "On a new way to read data from memory," in *Proceedings of the First International IEEE Security in Storage Workshop, SISW 2002, Greenbelt, Maryland, USA, December 11, 2002*, IEEE Computer Society, 2002.

[12] J. Schmidt and M. Hutter, "Optical and EM fault-attacks on crt-based rsa: Concrete results," in *Austrochip 2007, 15th Austrian Workshop on Microelectronics, 11 October 2007, Graz, Austria, Proceedings*, Verlag der Technischen Universität Graz, 2007.

[13] A. Dehbaoui, J. Dutertre, B. Robisson, and A. Tria, "Electromagnetic transient faults injection on a hardware and a software implementations of AES," in *2012 Workshop on Fault Diagnosis and Tolerance in Cryptography, Leuven, Belgium, September 9, 2012* (G. Bertoni and B. Gierlichs, eds.), IEEE Computer Society, 2012.

[14] G. Cellere, A. Paccagnella, A. Visconti, M. Bonanomi, S. Beltrami, J. R. Schwank, M. R. Shaneyfelt, and P. Paillet, "Total ionizing dose effects in nor and nan flash memories," *IEEE Transactions on Nuclear Science*, vol. 54, no. 4, 2007.

[15] R. Micheloni, L. Crippa, and A. Marelli, *Inside NAND Flash Memories*. Springer Netherlands, 2010.

[16] S. Anceau, P. Bleuet, J. Clédière, L. Maingault, J. Rainard, and R. Tucoulou, "Nanofocused x-ray beam to reprogram secure circuits," in *Cryptographic Hardware and Embedded Systems - CHES 2017 - 19th International Conference, Taipei, Taiwan, September 25-28, 2017, Proceedings* (W. Fischer and N. Homma, eds.), vol. 10529 of *Lecture Notes in Computer Science*, Springer, 2017.

[17] L. Maingault, S. Anceau, M. Sulmont, L. Salvo, J. Clédière, P. Lhuissier, E. Beliard, and J. Rainard, "Laboratory x-rays operando single bit attacks on flash memory cells," in *Smart Card Research and Advanced Applications - 20th International Conference, CARDIS 2021, Lübeck, Germany, November 11-12, 2021, Revised Selected Papers* (V. Grosso and T. Pöppelmann, eds.), vol. 13173 of *Lecture Notes in Computer Science*, Springer, 2021.

[18] P. Grandamme, L. Bossuet, and J.-M. Dutertre, "X-ray fault injection in non-volatile memories on power off devices," in *2023 IEEE Physical Assurance and Inspection of Electronics (PAINE)*, 2023.

[19] S. Bouat, S. Anceau, L. Maingault, J. Clédière, L. Salvo, and R. Tucoulou, "X ray nanoprobe for fault attacks and circuit edits on 28-nm integrated circuits," in *IEEE International Symposium on Defect and Fault Tolerance in VLSI and Nanotechnology Systems, DFT 2023, Juan-Les-Pins, France, October 3-5, 2023* (L. Cassano, M. Psarakis, M. Traiola, and A. Bosio, eds.), IEEE, 2023.

[20] S. Gerardin, M. Bagatin, A. Paccagnella, K. Grürmann, F. Gliem, T. R. Oldham, F. Irom, and D. N. Nguyen, "Radiation effects in flash memories," *IEEE Transactions on Nuclear Science*, 2013.

[21] C. O'Flynn and Z. D. Chen, "Chipwhisperer: An open-source platform for hardware embedded security research," in *Constructive Side-Channel Analysis and Secure Design - 5th International Workshop, COSADE 2014, Paris, France, April 13-15, 2014. Revised Selected Papers* (E. Prouff, ed.), vol. 8622 of *Lecture Notes in Computer Science*, Springer, 2014.