Side-channel suppression for isolated facilities

How it works

Several verification designs place checks on the official links of an AI cluster, for example network taps between accelerators (Network taps and certifiers) ¹. Cankaya points out that these checks only hold if the facility cannot move significant data by some other physical route ¹. Side-channel suppression retrofits an untrusted facility so that any such route has negligible capacity ¹.

Cankaya surveys these classes of physical channel ¹:

• electromagnetic radiation, through the air and through optical fibre;
• airborne acoustics;
• acoustic signals carried through solids and through coolant water;
• signals conducted along power lines and water columns;
• physical access, such as covert devices.

Instead of eliminating every channel, the design accepts a small residual rate, in the single-digit kilobits per second, to keep defence costs manageable ¹. It reasons from information theory: a channel's capacity depends on its bandwidth and its signal-to-noise ratio, so defences either weaken the signal or raise the noise ¹. This is a proposed target, not a measured ceiling. A March 2026 Alignment Forum post by joshc argues that residual output bandwidth could carry selected reinforcement-learning rollouts for covert training elsewhere ⁷. That is a different channel from the physical routes Cankaya studies; neither analysis tests whether the proposed physical-channel target is sufficient for a complete verification system ^{1 7}.

The proposed defences, grouped by channel, are ¹:

• Electromagnetic. Sheet-metal enclosures with bent cable conduits, metal barriers between racks, directional radio jamming, and radio sensors that monitor during or between jamming.
• Power lines. Commercial TEMPEST-grade filters.
• Optical fibre. Optical-electrical-optical conversion at the enclosure boundary, and inspection for undeclared optical components.
• Acoustic. Enclosures and air vents that do not face each other, plus air gaps and vibration isolation between and under racks.
• Inspection. Guards, unannounced inspections and destructive teardowns looking for hidden antennae.

AI Security Forum's secure-enclosure sketch suggests using two enclosure layers, one supplied by each party, to reduce bilateral trust requirements ⁸. Inspection by both parties and maintenance access remain open design questions ⁸.

What it establishes

If it works as designed, suppression bounds the capacity of unmonitored physical channels out of an enclosure ¹. Other checks can then treat the monitored links as the only significant path for data (Bandwidth limits and compartmentalization, Bounding unexplained information in outputs) ¹.

Suppression does not show what the computation is, since it only makes the other verification layers harder to bypass ¹. It also does not bring leakage to zero, because the design deliberately tolerates single-digit kilobits per second ¹.

Side-channel attacks on verification hardware itself are a separate concern ⁶. Ansari notes that differential power analysis and electromagnetic attacks on compact cryptographic implementations are within reach of commercially available tooling ⁶.

Threat model

• Adversary. Cankaya assumes a well-resourced, nation-state adversary constrained only by physics ¹. He argues that verification favours the defender because "the attacker loses if caught even once" ¹.
• Physical security. The facility is guarded or monitored, with no unmonitored access and unannounced inspections, possibly by teams drawn from several organizations ¹.
• Inspection. Inspections of sampled units catch any flaw present, which allows statistical bounds from sampling ¹.