Learning to Localize Leakage of Cryptographic Sensitive Variables
Authors: Jimmy Gammell
Anand Raghunathan
Abolfazl Hashemi
Kaushik Roy
Venue: Accepted by TMLR ()

Abstract: While cryptographic algorithms such as the ubiquitous Advanced Encryption Standard (AES) are secure, *physical implementations* of these algorithms in hardware inevitably `leak' sensitive data such as cryptographic keys. A particularly insidious form of leakage arises from the fact that hardware consumes power and emits radiation in a manner that is statistically associated with the data it processes and the instructions it executes. Supervised deep learning has emerged as a state-of-the-art tool for carrying out *side-channel attacks*, which exploit this leakage by learning to map power/radiation measurements throughout encryption to the sensitive data operated on during that encryption. In this work we develop a principled deep learning framework for determining the relative leakage due to measurements recorded at different points in time, in order to inform *defense* against such attacks. This information is invaluable to cryptographic hardware designers for understanding *why* their hardware leaks and how they can mitigate it (e.g. by indicating the particular sections of code or electronic components which are responsible). Our framework is based on an adversarial game between a classifier trained to estimate the conditional distributions of sensitive data given subsets of measurements, and a budget-constrained noise distribution which probabilistically erases individual measurements to maximize the loss of this classifier. We demonstrate our method’s efficacy and ability to overcome limitations of prior work through extensive experimental comparison on 6 publicly-available power/EM trace datasets from AES, ECC and RSA implementations. Our PyTorch code is available at https://github.com/jimgammell/learning_to_localize_leakage.

Published in Transactions on Machine Learning Research (03/2026)
Learning to Localize Leakage of Cryptographic Sensitive Variables
Jimmy Gammell Anand Raghunathan figammell, araghu, abolfazl, knushikk @ppurdue.eds edu
Abolfazl Hashemi
Kaushik Roy
Elmore Fomily School of Electrical and Computer Engineering, Purdue Universily
Reviewed on OpenReview:
https: // openreview. net/ forun?? id= 9g2CSUBnD0e
Abstract
While cryptographic algorithms such as the ubiquitous Advanced Encryption Standard (AES) are secure, physical implementations of these algorithms in hardware inevitably 'leak' sensitive data such as cryptographic keys. A particularly insidious form of leakage arises from the fact. that hardware consumes power and emits radiation in manner that is statistically associated with the data it processes and the instructions it executes. Supervised deep learning has emerged as a state-of-the-at tool for carrying out side-chammel atlacks, which exploit this leakage by learning to map power/radiatee to the sensitive data, operated on during that encryption. In this work we develop a principled deep learning framework for determining the relative leakage due measurements recorded at different points in time, in order to inform defense against such attacks. This information is invaluable to cryptographic hardware designers for understanding why their hardware leaks and how they can mitigate it (c.g. by indicating the particular sections of code or electronic components which are responsible). Our framework is based on an adversarial game between a classifier trained to estimate the conditional distributions of sensitive data given subsets of measurements, and a budget-constrained noise distribution which probabilistically crases individual mcasurements to maximize the loss of this classifier. We demonstrate our method's eflicacy and ability to overcome limitations of prior work through extensive experimental comparison 6 publicly-availably power/EM trace datasets from AES, ECC and RSA implementations. Our PyTorch code is available here.
measurements throughout encryption
1 Introduction
The Advanced Encryption Standard (A Daemen & Rijmen 1999 2013 is widely used and trusted for protecting sensitive data. For example, is approved by the United States National Security Agency for protecting top secret information (Committee on National Security Systems (003),, is a major component. (TLS) protocol (Rescorla] 2000) which underlies the security of HTTPS
of the Transport Layer Security (Rescorla, 2000), and it is used in payment card readers to secure card information before transmission financial institutions (Bleffin Payment Systems
2023
AES aims to keep data secret when it is transmitted over insecure channels that are accessible to unknown and untrusted parties (e.g. via wireless transmissions which may be intercepted, or storage on hard drives accessible to untrusted individuals). Prior to transmission, the data is first encoded and partitioned into a sequence of fixed-length bitstrings called plaintents. Fach plaintext then encrypted into ciphertent by applying an invertible function from a family of functions indexed by an integer called cryptographic key. This family of functions is designed so that if the key sampled uniformly at random, then the plaintext and ciphertext are marginally independent. The key is known to the sender and intended recipients of the transmission, and is kept secret from potential cavesdroppers. Thus, the intended recipients can use the key
For clarity of exposition we discuss AFS here, but our technique also applies other algorithms.

