{
  "schema_version": "1.0.0",
  "rubric_version": "1.0",
  "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)",
  "record": {
    "id": "K-0013",
    "slug": "side-channel",
    "title": "Side channel",
    "aliases": [
      "side-channel attack",
      "covert channel"
    ],
    "status": "draft",
    "last_reviewed": "2026-09-23",
    "review_interval_days": 90,
    "steward": null,
    "provenance": {
      "drafted_by": "ai",
      "reviewed_by": []
    },
    "risk_flags": [],
    "flags": [],
    "one_liner": "An unintended path by which information leaks from a system through effects of its operation, such as timing, power draw or electromagnetic emissions.",
    "sources": [
      {
        "source": "S-1600",
        "supports": "NIST definitions of side-channel attack and covert channel",
        "locator": "terms: side_channel_attack (NIST SP 1800-21B; SP 800-63-4); covert_channel (CNSSI 4009-2015; NIST SP 800-53 Rev. 5)"
      },
      {
        "source": "S-0043",
        "supports": "correlation electromagnetic analysis recovers neural-network parameters on an edge GPU device",
        "locator": "abstract"
      },
      {
        "source": "S-0014",
        "supports": "microarchitectural side channels as a TEE limitation",
        "locator": "Limitations"
      },
      {
        "source": "S-0038",
        "supports": "physical channels could bypass network monitoring; electromagnetic, acoustic, conducted power-line and fibre-optic channels in a data centre; shielded enclosures, jamming with sensing, inspection and filtering as defences",
        "locator": "sections on channels and defences"
      },
      {
        "source": "S-0018",
        "supports": "covert side-channel bandwidth target of kilobits per second",
        "locator": "open problems"
      },
      {
        "source": "S-0005",
        "supports": "utilization and power draw often differ between training and inference",
        "locator": "Workload classification with high-level chip measures"
      }
    ],
    "related": [
      "K-0015",
      "K-0022",
      "K-0006",
      "K-0017"
    ],
    "type": "concept",
    "url": "https://trustbutveri.fyi/concepts/side-channel/",
    "source_file": "content/concepts/side-channel.md",
    "flags_all": [
      "ai-drafted"
    ],
    "body_markdown": "A side channel is an unintended path through which information leaks from a system via observable effects of its operation, such as timing, power consumption, and electromagnetic or acoustic emissions [[S-1600]].\n\nA covert channel is related but deliberate: two cooperating parties use an unintended channel to transfer information in a way that violates a system's security policy [[S-1600]]. Side channels can leak secrets that verification designs aim to protect: BarraCUDA used electromagnetic analysis to recover the parameters of neural networks running on an edge GPU [[S-0043]], and a 2026 MIRI Technical Governance Team post describes microarchitectural side channels as a limitation of [[K-0006|trusted execution environments]] [[S-0014]]. Covert channels threaten the checks themselves: another post from the same team describes electromagnetic, acoustic, power-line and fibre-optic channels that could carry data around a data centre's monitored network links, and proposes shielded enclosures, jamming combined with sensing, inspection and filtering, the approach of [[M-0022|side-channel suppression]] [[S-0038]]. One low-trust system design sets its suppression target at covert bandwidths of kilobits per second rather than zero [[S-0018]]. Physical signals can also serve the verifier: training and inference often differ in accelerator utilization and power draw, which [[M-0021|workload classification]] uses [[S-0005]].",
    "body_text": "A side channel is an unintended path through which information leaks from a system via observable effects of its operation, such as timing, power consumption, and electromagnetic or acoustic emissions [S-1600]. A covert channel is related but deliberate: two cooperating parties use an unintended channel to transfer information in a way that violates a system's security policy [S-1600]. Side channels can leak secrets that verification designs aim to protect: BarraCUDA used electromagnetic analysis to recover the parameters of neural networks running on an edge GPU [S-0043], and a 2026 MIRI Technical Governance Team post describes microarchitectural side channels as a limitation of trusted execution environments [S-0014]. Covert channels threaten the checks themselves: another post from the same team describes electromagnetic, acoustic, power-line and fibre-optic channels that could carry data around a data centre's monitored network links, and proposes shielded enclosures, jamming combined with sensing, inspection and filtering, the approach of side-channel suppression [S-0038]. One low-trust system design sets its suppression target at covert bandwidths of kilobits per second rather than zero [S-0018]. Physical signals can also serve the verifier: training and inference often differ in accelerator utilization and power draw, which workload classification uses [S-0005].",
    "referenced_by": [
      {
        "id": "M-0024",
        "title": "Bounding unexplained information in outputs",
        "url": "https://trustbutveri.fyi/mechanisms/bounding-unexplained-information/"
      },
      {
        "id": "M-0013",
        "title": "Network taps and certifiers",
        "url": "https://trustbutveri.fyi/mechanisms/network-taps-and-certifiers/"
      },
      {
        "id": "M-0010",
        "title": "On-chip telemetry from timing, memory and performance counters",
        "url": "https://trustbutveri.fyi/mechanisms/on-chip-telemetry/"
      },
      {
        "id": "M-0022",
        "title": "Side-channel suppression for isolated facilities",
        "url": "https://trustbutveri.fyi/mechanisms/side-channel-suppression/"
      },
      {
        "id": "M-0008",
        "title": "TEE remote attestation for AI workloads",
        "url": "https://trustbutveri.fyi/mechanisms/tee-remote-attestation/"
      },
      {
        "id": "M-0021",
        "title": "Workload classification from telemetry and side channels",
        "url": "https://trustbutveri.fyi/mechanisms/workload-classification-from-telemetry/"
      },
      {
        "id": "I-0012",
        "title": "Low-trust AI compute verification system overview",
        "url": "https://trustbutveri.fyi/implementations/low-trust-compute-verification-system-overview/"
      },
      {
        "id": "C-0008",
        "title": "Communication between compute groups is bounded",
        "url": "https://trustbutveri.fyi/claims/bandwidth-is-bounded/"
      },
      {
        "id": "C-0003",
        "title": "Declared hardware is idle or shut down",
        "url": "https://trustbutveri.fyi/claims/declared-hardware-is-idle/"
      },
      {
        "id": "C-0004",
        "title": "This compute runs inference, not training",
        "url": "https://trustbutveri.fyi/claims/inference-not-training/"
      },
      {
        "id": "C-0009",
        "title": "Model weights or data have not left the facility",
        "url": "https://trustbutveri.fyi/claims/weights-have-not-left/"
      },
      {
        "id": "K-0017",
        "title": "Compartmentalization",
        "url": "https://trustbutveri.fyi/concepts/compartmentalization/"
      },
      {
        "id": "K-0015",
        "title": "Tamper evidence and tamper resistance",
        "url": "https://trustbutveri.fyi/concepts/tamper-evidence/"
      },
      {
        "id": "K-0006",
        "title": "Trusted execution environment (TEE)",
        "url": "https://trustbutveri.fyi/concepts/trusted-execution-environment/"
      },
      {
        "id": "K-0022",
        "title": "Weight exfiltration",
        "url": "https://trustbutveri.fyi/concepts/weight-exfiltration/"
      }
    ]
  }
}