AMD announces Versal TR devices with a protection die bonded over the silicon backside
Three tamper-resistant Versal AI Edge Gen 2 parts add a sensor die covering the chip backside, post-quantum signature acceleration and new glitch detectors. Samples are due in the second half of 2027.
AMD announced its Versal tamper-resistant (TR) devices on 12 November 2026. The three parts, 2VE3358TR, 2VE3558TR and 2VE3858TR, are versions of the Versal AI Edge Series Gen 2 adaptive SoCs with a second, sensor-based protection die bonded to the compute die using 3D active-on-active packaging. The protection die covers the whole backside of the silicon, detects physical attacks and stops the device booting if it is tampered with or removed. AMD says this makes them the first adaptive SoC or FPGA devices with built-in backside protection, a claim it bases on its own November 2026 comparison of competing parts.
Compute is unchanged from the standard parts: Arm cores, AI Engines and programmable logic, with up to 229,000 DMIPS, up to 369 INT8 TOPS and up to 543,000 LUTs. Each TR device has a footprint-compatible standard counterpart, so a design can be developed on a shipping Versal AI Edge Gen 2 part and moved across without re-running synthesis or place and route. Security additions include hardware acceleration for the ML-DSA and SLH-DSA post-quantum signature algorithms, a hybrid boot flow that accepts several signature schemes, an improved glitch detector plus a new orthogonal detector that watches two voltage rails at once, and a memory element ageing sensor to protect stored keys. Target markets are defence, critical infrastructure, data centre networking and financial technology. Sampling is expected in the second half of 2027 with production in the first half of 2028. A footnote states that tamper-resistant does not mean tamper-proof.
Why it matters
Backside attacks, where an adversary thins the substrate and probes or images the transistors from below, have been the uncomfortable gap in FPGA anti-tamper for years. Shielding the backside with an active die is a packaging answer rather than a logic one, and it is notable that AMD is doing it on a mainstream line rather than a defence-only part. The footprint-compatible development path is sensible. The timeline is long and the threat model lives in documentation you cannot yet read. A paper posted to arXiv the same day argues that on-chip anti-tamper sensors themselves can be bypassed, so wait for the details.