---

Published in Transactions on Machine Learning Research (03/2026)
to decrypt the ciphertext back into the original plaintext, while eavesdroppers who possess the ciphertext but not the key learn nothing about the plaintext.
Clearly, such an algorithm is effective only if the cryptographic key remains outside of the hands of attackens AES is believed to be "algorithmically secure' in the sense that it is infeasible to determine the cryptographic key by exploiting its intended inputs and outputs: plaintexts and ciphertexts (Mouha 2021: Tao Wu 2015). Despite this, physical émplementations of AES in hardware 'leak' information about their cryptographic keys. This phenomenon, called side-channel leakage, occurs because hardware inevitably emits measurable physical signals that are statistically associated with the data it processes and the instructions it executes (Mangard ct al., 2007j. There are many diverse physical side-channels which can lcak, such as program, poggram/oprre /operation execution time (Kocher 1996 Lipp et al. 2018 Kocher et al., 2019), temperature (Hutter & Schunidt, 2014), and sound due to vibration of electronic components (Genkin et al. 2014j. In this work the side-channels we consider are power and electromagnetic (EM) radiation over time (Kocher et al.] 1999. Mangard et al., 2007p, which are major sccurity vulnerabilities for AES implementations (Genkin et al.] 2016 Bronchain & Standaert 2020).
Side-channel attacks exploit this leakage to break cryptographic implementations by revealing secret internal variables such as cryptographic keys. In this work we consider profiling side-channel attacks (Chari et al. 2003 Mangard et al. 2007), which assume a worst-case scenario where the attakr possesses a clone of the target device and can repeatedly measure its power/radiation over time while encrypting arbitrary plaintexts using arbitrary keys. These sequences of nower/radiation measurements are recorded as real vectors called traces, where each element encodes a measurement at a fixed point in time relative to the start of encryption. The attacker can thereby gather data from the clone device to model the conditional distribution of the secret variable given trace. They can then defeat the target device by measuring its power/radiation traces, feeding them to the model, and revealing its secret internal variables.
Supervised deep learning has emerged as a statc-of-tho-art technique for this modeling task, achieving comparable or superior performance to prior approaches while requiring far less data preprocessing and
feature selection (Maghrebi et al. 2016 Benadjila et al. 2020 Zaid et al., 2020 Wouters et al.
2020 Lu et al.
2021
Bursztein et al.) 2023). Older non-deep learning attacks were mostly based on parametric statistics and
had major limitations such restrictive modeling assumptions (Messerges) 2000 Chari et al.
2003 Agrawal
et al.] 2005 (Schinllr et al. 2005 Hospodar et al., 2011) and inability to scale to long traces (Chari el al.
2003
Archambeau et al.) 2006). Deep learning overcomes these limitations and consequently poses a major
and growing threat to a wide assortment of security measures and evaluations that were designed with the limitations of older attacks in mind.
In this work, we soek to leverage deep learning to defend against side-channel attacks by identifying specific points in time at which power/radiation measurements leak sensitive data. Our aim is to aid the designers of implementations in understanding why their implementations leak (e.g. by indicating the particular sections of code or electronic components which are responsible) and thereby enable targeted mitigation of the leaks. Our key contributions arc:
We propose principled information thcoretic quantity which mcasures the 'leakiness' of individual power/EM radiation measurements. Unlike prior approaches, ours is sensitive to arbitrary statistical associations between a chosen secret variable and subsets of measurements. Our quantity is implicitly defined through a constrained optimization problem.
We propose a novel deep learning algorithm called Adversarial Leakage Localization (ALL) which approximately solves this optimization problem. ALL is based on an adversarial game played between a neural net 'attacker' trained to classify secret data using power/rate erwerdriaiiiin traces, and a budget- constrained noise distribution trained to 'defend' against the attack by introducing noise to individual measurements in the traces. Due to the budget constraint, noise cannot be added everywhere and must be rationed for the leakiest measurements. After training we can thereby surmise the leakiness of each measurement from its noisiness.
We compare ALL with 11 baseline methods on 6 publicly-availabe power and EM radiation side- channel leakage datasets from implementations of the AFS, ECC, and RSA eryptographic standards.
2

---

Published in Transactions on Machine Learning Research (03/2026)
Side channel leakage
Side channel attack
Dataset D
PXY
Key
Sensitive intermediate variable
Y PY
Ciphertext
Known function
Plaintext
Supervised leurning
Cryptographic hardware
Power trace
M
X Pxly
Measurement apparatus
X ~ px
pv|x X)
Power
source
Figure 1: Diagram illustrating our probabilistic framing of side-channel leakage in the special case of power side-channel leakage from a symmetric-key (e.g. AFS) cryptographic implementation. A cryptographic device consumes power over time while encrypting data. The power consumption leaks the secret key because it is stalistically associated with key-dependent internal variables. Our work considers profiling side-channel attacks, a worst-case scenario where attackers can freely model the relationship between an implementation' 's secret data and its power consumption over time, then use this model to attack the same device.
To our knowledge this is by far the most comprehensive and quantitative comparison of leakage localization algorithms which has been done, and we release our code and procedure in the hope of facilitating reproducibility and benchmarking of future work in this area.
2
Background and Setting
See Table [ for a summary the important notation we will use throughout the rest of the paper. Our setting standard in the context of profiling power/EM side-channel analysis (Chari et al. 2003 Mangard ltt al. 2007) and is illustrated in Fig. 1 We assume have a cryptographic device which encrypts data in a manner dependent on secret variable y E Y, where Y is finite set (e.g. consisting of bitstrings encoding all possible values of the variable). We assume to have some measurement apparatus that allows us to measure the power consumption FM radiation throughout encryption. We view the resulting measurement sequences as vectors E RRT, called traces, where T E Z++ denotes the number of measurements per trace. We view the secret variable as a random variable Y ~ py where py is a simple (e.g. uniform) distribution under our control. The resulting trace X Y Pxix distribution dictated by factors such as the hardware, environment, and measurement setup. Here cach element X, of the random vector X (X1,..., Xx) represents power/radiation measurement at fixed point in time relative to the start of eneryption. In this work assume that the distributions px,y(: (: y) exist and have full support for all E Y, which is reasonable because empirically power consumption usually has 'random' component which is well-described by additive Gaussian noise (Mangard et al. 2007 Most i.i.. profiling side-channel attacks amount to collecting a dataset D ~ PX, and using supervised (deep or otherwise) learning to model Pr|x-
Pxiy then comes from complicated and a priorí unknown
Given these jointly-distributed X, Y, we seek to define for each X, a scalar quantifying its 'leakiness, i.e. the extent to which can be exploited by attackers to learn from X. Towards this end is useful to consider the Shannon conditional mutual information (Shannon
1948)
II: S] = [logPrix,s(Y* X,, S) - log PY [S]] S (X Xrr {X.).
(1)
Intuitively, T[; X₂ S] tells us the extent to which our uncertainty about Y is reduced upon observing X provided we have already observed the elements of
Each individual quantity I[Y: Xx S] tells us something about the leakiness of X₁. However, for each there are 27'1 such quantities, and it is not obvious how they should be combined into single scalar. Clearly,
3

