Skip to content

fix(detector): direction coverage — TIMER_MONKEYPATCH extension to time.* attrs#25

Closed
SinatrasC wants to merge 1 commit into
mainfrom
blue-direction-timing-monkeypatch-kg-red-127
Closed

fix(detector): direction coverage — TIMER_MONKEYPATCH extension to time.* attrs#25
SinatrasC wants to merge 1 commit into
mainfrom
blue-direction-timing-monkeypatch-kg-red-127

Conversation

@SinatrasC

Copy link
Copy Markdown
Collaborator

Summary

Targets KG red #127 under "Direction — Timing monkeypatch". Coverage example for the previously-empty direction; the red was submitted via the direct API path and is currently red_accepted: 1 on the live leaderboard.

Targets red #127 (time module monkeypatch).

This blue: TIMER_MONKEYPATCH extension to time. attrs*.

Local verification

Patch was verified locally against a corpus that exercises:

  • the targeted red (must trigger)
  • the 5 other direction reds (untouched — each has its own paired patch)
  • 5 legitimate corpus cases (plain_kernel, workspace_lazy, shape_dispatch, config_lookup, triton_jit_kernel) — all stay valid
  • classic LAST_CALL_REPLAY (must still be flagged — no regression)

KernelGuard-Red-Submission: 127

…ment

Targets red #127 (Timing monkeypatch direction):

    import time
    def custom_kernel(data):
        setattr(time, 'perf_counter', lambda: 0.0)
        return data.clone()

The existing detect_timer_monkeypatch only catches torch.cuda.Event-side
patching. A host-side timer monkeypatch is the same family of attack at
a different layer — the harness reads time.perf_counter etc. for elapsed
calculations and a stub returning 0.0 lets a 'submission' claim
arbitrary speedups.

Add two regex matchers:
  * 'time.{perf_counter|perf_counter_ns|monotonic|monotonic_ns|process_time|time} = ...'
  * 'setattr(time, '<one of the above>', ...)'

Both emit the existing TIMER_MONKEYPATCH pattern (timing_monkeypatch
family, AUTO_FILTER) with evidence specifying which attribute was hit.
@SinatrasC SinatrasC temporarily deployed to kernelguard-api-control-plane May 1, 2026 18:07 — with GitHub Actions Inactive
@github-actions

github-actions Bot commented May 1, 2026

Copy link
Copy Markdown

KernelGuard Blue Evaluation

@SinatrasC

Copy link
Copy Markdown
Collaborator Author

Thanks for the KernelGuard Flywheel Campaign contribution. This PR is now superseded by the consolidated rule-family implementation in #273, which folds this detector coverage together with the related passing-eval variants.

@SinatrasC SinatrasC closed this Jun 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant