A banking HSM protects its signing keys with a tamper-respondent mesh of fine conductive traces cast into the potting around the key store. Each trace is one leg of a voltage divider:
V_out = V_cc · R2 / (R1 + R2)
trip when V_out ≥ V_th (comparator threshold)
Severing a trace drives R2 toward infinity, pushing V_out toward V_cc — a full severance is always caught, because no threshold below V_cc can miss 100% V_cc. The interesting failure mode is partial cutting: a slow, careful attacker using a conductive shunt can mask a cut trace's signal, but only up to a ceiling set by trace redundancy:
bypass ceiling ≈ 1 − 1/√N (N = independent sensor traces)
If the comparator threshold is set above that ceiling, the alarm cannot fire from a shimmed partial cut — it only trips at the instant of full severance, by which point the attacker already has physical access. If it is set below the ceiling, the comparator trips mid-drill and the HSM has time to destroy the keys first. Once tripped, key-register words are cleared one per clock cycle:
t_zero = W / f_clk (W = 256 key-register words)
Fixed vs. the 3D original: the source engine capped the comparator's simulated ΔV at the bypass ceiling even after full severance (cutFrac ≥ 1), so a threshold set above the ceiling never tripped — silently contradicting its own theory text above ("a full severance is always caught"). This 2D build restores that guarantee: ΔV snaps to 100% the instant the trace is fully severed, regardless of the shim ceiling, so a too-high threshold only delays detection to the moment of full breach — it never defeats it.
This is the same "zeroize-on-intrusion" principle behind FIPS 140-2/3 Level 3–4 tamper-active security boundaries in the HSMs that sign core-banking transactions and SWIFT messages: a threshold set too high for false-positive comfort trades away the response margin that keeps a physically breached module's keys from being extracted.
- Drill / probe speed — how fast the simulated attacker advances and cuts through the potting.
- Sensor-trace density — more independent traces raise the shim-bypass ceiling, narrowing the window a threshold misconfiguration can hide in.
- Comparator threshold — the defender's sensitivity dial: too low risks false trips from vibration/thermal noise, too high risks missing a shimmed breach until full severance.
- Zeroization clock — how fast key material is cleared once the comparator trips.