---

Published in Transactions on Machine Learning Research (03/2026)
Table 1: A summary of the important quantities and variables used throughout this work.
Notation
Explanation
PA. Paja, etc.
Probability distribution of random variable A, conditional distribution given B, etc.
E B B), EA B(
Expocted value of f(A, B) (left: over all raudomness, right; over randomuess of A)
[[ B CJ
Conditional mutual information between A and B given C
TE 344
Number of measurements/ ttatmeeeeeeettttstttssss timeeteps in power trace
Xr) ER X (XI....,
Power trace (random variable) consisting of T messurements Secret data (random variable) from finite set. Y (e-g. Y = (0, 10...,,,..55 for uint8 Y)
Y E Y
y (?I....?77) (T) 10.
Occlusion probabilities, where "v denotes probability of occluding X;
Ce R++
Budget for occlusion probubility vector, which incurs cost Σx d(1)) Re-parameterized version of C' which is less-sensitive to dataset Occlusion mask (random variable), where Pro = =
7 == C/(C +T)
T) E (0,
A,- = (Ag...... .A.r) c 10,
o Ag ERR
Occluded trace (elementwise product of trace and occlusion mask)
4 X E,) 10
Predicted distribution of secret data given occluded trace and mask, by classifier w/ weights A
X, should be considered leaky if I[; X,) > 0 and non-lcaky if IY; X, S]= 0 VS. Morc-subtly, there are many practical scenarios in which have second-order leakage, where I[Y; X.] 0 but I[Y; Xe] > 0 for some t' * t (i.e. X2 alone reveals nothing about Y. but reveals something useful about Y when combined with x- For example, many cryptographic implementations use a Boolean masking countermeasure (Chari le al. 1999 Benadjila et al. 2020) whereby a sensitive variable is decomposed into a pair of independent "random shares' which are operated on at distant points time. Hence, the naïve choice of I[;; Xx] as our definition of the leakiness of X, would not work.
Another naive choice would be define the leakiness of X, as X[ (X1....,.p))) \ (X+Hl- This addresses the insensitivity of I[[; Xz] to second-order leakage. However, it introduces new shortcoming: when there [X,]] se 0
are many leaky measurements with 'redundant' information, we may have I[;;; {XI,..., even if I[Y; x,) > O. In other words, X, has little new information about Y which is not already provided by the other measurements. As we will show, this phenomenon creates issues for many prior deep learning- based leakage localization algorithms.
We will subsequently propose natural notion of leakiness which is sensitive to all the quantities described by Eqn. I Before we do so, let consider relevant prior work and its limitations.
3 Existing work and its limitations
We consider prior work in the side-channel analysis literature which may be leveraged for leakage localization. One prominent category of such work is parametric statistics- based methods which use non-deep learning techniques to look for pairwise associations between the measurements X, and Y. The other is neural net allribulion- methods, where 1) a profiling side-channel attack is carried out with supervised deep learning, and 2) the neural net is 'interpreted" to determine the relative importance of its input features. Refer to Appendix C for further dotails.
3.1 First-order parametric statistics-base based methods
First-order parametric statistics- based methods (Mangard et al. 2007 Chari et al., 2003 Brier et al.] 2004 are widely used for understanding lcakage due to their simplicity, interpretability, and low computational cost. However, these cannot detect leakage of order or higher, and make restrictive assumptions about the relationship between X and Y. Thus, such methods are ill-suited to work's 'black-box leakage localization setting where we make minimal assumptions about the cryptographic implementation being evaluated.
In practice, leakage mitigation will likely be done in a 'white-box' setting where hardware designers understand the implementation and have access to its internal variables. In this setting, thoder leakage can often be decomposed into first-order leakage of 2 n internal variables, which can then be localized individually with first-order mothods. However, such analysis is aroorprronc and relies on careful analysis of the implementation. For example, Benadjila al. (2020) released the second order-leaking ASCADv 1-fixxed dataset. and analyzed
4

