Side-Channel Attack

Measures the precise execution time of cryptographic operations to infer secret keys. Variations in computation time—often caused by branching logic or cache hits/misses—leak information about the data being processed.

• Example: An attacker measures how long an AI accelerator takes to process different inputs, deducing the model's internal weights.
• Key metric: Nanosecond-level precision is often required for exploitation.

Monitors a processor's electrical current draw during computation. Simple Power Analysis (SPA) visually interprets power traces, while Differential Power Analysis (DPA) uses statistical correlation to extract secrets from noisy measurements.

• SPA: Directly observes instruction sequences in a power trace.
• DPA: Correlates power consumption with hypothetical intermediate values to brute-force a key byte-by-byte.

Captures radio-frequency signals emitted by processors and memory buses during operation. These emanations can be picked up with an antenna and software-defined radio, often from several meters away, making it a non-invasive attack vector.

• TEMPEST: The NATO codename for standards protecting against compromising emanations.
• Application: Reconstructing a display screen's content or extracting cryptographic keys from a device's RF emissions.

Exploits the timing difference between a cache hit (fast) and a cache miss (slow) in the CPU's shared memory hierarchy. An attacker process primes the cache, waits for the victim to execute, then probes which cache lines were evicted to infer the victim's data access patterns.

• Spectre & Meltdown: Catastrophic vulnerabilities that weaponized speculative execution to leak arbitrary memory via cache timing.
• Prime+Probe: A classic technique where the attacker fills the cache, then measures which sets the victim displaced.

Analyzes the sound produced by electronic components, particularly capacitors and coils in voltage regulation circuits. The audible or ultrasonic noise emitted by a CPU during intensive cryptographic operations varies based on the key being processed.

• Mechanism: Piezoelectric effects in ceramic capacitors cause them to vibrate and emit sound proportional to the current draw.
• Feasibility: Demonstrated to extract RSA keys from a laptop using a standard smartphone microphone.

A specialized side-channel attack targeting AI accelerators and GPUs. By observing memory access patterns or bus snooping during inference, an attacker can reconstruct the proprietary weights of a deployed neural network without ever accessing the model file directly.

• Target: The high-bandwidth memory (HBM) interface connecting the AI accelerator to its DRAM stacks.
• Impact: Enables complete intellectual property theft of a model trained at a cost of millions of dollars.

A side-channel attack where an adversary measures the time a system takes to perform cryptographic operations or model inference. Variations in execution time can leak secret information, such as private keys or model architecture details. For example, an attacker can measure query response times to infer the depth of a neural network.

• Constant-time programming is the primary defense
• Exploits data-dependent branching in code
• Can be executed remotely against AI inference APIs

A physical attack that monitors a processor's power consumption during computation to extract secrets. Simple Power Analysis (SPA) interprets visual traces directly, while Differential Power Analysis (DPA) uses statistical methods to correlate power fluctuations with data values. In AI systems, this can reveal model weights stored in edge devices.

• Requires physical proximity or compromised power monitoring
• Masking and hiding are key countermeasures
• Particularly dangerous for on-device model deployment

An attack that captures electromagnetic radiation emitted by processors, memory buses, or cryptographic accelerators during computation. Using an antenna and software-defined radio, attackers can reconstruct signals to extract encryption keys or model parameters. TEMPEST is the NATO codename for defending against such compromising emanations.

• Can be executed at a distance without physical contact
• Faraday cages and RF shielding are standard mitigations
• Targets air-gapped AI training infrastructure

A microarchitectural attack exploiting the shared CPU cache to infer sensitive data accessed by a victim process. Landmark variants like Spectre and Meltdown force speculative execution to leak memory across security boundaries. In AI systems, this can expose model weights or training data from co-located cloud tenants.

• Exploits speculative execution hardware optimizations
• Cache partitioning and flushing are key defenses
• Critical risk for multi-tenant cloud inference

A side-channel attack that analyzes sound emitted by electronic components, such as capacitor whine from voltage regulators or keyboard clicks. Researchers have demonstrated extracting 4096-bit RSA keys by listening to a computer's high-frequency coil noise. In AI contexts, acoustic emanations from GPU fans or power supplies can leak operational patterns.

• Uses standard microphones or ultrasonic sensors
• Sound-dampening enclosures are a physical defense
• Demonstrated against laptops and mobile devices

A mathematical framework that injects calibrated statistical noise into model outputs or training processes to bound information leakage. It provides a formal guarantee that an adversary cannot determine whether a specific individual's data was used in training, even with access to all other records. Governed by the privacy budget (ε) parameter.

• ε (epsilon) quantifies the privacy loss
• Gaussian and Laplacian mechanisms add noise
• Defends against membership inference side channels