AMD introduces Versal devices with silicon-backside attack protection

AMD introduced three Versal tamper-resistant adaptive system-on-chips designed to detect specified physical attacks on the silicon backside. The package-level defense targets security-critical embedded and AI systems, though the opened evidence contains no product-specific independent security test results.

The 2VE3358TR, 2VE3558TR and 2VE3858TR pair a compute die with a sensor-based protection die through 3D active-on-active packaging. AMD says this added die covers the compute silicon’s backside, detects covered attack methods and prevents the system from booting if the protection die is removed or tampered with. The company cautions that the devices are tamper-resistant, not tamper-proof: protection is limited to specified physical attack methods under a product threat model and other limitations.

AMD describes the products as the first adaptive SoC or FPGA family with built-in protection against silicon-backside physical attacks. That industry-first assertion relies on AMD’s own competitive analysis and was not independently established by the opened sources. The evidence also contains no product-specific third-party penetration test, certification, threat-model document or attack-coverage matrix.

A contemporaneous research paper argues that FPGA anti-tamper sensor detection and response mechanisms can be bypassed or affected by temperature, aging and power-delivery behavior. It does not test Versal TR devices or AMD’s backside protection die, so it cannot establish how these products will perform against physical attacks.

The chips also provide hardware acceleration for the ML-DSA and SLH-DSA post-quantum signature algorithms. The National Institute of Standards and Technology identifies those algorithms with FIPS 204 and FIPS 205, respectively. The available sources, however, do not show certification or independent validation of AMD’s implementation.

The devices use AMD’s Versal AI Edge Series Gen 2 computing architecture. AMD advertises up to 229,000 DMIPS, 543,000 lookup tables and 369 INT8 TOPS. Its Gen 2 specifications identify 369 TOPS as a maximum-sparsity figure and list 184 INT8 TOPS for dense workloads on the 2VE3858. The research record includes no independent benchmark for the tamper-resistant devices.

AMD says each TR model has a footprint-compatible standard Versal AI Edge Gen 2 counterpart, allowing a design to move to the security-focused part without repeating synthesis or place-and-route. AMD expects first samples in the second half of 2027 and plans production for the first half of 2028. Those dates are company roadmap targets, not completed availability milestones.