---

Published in Transactions on Machine Learning Research (03/2026)
its leakage by decomposing it into 2 pairs of first-rrder-lakking internal variables. Subsequently, Egger et al. (2022) noted additional internal variables which contribute to leakage but were missed in the initial analysis. We view black-box deep learning- based methods such as ours as complementary with parametric white- analysis: the latter provides an interpretable and hyperparameter-Free assessment of known-loaky internal variables, while the former can detect leakage stemming from both known and unknown sources.
3.2 Neural net attribution- based methods
There is a great deal of prior work on localizing leakage by applying interpretability techniques to neural nets which have been trained to perform side-channel attacks (Masure et al.
2019 Hettwer et al. 2020 Jin
ee al. 2020: Zaid et al. 2020; [Wouters et al. 2020 van der Valk et al. 20221 Golder el al.) 2022 Li et al.
2022 Perin et al. 2022: Schamberger et al. 2023 Yap et al.) 2023 Li al.) 2024 Yap et al.) 2025). Most
of these techniques can be summarized as follows: 1) use standard supervised deep learning techniques to train model P R Py x using data, and 2) use interpretability techniques to estimate the influence of each input feature on the model, on average over the dataset. For example, the Gradient Visualization (GradVis)
technique of Masure et al. (2019) estimates the leakiness of Xt by Ex,y a logā(Y |=)|==x -x and the - 1,) C X)] where I, denotes column & of the identity matrix. this work we consider as baselines the recent OcePOT method
1-Occlusion technique of Heltwer et al. (2020) estimates it as Σx,y [0(Y x)- - 1 (1-
Yap et al., 2025). the m-Ocelusion and 2"d-order m-Occlusion techniques (Schamberger et al. 2023 as
well as GradVis Vis Masure et al. 2019), Saliency (Simonyan et al. 2014
Hettwer et al.] 2020), 1-Occlusion
Zeiler & Fergus
2014
Hettwer el al. 2020), LRP (Bach et al.) 2015 Hellwer et al. 2020 and Inpul *
Grad (Shrikumar et al.
2017 Wouters et al. 2020). Note that these subsume the deep learning basclines
considered by Yap et al. (0025); Schamberger et al. (2023).
Most of these methods are prone to detecting only some leaking measurements while ignoring others. GradVis, Saliency, 1-Occlusion, LRP and Input Grad compute the leakiness of X, by occluding or differentiating the input de to p(Y
X Xet1y..., XT) and observing its change in output. However, discussed in Sec. 2. when many of the measurements carry 'redundant information, one may have I[Y; X, constant with respect to 2t, causing these methods to spuriously estimate low leakiness for X,.
[X,]] }
R O even if I[;; X,) > 0. In this case well-fit P becomes essentially
While m-Occlusion, 2nd m-Occlusion, and OcePOI occlude multiple inputs simultaneously and are thus less-susceptible to this issue, they have their own shortcomings. m-Occlusion is like 1-Occlusion except that it occludes m-diameter windows rather than single points, which has an undesirable smoothing effect and is helpful only when the 'redundant' measurements are temporally-local. 2nd-order m-Occlluion entails occluding all pairs of windows, which is expensive because it requires ( passes through the dataset with the neural net. Additionally, while it provides the interesting and unique ability to discern whether leakage is first-order or second-order, we find that it gives little improvement over m-Occlusion when adapted to estimate the leakiness of a single point. Unlike the other considered methods, OccPOI does not assign a leakiness estimate to every measurement. Rather, it is a heuristic which aims to identify a non-unique minimal-cardinality set of measurements sufficient for P to attain some classification performance when all other measurements are occluded. Additionally, it is expensive because it requires Q(T)) non- non-parallelizable passes through the dataset with the neural net.
4 Our method: Adversarial Leakage Localization (ALL)
Here we propose a novel algorithm called Adversarial Leakage Localization (ALL) for localizing leakage which addresses the shortcomings of prior work. In line with Sec. [ we have dointly-distributer power Twer/EM /EM radiation traces X = (Xi...., .x) and secret data Y. We seek to define for each X, a scalar quantifying its 'leakiness,' Lee its usefulness to attackers for learning Y from X.
Intuitively, ALL is based on an adversarial game played between a neural net 'attacker' trained to predict Y from X, and a budget-constrained noise distribution trained to 'defend' against the attack by introducing noise individual measurements to maximize the loss of the classifier. Because of the budget constraint, increasing the noise applied to one measurement requires reducing the noise of other measurements. Thus,
5

