AMD plans Versal chips that block boot after backside tampering

Announced on November 12, 2026, the devices move a layer of physical protection into an adaptive computing chip rather than leaving that work entirely to surrounding hardware. The intended customers operate security-critical systems in defence, critical infrastructure, data-centre networking and financial technology—places where protecting software and network connections is only part of the job.⁠3⁠1

The three devices—2VE3358TR, 2VE3558TR and 2VE3858TR—extend AMD’s Versal AI Edge Series Gen 2 family. These are adaptive system-on-chip devices: they combine processors with programmable hardware that customers can configure for particular applications. The new distinction is a protective layer over the silicon backside, not simply another software security feature.⁠1

According to AMD’s design description, reported by IT Brief Australia, a sensor-based protection die bonds directly to the main computing die through three-dimensional active-on-active technology. It is intended to shield the entire backside. If an attacker tampers with or removes that protection die, the device is designed to refuse to boot. The protective layer is therefore part of the chip’s construction, rather than a separate enclosure around it.⁠1

That addresses a different threat from an intruder reaching a system over a network. An attacker with physical access can target the hardware itself. Operators already use combinations of protective enclosures, application-specific chips and board-level safeguards to protect sensitive information; those combinations can add cost and design complexity. AMD’s proposition is to bring more of that protection into the device doing the computing.⁠1

Integration could make a system simpler to build. It does not, by itself, establish that the finished system is cheaper or more secure than an alternative design. The announcement provides no quantified saving or independent comparison of complete-system protection. The useful question is not whether a separate component disappears, but whether the integrated defence meets the customer’s actual threat model.

AMD calls this the first built-in silicon-backside attack protection in adaptive SoC or FPGA-based products. That is a company claim about a specific category of protection, not evidence that the devices defeat every physical attack. Nor does it mean earlier Versal products lacked security: AMD’s existing security documentation describes defences against side-channel attacks, hardware tampering, firmware alteration and intellectual-property theft. The backside layer extends that approach.⁠3⁠7

The announced security changes also cover cryptographic signatures, key protection and electrical fault attacks. AMD says it is expanding hardware acceleration for Module-Lattice-Based Digital Signature Algorithm, or ML-DSA, and Stateless Hash-Based Digital Signature Algorithm, or SLH-DSA. These are post-quantum digital-signature algorithms; their inclusion does not mean the chip performs quantum computing. Digital signatures help establish authenticity.⁠1

A hybrid boot flow allows multiple signature algorithms. AMD has also updated the application security unit’s key vault and added a memory element aging sensor intended to provide another safeguard for cryptographic keys. These are distinct parts of the security package, not interchangeable descriptions of the backside protection.⁠1

Glitch detection is being expanded too. Glitch attacks manipulate electrical conditions to disrupt a chip’s behaviour. AMD says the design updates the existing Versal detector and adds a second, orthogonal detector, including coverage for glitches occurring simultaneously across two voltage rails. That is a specific capability claim—not a demonstration that every possible electrical fault attack has been eliminated.⁠1

The computing architecture remains central to the pitch. Arm CPUs handle general processing, AI Engines provide specialised arithmetic, and programmable logic lets customers tailor hardware to their workloads. Dedicated hardware functions and connectivity also share the package. Those resources serve different purposes; programmable-logic capacity, processor performance and AI throughput should not be collapsed into one score or mistaken for a measured result in a customer’s application.⁠1⁠5

Kirk Saban, AMD Embedded’s corporate vice president of product, software and solutions, describes the intended benefit as “helping customers simplify the development of security-critical systems while maintaining the performance and flexibility their applications demand”. That is the commercial argument: protection and substantial computing capability together, with less work assembling the surrounding design. Whether it delivers that simplification remains a customer-level question.⁠1

There is a development path before the protected hardware arrives. Each planned tamper-resistant model has a footprint-compatible standard counterpart already available in the Versal AI Edge Series Gen 2 family. Customers can begin work on those standard parts and later migrate to the protected versions.⁠1

AMD expects that transition to require minimal effort and avoid repeating synthesis and place and route—the steps that turn a programmable design into its implemented arrangement on the chip. For organisations with lengthy development cycles, that continuity may be the most immediately useful part of the announcement. But compatibility does not give an existing standard device the new backside protection, and developing an application is not the same as testing that protection.⁠1

The next meaningful milestone is therefore sampling, not production. The second half of 2027 is an expected window for the first devices, not a fixed delivery date or a promise of general availability. Production is planned for the first half of 2028. Neither milestone has been reached in the reporting supporting this announcement.⁠1

The evidence establishes an announced design, not independently demonstrated physical-attack resistance or a TR-specific physical-security certification. Customers still need to see how the protection performs in a complete system. AMD’s idea is consequential because it puts a physical barrier inside the computing device. The test is whether that barrier holds up against the attacks customers actually need to withstand.