Side channel
A side channel is an unintended path through which information leaks from a system via observable effects of its operation, such as timing, power consumption, and electromagnetic or acoustic emissions 1.
NIST defines a side-channel attack as one enabled by such leakage from a physical cryptosystem 1.
A covert channel is related but deliberate. Two cooperating parties use an unintended or unauthorized channel to transfer information in a way that violates a system's security policy 1.
Side channels can leak secrets that verification designs aim to protect. BarraCUDA used electromagnetic analysis to recover the parameters of neural networks running on an edge GPU 2. A 2026 MIRI Technical Governance Team post describes microarchitectural side channels as a limitation of trusted execution environments 3.
Covert channels threaten the checks themselves. Another post from the same team describes electromagnetic, acoustic, power-line and fibre-optic channels that could carry data around a data centre's monitored network links. It proposes shielded enclosures, jamming combined with sensing, inspection and filtering, the approach of side-channel suppression 4. The same author's low-trust system design judges that keeping covert bandwidth below kilobits per second is much more achievable than eliminating it 5.
Physical signals can also serve the verifier. Training and inference often differ in accelerator utilization and power draw, which workload classification uses 6.
Related
- Tamper evidence and tamper resistance
- Weight exfiltration
- Trusted execution environment (TEE)
- Compartmentalization
Used in
- R2Bounding unexplained information in outputs
- R1Network taps and certifiers
- R2On-chip telemetry from timing, memory and performance counters⚠
- R1Side-channel suppression for isolated facilities
- R3TEE remote attestation for AI workloads⚠
- R2Workload classification from telemetry and side channels
- R1Low-trust AI compute verification system overview
- Communication between compute groups is bounded
- Declared hardware is idle or shut down
- This compute runs inference, not training
- Model weights have not left the facility
Sources
- ANational Institute of Standards and Technology (2026). NIST Computer Security Resource Center (CSRC) Glossary. NIST Computer Security Resource Center. Source recordSupports: NIST definitions of side-channel attack and covert channel · terms: side_channel_attack (NIST SP 1800-21B; SP 800-63-4); covert_channel (CNSSI 4009-2015; NIST SP 800-53 Rev. 5)
- AP. Horvath et al. (2025). BarraCUDA: Edge GPUs do Leak DNN Weights. 34th USENIX Security Symposium. Source recordSupports: correlation electromagnetic analysis recovers neural-network parameters on an edge GPU device · abstract
- CGloria Z (2026). On TEEs for Privacy-Preserving Monitoring in AI Governance. MIRI Technical Governance Team. Source recordSupports: microarchitectural side channels as a TEE limitation · Limitations
- CN. Cankaya (2026). Suppressing Side Channels in an Untrusted Data Center via Retrofitted Defenses. MIRI Technical Governance Team. Source recordSupports: physical channels could bypass network monitoring; electromagnetic, acoustic, conducted power-line and fibre-optic channels in a data centre; shielded enclosures, jamming with sensing, inspection and filtering as defences · sections on channels and defences
- BN. Cankaya (2026). A System Overview for Near-Term, Low-Trust AI Compute Verification. Machine Intelligence Research Institute. Source recordSupports: suppressing covert bandwidth below kilobits per second judged much more achievable than zero · §5.3.1
- BA. Scher & L. Thiergart (2025). Mechanisms to Verify International Agreements About AI Development. arXiv. Source recordSupports: utilization and power draw often differ between training and inference · Workload classification with high-level chip measures