Side-channel suppression for isolated facilities

How it works

Several verification designs place checks on the official links of an AI cluster, for example network taps between accelerators (Network taps and certifiers) ¹. Cankaya points out that these checks only hold if the facility cannot move significant data by some other physical route ¹. Side-channel suppression retrofits an untrusted facility so that any such route has negligible capacity ¹.

Cankaya surveys these classes of physical channel ¹:

• electromagnetic radiation, through the air and through optical fibre;
• airborne acoustics;
• acoustic signals carried through solids and through coolant water;
• signals conducted along power lines and water columns;
• physical access, such as covert devices.

Instead of eliminating every channel, the design accepts a small residual rate, in the single-digit kilobits per second, to keep defence costs manageable ¹. It reasons from information theory: a channel's capacity depends on its bandwidth and its signal-to-noise ratio, so defences either weaken the signal or raise the noise ¹.

The proposed defences, grouped by channel, are ¹:

• Electromagnetic. Sheet-metal enclosures with bent cable conduits, metal barriers between racks, directional radio jamming, and radio sensors that monitor during or between jamming.
• Power lines. Commercial TEMPEST-grade filters.
• Optical fibre. Optical-electrical-optical conversion at the enclosure boundary, and inspection for undeclared optical components.
• Acoustic. Enclosures and air vents that do not face each other, plus air gaps and vibration isolation between and under racks.
• Inspection. Guards, unannounced inspections and destructive teardowns looking for hidden antennae.

What it establishes

If it works as designed, suppression bounds the capacity of unmonitored physical channels out of an enclosure ¹. Other checks can then treat the monitored links as the only significant path for data (Bandwidth limits and compartmentalization, Bounding unexplained information in outputs) ¹.

It does not establish:

• What the computation is. It only makes the other verification layers harder to bypass ¹.
• Zero leakage. The design deliberately tolerates single-digit kilobits per second ¹.

Side-channel attacks on verification hardware itself are a separate concern ⁶. Ansari notes that differential power analysis and electromagnetic attacks on compact cryptographic implementations are within reach of commercially available tooling ⁶.

Threat model

• Adversary. Cankaya assumes a well-resourced, nation-state adversary constrained only by physics ¹. He argues that verification favours the defender because "the attacker loses if caught even once" ¹.
• Physical security. Physical security involves several organizations and includes guards and unannounced inspections ¹.
• Inspection. Inspections of sampled units catch any flaw present, which allows statistical bounds from sampling ¹.

Evidence

Peer-reviewed attacks show that ML hardware leaks information through physical side channels:

• BarraCUDA used correlation electromagnetic analysis to recover parameters of convolutional networks running on NVIDIA Jetson devices ³.
• Kraken extracted parameters from GPU Tensor Core units, and showed that GPU electromagnetic radiation leaks even 100 cm away through a glass obstacle ⁴.
• DeepTheft recovered the structure of DNN models on general-purpose processors through the RAPL power interface, reporting 99.75% Levenshtein-distance accuracy ⁵.

These attacks show leakage, not deliberate covert signalling ^{3 4 5}. Cankaya also surveys published covert-channel demonstrations across the channel classes above ¹.

For suppression itself, the evidence is one paper design ¹. It estimates $35,000–$150,000 per 8-rack scalable unit, about 0.1–0.5% of hardware cost at an assumed $4 million per rack ¹. Cankaya describes it as a first-pass viability study and asks for prototypes and adversarial feedback ¹.

Limitations

• Untested design. It has not been prototyped or red-teamed ¹.
• Supply-chain implants. Hardware implanted in purchased components may evade inspection ¹.
• Openings. Airflow, power cabling and optical links complicate shielding ¹.
• Inspection limits. It is unclear whether destructive teardown favours defender or attacker ¹.
• Cost uncertainty. Filter costs vary widely, and optical conversion depends on the supply of many high-performance transceivers per pod ¹.
• Deterrence assumptions. Keeping sensor capabilities unknown to the prover may deter attacks, but it makes the adversary assumptions hard to test ¹.