---

Published in Transactions on Machine Learning Research (03/2026)
noise cannot simply be applied everywhere, and must be 'triaged' so that leakier measurements get more noise. After training we can surmise the leakiness of measurement from the amount of noise which has been applied to it.
In this section we first propose a constrained optimization problem which implicitly defines a notion of 'leakiness' which is sensitive all the terms I[ Xx S]: S (X Xr) (X.). We then derive ALL as a practical deep learning algorithm which approximately solves this optimization problem. We conclude by explicitly contrasting ALL with prior work. Refer to Appendix D for extended version of this section with proofs and derivations, and Algorithm 2 for pseudocode.
4.1 Implicit definition of leakiness through constrained optimization problem
We define vector 7 [0, 1)" which we name the occlusion probabilities. Y parameterizes distribution over binary random vector with range {0, 13 which we call the occlusion mask: A, (Ay.1..... Ay,r) ~ -AAy Aq ~ Bernoulli(1 - >))). For arbitrary vectors a E R², E {0, 13", let us denote I& = (zz :f 1...., T 0; = 1), iee. the sub-vector of æ containing its elements for which the corresponding element of a is 1. We can accordingly use A, to obtain random sub-vectors XA, of X. Note that 7/ denotes the probability that X, will not be an element of XA.
We assign to each element of y a strictly-increasing 'cost' e: (0, RR+ : - with the properties <(0)= and lim c(x) co. We sook to solve the constrained optimization problem
min 1)(
XA, A,y such that Σ d(m)) =
(2)
where C R++ is a 'budget' hyperparameter. Intuitively, the mutual information term tells us the extent to which the 'occluded' trace XA, 'leaks' Y, and y is optimized to distribute fixed 'budget of occlusion probability' among the individual elements of X to minimize this leakage.
As discussed in Appendix D.1 during this optimization process each % is 'pushed' up towards 1 in proportion to a weighted sum over all values 1[Y; Xx S] S C (X,...,, Xr3 \ {Xe). Thus, ALL is sensitive to all associations between Y and subsets of [X1.... }. This in contrast to parametric methods which consider only pairwise associations between each X, and Y, methods like 1-Occlusion, GradVis, Saliency, Input * Grad and LRP which are sensitive associations between and the sets ; (X,....,X7 {Xe), and OccPOI, m-Occlusion, and 2nd-or m-Occlusion, which consider larger yet still tiny subsets of the power set of (T).
Due to the budget constraint, increasing requires reducing other Yr T o t. Let us denote by Y a solution to Equ. 2 Each ri will be closer to 1 if X, is 'leakier' in the sense that it has greater mutual information with Y, conditioned on other X,, T * Thus, we propose using of to measure the 'leakiness' of X₃.
4.2 Deep learning- implementation
We will now re-frame this problem in a way that is amenable to standard deep learning techniques. Refer to Fig. 2 for a diagram.
We first re- re-parameterize into an unconstrained problem by defining the variable n softmax (n), , n RT and letting 7 be function from R [0, 11T satisfying
c()) On + (ñ) = sigmoid(log C' + log(softmax(m)))..
(3)
We can now optimize with respect to rj instead of 7, letting us drop the constraint because it is satisfied for any n.. Note that it is cheap and mumerically-stabbe
map n to 7 in PyTorch.
Next, as described in Appendix D.2 we can approximate the mutual information term of Equ. 2 with neural net. Note that XA, A.
Exe( PA, (A)(a) X[] where each I[Y; = E loggyy PY| xx (Y
Xa) Elog Py (Y). The right terms can be dropped because their corresponding terms the full expression do not depend on 7. The conditional distributions in the left. terms can each be approximated by using

---

Published in Transactions on Machine Learning Research (03/2026)
Noise distribution ('Defender): applies multiplicative binary noise
Trace: side-channel (e.g.
power, radiation)
71
Ar.1
measurements over
X1
w/ prob. 1 w/ prob.
~ Moo
L0
X1
Classifier ('Attacker')) noise- conditional neural net predicts secret variable from trace
Secret variable.
egg. oryptographic key
7/8
A
X,
w/ prob. w/ prob.
Y
X,
4
Predicted distribution over secret variable
Y7
AyT
Xx
w/ prob. 1 70 w/ prob. "
XT
θ
Learned occlusion probabilities
Occlusion mask
Neural net weights
A diagram illustrating Adversarial Leakage Localization (ALL) algorithm. A classifier Dg is trained to 'attack' a cryptographic implementation by predicting its secret data Y from power/EM radiation traces x=
Figure 2:
Simultaneously, a noise distribution is trained to 'defend against the attack' by occluding the classifier's individual input features X₂ with probabilities 7t subject to a budget constraint which prevents trivially occluding every feature with probability 1. Because of the const increasing " necessarily entails decreasing "/ for some T # t, so the noise distribution must preferentially apply noise leakier foatures. Thus, after training we may interpret " the 'leakiness' of X,.
supervised deep learning with cross-entropy loss to classify Y from Xa- There are 2 such distributions and it would be infeasible to train this many neural nets independently. Instead, similarly to Lippe et al. (2022). we train single neural net to estimate all the distributions by occluding its imputs according to Ay and feeding Ay as auxiliary input. Thus,
approximate Eqn. with the optimization problem
min max NER? BER*
Ladv 0) = Eog do (Y X Aym. Aym)
(4)
where to Y YXRR,, x (0.1)² 10 is neural net with weights O and softmax output activation, and Do(y x @ a, a) denotes its estimated probability that Y = given Xa aa. This can be approximately solved using alternating SGD-style algorithms, similarly to GANs (Goodfellow et al. 2014).
To use SGD-like algorithms we must estimate VoLadv 0) and V,ffavv 0) with Monte Carlo integration. The former routine in the context of DNN training. However, the latter is nontrivial because Ladv has the form Ea-pa f(x) where is discrete. There is large body of work gradient estimation for functions of this nature, which can broadly be categorized into unbiased REINFORCE (Williams) -992)-based estimators with variance reduction strategies, and biased estimators based on relaxing Pr into a continuous distribution for which we can use the reparameterization trick (Rezende et al., 2014 Kingma & Welling 2014). In our experiments we use the biased CONCRETE estimator (Maddison et al. 2017) with fixed temperature = because is cheap and simple, and we find it yields nearly the same performance as more-complicated estimators we tried. We conjecture that we get strong performance with this simple and biased estimator because our performance metrics sensitive only to the relative leakiness assigned the bias does not significantly affect this. Note that f(a) = Elog (Y X @ a, a) has been defined for a E (0, 13T but after the CONCRETE relaxation we may have any E [0, 1] Thus, we replace it with the modified function f(a) = E log (Y X @ a e o (1 a), a) where e ~ (0, 1)".
measurements, and
Our method is mainly sensitive to 3 hyperparameters: the learning rates of 0 and n, and the budget hyperparamcter C. Rather than tuning C' directly, we find it casier tune the hyperparameter x== ,ィー. 7 is equal the occlusion probability of each measurement when n is constant, and is less-sensitive to the data dimensionality T than C.
7

