Research map / Adversarial robustness and security / Black-box and transfer attacks
Interpreting Emergent Features in Deep Learning-based Side-channel Analysis
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Applies mechanistic interpretability (logit analysis, PCA of activations, activation patching) to MLPs trained for profiled side-channel attacks on masked AES, recovering secret mask shares during sudden performance jumps.
Problem
Deep learning-based side-channel analysis achieves strong attacks but is a black box; evaluators cannot tell how networks exploit leakage from masked implementations, and standard input interventions are unavailable because masks are hidden.
Approach
Study the discrete performance jumps (phase transitions) during training of SCA models, derive features from output logits, locate emergent grid/diagonal structure in principal components of activations, and use activation patching on those PCs to extract secret mask shares without access to masking randomness.
Key results
- On CHES_CTF, activation PCs show a high/low Hamming weight diagonal structure after the first performance jump, and a grid with even/odd parity after a second jump, enabling mask extraction via patching with SNR spikes at mask loading and S-box operations.
- On ESHARD, only one phase transition occurs (around epoch 4) and patching recovers secret-share Hamming weight distributions matching ground truth.
- On ASCAD, a linear probe on the final layer for the two least significant bits achieves 0.64 accuracy and a PI of 2.47 vs 2.58 for the actual model; mask extraction is only partially successful with SNR lower than actual shares.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use a linear probe on final-layer activations to predict 16 classes based on the two least significant bits of S-box input and output | ASCAD MLP · ASCAD | Perceived Information: 2.47 vs. 2.58 | Mixed |
| Use a linear probe on final-layer activations to predict 16 classes based on the two least significant bits of S-box input and output | ASCAD MLP · ASCAD | probe accuracy: 0.64 | Helped |
| Patch components associated with secret-share representations | CHES_CTF MLP · CHES_CTF | causal influence on model outputs | Helped |
| Learn even-odd Hamming-weight distinctions after the second performance jump | CHES_CTF MLP · CHES_CTF | class distinction | Helped |
| Learn high-low Hamming-weight distinctions after the generalization transition | ESHARD MLP · ESHARD | class distinction | Helped |
| Learn even-odd Hamming-weight distinctions | ESHARD MLP · ESHARD | class distinction | Hurt |
| Learn representations of the two least significant input and output bits | ASCAD MLP · ASCAD | bit-probe accuracy | Mixed |
| Patch components associated with input shares in layer 2 | ASCAD MLP · ASCAD | successful intervention | Hurt |
| Patch the analogous input-share structure in layer 1 instead of layer 2 | ASCAD MLP · ASCAD | causal effect on probe outputs | Helped |
| Use the extracted ASCAD share values without further post-processing | ASCAD MLP · ASCAD | share recovery | Hurt |
| Analyze the final ASCAD CNN at epoch 100 as performance increases gradually | ASCAD CNN · ASCAD | feature localization | Mixed |
Surprising findings
- The second CHES_CTF performance jump appears to build on the first, with high/low HW embeddings refined into direct HW embeddings that enable even/odd distinctions.
- ASCAD mask extraction yields only a reasonable clustering: some shares resolve to only two or three classes instead of four, requiring further post-processing.
Limitations
- Only MLPs and one CNN studied; Transformer-based SCA models not analyzed.
- Analysis is manual and requires domain knowledge; attack sets come from the same device as profiling, limiting realism.
- ASCAD mask extraction is incomplete, with lower SNR and cluster count mismatches.
Experimental setup
Datasets: CHES CTF 2018 ESHARD-AES128 ASCAD
Benchmarks: CHES CTF 2018 ESHARD-AES128 ASCAD
Metrics: perceived information probe accuracy signal-to-noise ratio logit distributions entropy between probe and model predictions
Baselines: input visualization (gradient-based saliency) truth table convolutional network Kolmogorov-Arnold network SCA
Builds on: grokking / group operation circuits activation patching Masure et al. learning curve plateau analysis ASCAD benchmark MLP hyperparameters
Closest papers by meaning
- Backdoor Channels Hidden in Latent Space: Cryptographic Undetectability in Modern Neural Networks (NeurIPS 2026 · similarity 0.84)
- Trap-MID: Trapdoor-based Defense against Model Inversion Attacks (NeurIPS 2024 · similarity 0.82)
- AI Models Can Provably Hide Arbitrary Capabilities (NeurIPS 2026 · similarity 0.82)
- Bilinear MLPs enable weight-based mechanistic interpretability (ICLR 2025 · similarity 0.81)
- Transcoders find interpretable LLM feature circuits (NeurIPS 2024 · similarity 0.81)
- Everything, Everywhere, All at Once: Is Mechanistic Interpretability Identifiable? (ICLR 2025 · similarity 0.81)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.