AMD ships tamper-resistant Versal chips against backside attacks

AMD has launched a line of tamper-resistant Versal chips that it says are the first adaptive SoC or FPGA-based products with built-in protection against physical attacks on the silicon backside. The devices, which extend the Versal AI Edge Series Gen 2 range, will sample in the second half of 2027 and enter production in the first half of 2028.

The launch targets a specific and escalating problem: attackers with physical access to a chip can probe or modify the silicon from the backside, where conventional packaging and front-side countermeasures offer little defense. Operators of systems that process sensitive information have flagged physical attacks on chips as a growing concern. Until now, organisations have typically relied on custom combinations of enclosures, application-specific chips and other board-level measures to protect hardware — an approach that adds both cost and design complexity.

AMD's answer is to move the defense into the package itself.

How does the backside protection work?

The new devices use a sensor-based protection die bonded to the main compute die using 3D active-on-active technology. This shields the entire backside of the device. If the protection die is tampered with or removed, the chip refuses to boot.

That architecture matters because it converts what was previously a system-level engineering problem — shielding a chip with external hardware — into a property of the component itself. AMD states the devices are the first adaptive SoC or FPGA-based products to ship with this protection built in, a claim that positions the company ahead of FPGA rivals Xilinx-descended product lines notwithstanding, since Versal itself is the Xilinx lineage now sold under AMD.

The Versal TR line combines this protection layer with the existing processing architecture of the AI Edge family. The devices integrate Arm CPUs, AI Engines, programmable logic, hard IP and connectivity in a single package.

What cryptographic features do the chips carry?

Alongside the backside protection layer, the devices include a broader set of security functions aimed at both current and anticipated attack vectors:

• Expanded hardware acceleration for post-quantum cryptography, with support for the Module-Lattice-Based Digital Signature Algorithm (ML-DSA) and the Stateless Hash-Based Digital Signature Algorithm (SL-DSA).
• A hybrid boot flow that allows multiple signature algorithms.
• An updated application security unit key vault.
• A memory element aging sensor intended to provide extra safeguards for cryptographic keys.
• Enhanced glitch detection.

The post-quantum support reflects preparation for a future in which quantum computers could break today's public-key cryptography. The two signature algorithms named are the standardized approaches the industry is converging on for firmware signing and authentication, and hardware acceleration for them shortens boot times and reduces the engineering burden for developers building systems expected to operate for a decade or more.

The glitch detection changes address attacks that try to disrupt chip behaviour by manipulating electrical conditions — for example, inducing faults at precise moments to bypass security checks. AMD says the new devices combine updates to the existing Versal glitch detector with an additional orthogonal glitch detector, including coverage for glitches occurring simultaneously across two voltage rails. Dual-rail coverage closes a gap: an attacker who can coordinate disturbances on multiple power domains at once previously had a window that single-rail monitoring did not catch.

The memory element aging sensor adds a defense against a subtler class of threat, one aimed at the long-term integrity of cryptographic keys stored on the device.

Which parts are in the range?

The product range will consist of three devices: the 2VE3358TR, the 2VE3558TR and the 2VE3858TR. The parts are intended to offer a common platform for customers with different performance and cost requirements, so a team can design once and select the variant that fits the budget and compute envelope of each deployment.

In performance terms, AMD says the devices deliver:

• Up to 229,000 DMIPS of scalar compute.
• Up to 369 INT8 TOPS of AI inference throughput.
• Up to 543,000 LUTs of programmable logic.

Those figures place the TR parts in the same performance band as the standard AI Edge Series Gen 2 devices, which is the point: AMD is targeting applications that need both strong device-level protection and substantial on-chip processing — defence systems, critical infrastructure, data centre networking and financial technology.

What does design continuity mean for customers?

AMD is also positioning the range around design continuity, and the details here may matter as much as the security features for programmes on long development cycles.

Each tamper-resistant device has a footprint-compatible standard counterpart already available in the Versal AI Edge Series Gen 2 family. Customers can begin development on the existing parts immediately and move to the tamper-resistant versions when they arrive. According to AMD, customers making that transition should be able to do so with minimal effort and without rerunning synthesis or place and route.

That last claim is significant for hardware teams. Rerunning the FPGA implementation flow typically forces re-verification of the entire design — months of work on a regulated programme. If the drop-in claim holds, a defence contractor or fintech developer could prototype today and swap in the protected part without reopening qualification.

The approach directly addresses organisations working on long development cycles in regulated or security-sensitive markets, where certification timelines often stretch well beyond the availability window of any single component generation.

Why did AMD build these chips now?

Kirk Saban, corporate vice president of product, software and solutions at AMD Embedded, outlined the rationale for the launch.

"Protecting critical information requires continued innovation in silicon security capabilities to stay ahead of emerging threats. With Versal tamper-resistant devices, AMD is bringing built-in protection against physical attacks together with high-performance heterogeneous compute in a commercial adaptive SoC, helping customers simplify the development of security-critical systems while maintaining the performance and flexibility their applications demand," he said.

The commercial framing is notable. Backside attack countermeasures have historically lived in specialised, government-grade components. Packaging them into a commercial adaptive SoC family with a standard development flow lowers the barrier for operators of critical infrastructure and financial systems that face physical-access threats but could not justify bespoke silicon.

The long runway to availability — sampling in the second half of 2027, production in the first half of 2028 — tells its own story: customers designing security-critical hardware today can architect around the standard Gen 2 parts now and qualify the tamper-resistant variants as drop-in replacements, with AMD effectively inviting them to lock in that roadmap before the first TR device leaves the fab.

For the wider chip market, the launch signals that physical silicon attacks, long treated as a niche concern for smart cards and payment terminals, now warrant commercial-grade countermeasures across embedded compute — and that post-quantum cryptography support is moving from software libraries into fixed hardware boot paths.