---

Published in Transactions on Machine Learning Research (03/2026)
4.3 Differences from prior work
Whereas GradVis, Saliency, LRP, Input Grad and 1-Occlusion effectively perturb single imput features to the classifier and analyze the change in its outputs, ALL generally perturbs many imputs simultaneously. This is useful in settings where there are many 'redundant' leaking measurements and the impact of perturbing only one of them is small.
Like ALL, m- m--Oclusionn, 2nd-order m- mn-Occlusion and OcePOl also simultaneously occlude multiple imput features. The key differences of our method are: 1) ALL samples from a distribution over all 2 possible occlusion masks optimized to maximally hurt the performance of the classifier, whereas prior work iterates over tiny subset of possible occlusion masks chosen heuristically, 2) ALL leverages the gradient of classifier loss with respect to relaxed occlusion masks, whereas prior work uses only zeroeth-order information from forward passes with 'hard' occlusion masks. 3) We simultaneously optimize the mask distribution to maximally hurt the classifier, and the classifier weights to be optimal for the current mask distribution. In contrast, prior work trains the classifier with standard supervised learning techniques, then 'interprets" the fixed classifier with occlusion.
5 Experimental results
5.1 Synthetic datasets where know 'ground truth' leakiness
1.0
Onal
m-geslmjan
Randum
OvaPii
Best paramentic
ALL (omās)
gradient based
0.6
negative
0.4
0.0
10a
10a
10a
10a
10
Number of second-order leaky pairs: D
Figure 3: A toy setting described in Sec. 5.1 where ALL (ours) significantly outperforms baselines. We sample non-leaky feature and second-order leaky pairs, then plot the false negative rate, defined as the proportion points incorrectly assigned leakiness less than or equal to that of the non-leaky point, as we increase D. ALL (ours) succeeds for D up 64 higher the best prior deep learning- approach, and the first-order parametric methods completely fail in this setting. Dots denote median and error bars denote min-max over random seeds.
Toy setting where ALL succeeds and prior work fails As we will show, these differences lead to significant, performance gains, as well as speedup relative to 2ud_order m-Oeclusion and OcePOI.
We generate a sequence of binary-label 2D 2D+1-ft 1-feature classification datasets consisting of ordered pairs (X, Y) sampled independently as follows (see Appendix E.1 for details): Y ~ U(0,, 1). 2(00, 1), M, (0, 1} for = I,..., D. Xn NRR 1), XM, NMM,, 1), XyeM, N(( @ Mt for i 1, 1, D. Here denote
8

---

Published in Transactions on Machine Learning Research (03/2026)
by the exclusive-or operation and X == (XR. XMi XymM........ XMn Xmper). Intuitively, the features XR, XM; and XyeM, as noisy observations of R M,, and Y @ M, respectively. Note that R tells us nothing about Y, and while individually each variable M,, Y @ M, is independent of Y, the pairs of variables {M, Y @ M, allow us to determine through the identity Y ===a @ M, @ M, An ideal leakage localization algorithn should indicate that each feature M, XYeM, is leaking, while X is not.
view
In Fig. 3 we plot the performance of ALL and prior work as we sweep the value of D. While prior deep learning- based methods succeed for small D, they fail when D grows large because the individual contribution of each (XM,;XYYaa } is 'drowned out' in the sense that I[Y; vanishes. ALL succceds for D up to 64x larger than prior work because as the classifier becomes more- reliant on particular features they are subject to a higher occlusion probability, mitigating this effect. For completeness we also include first-order parametric methods our comparison; these fail because they are not sensitive to the second-order associations between Y and (X..: Xy
(XM,.XYeM,
# i]]
Increasing low-pass filtering strength 5 0.96755
Esdimated leakiness of X Estimated leakiness of
0.75
0.9021875
Increasing leaky instruction count
l--0
Inereasing max random delay duration
Estinated leakiness Xf
1-a=0
1a-13
Increasing shuffle locations
Extimated leakiness of
Timestep
Timestep
Timestep
Timestep
Estimated leakiness
Ground truth leaky instruction timestop
Figure 4: Output >" = (""") of ALL algorithm when applied to simulated AES-128 power frace datasets based on the Hamming weight model of (Mangard et al. 2007 ch. 4), as described in Appendix E.2 Leakiness estimated by ALL is consistent with the ground truth timestep at which leaky instruction(s) are exccuted across varying low-pass filtration strength, leaky instruction count, random no-op insertion, and random shuffling.
Simulated AES-128 datasets We next apply ALL to variety of simulated AES datasets. These are useful complement to subsequent experiments on real datasots because we can validate ALL's outputs against ground truth knowledge about which timesteps are leaking, as well as gain insight into its behavior when individually varying particular dataset properties. Traces are simulated using the Hamming weight Icakage model of (Mangard et al., 22007] ch. 4), which decomposes total power consumption as X, Xdata, 1 + Xop.t + X.esid, Here Xdata, function of the Hamming weight of the data currently being operated on, X.p.t is function of the operation currently being applied to the data, and X Xresid, models

