Timing Attack Mitigation

The foundational defense that ensures all code paths execute in an identical number of processor cycles regardless of secret data values.

• Key principle: Eliminates conditional branches that depend on secret bits
• Implementation: Replaces if (secret_bit) with bitwise operations that compute both paths and select results using masks
• Critical operations: Memory lookups must access identical indices; loops must iterate a fixed count
• Verification: Requires assembly-level auditing, as compilers may optimize away constant-time logic

This technique is mandatory for cryptographic libraries like OpenSSL and libsodium when handling private keys.

A statistical defense that randomizes the internal state of a computation so that timing measurements cannot be correlated with secret values.

• RSA blinding: Multiplies ciphertext by a random value before decryption, then removes the blinding factor afterward
• ECC blinding: Randomizes the projective coordinate representation of curve points before scalar multiplication
• Effect: Each execution produces a unique timing profile even for identical inputs
• Overhead: Typically adds 2-10% computational cost depending on the operation

Blinding is particularly effective against remote timing attacks where attackers collect thousands of samples to average out noise.

A scheduling-based defense that pads all operations to a predetermined worst-case execution time, releasing results only after a fixed interval elapses.

• Mechanism: A hardware or software timer delays the response until the pre-set deadline
• Granularity: Can be applied per-operation or per-request
• Trade-off: Reduces throughput to the slowest possible path
• Use case: Common in smart cards and HSMs where predictable response timing is a certification requirement

Unlike constant-time code, this approach does not require modifying the underlying algorithm, making it suitable for legacy systems.

A class of mitigations that prevent attackers from inferring secret-dependent memory access patterns through CPU cache timing side channels.

• Cache partitioning (CAT): Intel's Cache Allocation Technology dedicates exclusive L3 cache ways to security-sensitive processes
• Preloading: Proactively loads all possible lookup table entries into cache before the secret-dependent access
• Data-independent memory access: Ensures every possible table index is touched regardless of the secret value
• Disabling cache: Used in extreme cases for small kernels, though with severe performance penalties

These defenses are critical for AES and other block ciphers that historically used S-box lookups vulnerable to cache-timing attacks like Prime+Probe.

Physical and architectural defenses that prevent timing side channels by isolating sensitive computation from untrusted observer processes.

• Trusted Execution Environments (TEEs): Intel SGX and ARM TrustZone execute code in encrypted memory regions inaccessible to the OS
• Dedicated security cores: Separate processors handle cryptographic operations with no shared cache or execution units
• Hardware security modules (HSMs): Physically isolated devices that perform all sensitive computation internally
• Constant-frequency operation: Disables dynamic frequency scaling to prevent power/timing correlation

Hardware isolation is the gold standard for FIPS 140-2 Level 3 certification and protects against co-located attackers in cloud environments.

A statistical obfuscation defense that adds random timing jitter or reduces measurement precision to degrade the signal-to-noise ratio for attackers.

• Random delays: Inserts unpredictable pauses (typically microseconds) before returning results
• Timer quantization: Rounds all timing measurements to coarse buckets, reducing resolution
• Effectiveness: Increases the number of samples an attacker needs exponentially
• Limitation: Not a complete defense; must be combined with constant-time primitives

This technique is often implemented in network-facing APIs and browser-based cryptography (WebCrypto) where precise hardware timers are unavailable to defenders.

The foundational software practice of writing algorithms where execution flow and memory access patterns are strictly independent of secret data. This eliminates timing side-channels at the source code level.

• Key Principle: No secret-dependent branches, array indices, or loop bounds
• Implementation: Use fixed-cycle instructions and bitwise operations instead of conditional jumps
• Verification: Requires specialized tools like ctgrind or formal verification to audit compiled binaries
• Challenge: Compiler optimizations can inadvertently reintroduce variable-time behavior, requiring constant-time-aware compilation

A broader class of defenses that eliminate or mask physical information leakage—including timing, power consumption, electromagnetic emanations, and acoustic signatures—from a processor running model inference.

• Power Analysis: Differential power analysis (DPA) correlates current draw with secret data
• EM Emanations: Radio frequency emissions can reveal cryptographic operations
• Cache Attacks: Prime+Probe and Flush+Reload exploit shared CPU cache timing
• Mitigation Stack: Combines constant-time code, hardware shielding, and noise injection

A technique that randomizes the pattern of memory reads and writes during computation to prevent an attacker from deducing the model's data flow or parameters by monitoring the memory bus or cache hierarchy.

• Oblivious RAM (ORAM): Continuously reshuffles memory layout to hide access patterns
• Address Space Layout Randomization (ASLR): Randomizes base addresses at load time
• Cache Partitioning: Isolates sensitive processes into dedicated cache ways to prevent cross-core leakage
• Application: Critical for protecting weight matrix access patterns during transformer inference

The on-the-fly encryption of data traveling between a processor and external memory, ensuring that an attacker physically probing the memory bus cannot capture plaintext model weights or intermediate activations.

• Mechanism: AES-XTS or similar tweakable ciphers encrypt each cache line with a unique tweak
• Hardware Support: Integrated into modern SoCs via memory encryption engines (e.g., AMD SME, Intel TME)
• Performance: Adds minimal latency when implemented in dedicated silicon
• Threat Model: Defends against cold-boot attacks and physical bus sniffing

The deliberate addition of calibrated random perturbations to model weights, gradients, or outputs to degrade the signal-to-noise ratio available to an attacker attempting model stealing or side-channel analysis.

• Timing Noise: Insert random delays or pad execution to a fixed upper bound
• Power Noise: Activate dummy circuits to flatten power consumption profiles
• Output Noise: Add calibrated noise to logits before softmax to obscure exact decision boundaries
• Trade-off: Balances security margin against inference accuracy degradation

A hardware-enforced secure area within a main processor that guarantees the confidentiality and integrity of code and data loaded inside it, isolating model inference from the host operating system and hypervisor.

• Implementations: Intel SGX, AMD SEV, ARM TrustZone
• Enclave Properties: Memory encryption, remote attestation, sealed storage
• Side-Channel Caveat: TEEs do not inherently prevent timing or cache attacks within the enclave
• Defense-in-Depth: Combine TEE isolation with constant-time programming inside the enclave