Side channel
An unintended path by which information leaks from a system through effects of its operation, such as timing, power draw or electromagnetic emissions.
A side channel is an unintended path through which information leaks from a system via observable effects of its operation, such as timing, power consumption, and electromagnetic or acoustic emissions 1.
A covert channel is related but deliberate: two cooperating parties use an unintended channel to transfer information in a way that violates a system's security policy 1. Side channels can leak secrets that verification designs aim to protect: BarraCUDA used electromagnetic analysis to recover the parameters of neural networks running on an edge GPU 2, and a 2026 MIRI Technical Governance Team post describes microarchitectural side channels as a limitation of trusted execution environments 3. Covert channels threaten the checks themselves: another post from the same team describes electromagnetic, acoustic, power-line and fibre-optic channels that could carry data around a data centre's monitored network links, and proposes shielded enclosures, jamming combined with sensing, inspection and filtering, the approach of side-channel suppression 4. One low-trust system design sets its suppression target at covert bandwidths of kilobits per second rather than zero 5. Physical signals can also serve the verifier: training and inference often differ in accelerator utilization and power draw, which workload classification uses 6.
Related
- Tamper evidence and tamper resistance
- Weight exfiltration
- Trusted execution environment (TEE)
- Compartmentalization
Used in
- R2Bounding unexplained information in outputs
- R1Network taps and certifiers
- R2On-chip telemetry from timing, memory and performance counters⚠
- R1Side-channel suppression for isolated facilities
- R2TEE remote attestation for AI workloads⚠
- R2Workload classification from telemetry and side channels
- R1Low-trust AI compute verification system overview
- Communication between compute groups is bounded
- Declared hardware is idle or shut down
- This compute runs inference, not training
- Model weights or data have not left the facility
Sources
- ANational Institute of Standards and Technology (2026). NIST Computer Security Resource Center (CSRC) Glossary. NIST Computer Security Resource Center. Source recordSupports: NIST definitions of side-channel attack and covert channel · terms: side_channel_attack (NIST SP 1800-21B; SP 800-63-4); covert_channel (CNSSI 4009-2015; NIST SP 800-53 Rev. 5)
- AP. Horvath et al. (2025). BarraCUDA: Edge GPUs do Leak DNN Weights. 34th USENIX Security Symposium. Source recordSupports: correlation electromagnetic analysis recovers neural-network parameters on an edge GPU device · abstract
- CGloria Z (2026). On TEEs for Privacy-Preserving Monitoring in AI Governance. MIRI Technical Governance Team. Source recordSupports: microarchitectural side channels as a TEE limitation · Limitations
- CN. Cankaya (2026). Suppressing Side Channels in an Untrusted Data Center via Retrofitted Defenses. MIRI Technical Governance Team. Source recordSupports: physical channels could bypass network monitoring; electromagnetic, acoustic, conducted power-line and fibre-optic channels in a data centre; shielded enclosures, jamming with sensing, inspection and filtering as defences · sections on channels and defences
- BN. Cankaya (2026). A System Overview for Near-Term, Low-Trust AI Compute Verification. Machine Intelligence Research Institute. Source recordSupports: covert side-channel bandwidth target of kilobits per second · open problems
- BA. Scher & L. Thiergart (2025). Mechanisms to Verify International Agreements About AI Development. arXiv. Source recordSupports: utilization and power draw often differ between training and inference · Workload classification with high-level chip measures