---

Published in Transactions on Machine Learning Research (03/2026)
remaining sources of noise as Gaussian random variable. Further details can be found in Appendix E.2 Note that while this model applies to a particular device studied by Mangard et al. (2007), the relationship between data and power consumption is device-dependent and often eludes simple characterization.
In Fig. f we simulate several factors of variation which may be expected to occur in realistic settings, and observe the change in behavior of ALL. First, we apply a varying-strength discrete low-pass filter to the simulated traces. As the strength increases, the peak of the estimated leakiness remains centered at the timestep of the leaky instruction while becoming more-diffuse. Second, vary the number of leaky instructions and see that ALL consistently produces mmmilar-height peaks at every leaky instruction. Third, we introduce a random delay before the leaky instruction, which causes ALL's peak diffuses over the set of timesteps at which the instruction may occur. Fourth, we shuflle the location of the leaky instruction so that it may occur at various points in time. As when varying the mumber of instructions, ALL produces similar-height peaks at each point in time at which the instruction sometimes occurs.
5.2 Real power and EM radiation leakage datasets
White hot SNR
2 -ooker 7-ocelusion biseline)
Geraaee Edinzed halinas of
0.75
Leklaes eanleseddannddyyy 2nd onler Olckksii
Suindig lead
0.90
'Ohali lalnarof
80a
ALL
10-1-
ALL
fre
Slos ( mim))
0.75
0.75
0.30
0.50
750
Laniino froes vhile-boo aocaaaant
Figure 5: A qualitative comparison on AsCADv1 between the estimated leakiness by a white-box SNR-based assessment following Egger et al. (2022). ALL (our method), and 2nd-order 7-Occlusion (the strongest baseline). (left) Superimposed per- timestep leakiness of 8 internal AES variables which contribute to leakage of our targeted 'secret variable' Y = S(w2 @ ki.). We consider Y to leak to the extent that at least one of these internal variables leaks. (center) The per- ver-timestep leakiness of Y, as estimated by ALL and the baseline. Ideally, these estimates should align with peaks in the white-box assessment. (right) The per-timestep leakiness as estimated by ALL and the baseline, vs. the mean SNR of subsets of the internal AES variables (indicated in plot titles). In the plot labeled 'All variables', ALL exhibits a stronger positive association with the aggregate white-box assessment than the baseline. For individual variable subsets, ALL consistently produces a 1/-haaped structure with diagonal trend indicating agrecment between estimated leakiness and SNR for the variables of interest, and vertical band corresponding to leakage from other variables. In contrast, the baseline often exhibits an L-shaped structure, with the horizontal band reflecting spuriously low leakiness estimates at timosteps where the internal variables are known to have significant. leakage. It appears that the baseline is mainly sensitive to (ri.. Wy + l2 @ rim) and possibly the security load (which leaks at similar times as vin), but understates or misses leakage due to the other variables.
We compare our method to prior work on 6 publicly-available datasets of real recorded side-channel emissions and metadata covering diverse settings, as described in Appendix F.3. See Appendix F.3 for an extended version of this section including full implementation details, additional experiments, and ablation studies.
Experimental setup Despite their methodological differences, all considered methods may be viewed as a function which maps a dataset to a sequence of scalars encoding the estimated leakiness of X, for each t. For all deep learning basclines apart from ALL, we first train a supervised classifier to predict socret variables Y from power traces .I....,,y) We then use the 'importance' of X, to the classifier's prodiction about Y, on average over the profiling set, as the estimated leakiness of X,. The definition of 'importance' is prescribed
10

---

Published in Transactions on Machine Learning Research (03/2026)
by the method. For ALL, we simply run our method as described in Sec. occlusion probability ot as the estimated leakiness of X,-
4 then directly use the trained
For the supervised classifiers and the classifier denoted by in ALL, we use the same ReLU MLP architecture trained with the AdamW optimizer (see Appendix E.3.2). For both supervised classification and ALL training runs, we use the same minibatch size and training step count, tune the important hyperparameters for each dataset using random search with a 50-rum budget, and leave the rest reasonable defaults (see Appendix E.3.3). Supervised classifier hyperparaaeeeess are tuned to minimize correct-key rank (similar to maximizing accuracy). For ALL camnot use this approach, we instead use a criterion based on occluding the inputs to frozen supervised classifier and observing its change in performance (sce Appendix E.3.5 Basclines are implemented using Caplum (Kokhlikyan et al. 2020) where possible. OcePOI and (2"d-order) m-Occlusion are adapted to the setting of our paper as described in Appendix E.3.2
Performance evaluation strategies and results In Fig. in line with previous work (Masure et al., 2019: Wouters et al. 2020; Schamberger et al., 2023 Yap et al. 2025), we compute a white-box leakage assessment on ASCADvI-variabl and qualitatively compare it to the outputs of ALL and the strongest baseline. As is standard, we target the variable Y = S(w2 + k2). Because this AES implementation employs Boolean masking, Y does not. directly influence the power consumption. Nonetheless, there are 3 pairs of internal variables which do directly influence power consumption and can be combined to determine Y (as well as more-complicated identities involving the securily load and Sprev @ S(w2 @ k2) @ Tous) (Egger et al., 2022). Ideally, a leakage localization algorithm should consider each X, leaky to the extent that at least one such variable with utility for determining Y leaks. In Fig. 5 ALL successfully identifies the leakage of all 3 pairs of variables, while the best considered baseline clearly identifies Icakage from only one of the pairs.
In the interest of scaling our comparison to many baselines and datasets, we next consider quantitative performance metrics. For real-world datasets quantitative performance evaluation is challenging because we lack 'ground truth' knowledge about Icakage, and there is consensus on the best way to do so. We thus employ 4 performance evaluation metrics which are conceptually similar to evaluation strategies in prior work. Because the specific numbers used to encode leakiness by the various baselines are not directly comparable, we use metrics which are sensitive only to the relative leakiness of different timesteps i.c. under which a vector of estimated leakiness values (?i...., 7 has the same performance as strictly-incrcasingg f RR.
f(r))) for any
Table 2 lists performance across four complementary metrics which emphasize different aspects of performance. See Appendix E.3.4 for details about each metric. The oracle agreement metric assesses agreement with a white-box leakiness evaluation, and is given by the Spearman rank correlation cocfficient. between estimated leakiness and the average SNR of known leaky internal variables (similar to Fig. 5). The lemplate allack minimum traces to disclosure AMTDDmetrie assesses the utility of the estimated-leakier measurements for conducting a side-channel attack
fidelityy leakiness estimates are expected to allow leakier measurements to be fed to the attacker, lcading to better attack performance. The forward DNN occlusion lest? measures the extent to which the performance of a deep learning- based side-channel allack is preserved occlude all but the estimated-leakies measuremenss, and is mainly sensitive to spurious incorrectly- ordered high estimates. The reverse DNN occlusion test? mcasures the extent to which performance is preserved as we occlude all but the estimated- leasttee--eest--eaalele least-leaky measurements, and is mainly sensitive to spurious low estimates. As seen in Table 2, ALL outperforms all baselines on the majority of datasets under every metric except for the forward DNN occlusion test.
6 Conclusion
We have proposed a novel algorithm for localizing side-channel leakage from cryptographic implementations. Unlike prior work, ours is sensitive to arbitrary statistical associations responsible for leakage and operates in a 'llac box' manner, requiring only supervised learning-style dataset with labels denoting the secret
TThe template attack MTD metric similar to evaluations doue in Masure al. 2019 Yap al. 2025 The DNN
occlusion testa were inspired by the ZB-KGE and KRPC algorithms of Hettwer al. (202). described Appendix alter implementation details summarize these as sealars and improve reliability on second-order datasets.
F.3.4
11

---

Published in Transactions on Machine Learning Research (03/2026)
Table 2: A comparison of the considered deep learning-baser leakage localization algorithms on datasets and under 4 quantitative performance metrics. We report mean standard deviation over 5 random seeds. Bold numbers denote the method with the best mean performance (ties broken by lower variance). t denotes that higher number is better, and + denotes that lower number is better. (Oracle agreement t) The Spearman rank correlation coefficient between the predicted leakiness and 'oracle' leakiness derived from a white-box SNR-based assessment exploiting knowledge of the internal variables contributing to leakage of the target. (Template attack MTD 4) The minimum traces to disclosure (MTD) of a template attack when using the predicted leakiness for point of interest (feature) selection. (Forward DNN occlusion test 4) The mean single-trace correct-key rank of DNN-based attacker when occluding all but the k prekicted-leakiest timesteps, on average for l E {I....,Ty T. (Reverse DNN occlusion test 1) The mean single-trace correct-key rank of DNN-based attacker when occluding all but the h predicted-least-late timesteps, average for k TT).
2nd-order datasets
1st-order datasets
Method
ASCADv1-f
ASCADv1-r
DPAv4
AES-HD
OTTAIT
GradVis
0.48 + 0.02
0.27 = 0.01
0.198 + 0.009
0.07 = 0.01
0.55 = 0.05
0.57 0.02
Saliency
0.47 1 0.02
0.26 1 0.01
0.198 0.008
0.07 1 0.01
0.67 1 0.06
0.58 0.002
Input Grad
0.47 0.02
0.25
0.202 0.009
0.08 0.02
0.71 0.05
0.00
LRP
0.47
0
0.202 0.009
0.08 0.02
0.71 0.05
0.60
OcePOI
0.07 + 0.01
0.064 0.004
0.030 0.008
0.044 0.009
0.07
0.01 +
1-Ooclusion
0.47 0.02
0.25
0,202 0.000
0.08
0.71
0.00
Oracle
m² -Oeelusion
0.49
0.11
0.32
0.18
0.72
0.70
2nd-order I-Oeclusion
0.51 0.01
0.27
0,206 1 0.000
0.08
0.74 0.05
0.60 1.002
2dé-order m -Oeelusion
0.52 0.01
0.02
+330
0.19
0.75 0.04
0.788 0.007
ALL (ours)
0.794 0.006
0.60 0.01
0.317 0.002
0.22+0000
0.782 + 0.001
0.848 0.003
GradVis
686 + 100
1162 1000
2.7
20014 6000
144 0.3
1,378 0.007
Tmpl. attack MTD
Saliency
726 100
1412 2000
2.7
19438
6000
1.14 0.02
1.379 0.005
Input Grad
675 100
1194 1. 2000
2.610.11
19893 6000
0.02
1.378 0.003
LRP
675 100
1194 1 2000
2.610.11
19893 6000
1.14 0.02
1,378
OcePOI
787 100
942 + 200
71
25000.000
1.08 0.03
1.47 + 0.05
1-Orclusion
667 + 100
1376 + 2000
2.05
20011 + 6000
1.14 0.02
1.379 0.003
m" n"-OOecluioon
673
727 = 400
911
16283 + 10
1.17 0.02
1332 + 0.007
2né.order 1-Ooclusion
709 + 100
1086 + 1000
2.65 0.008
20222 + 6000
1.14 0.02
1.378 + 0.003
2nd-order vnt -eollssion
642
710 400
911
16033 1: 700
1.16 1: 0.03
1.381 1: 0.008
ALL (ours)
459 40
394 20
0.00
17582 = 5000
1.11 0.02
1.363 0.007
GradVis
0.5
96.8 +
9.6
125.6
1.9 0.2
1.013 0.002
Fwd. DNN occlusion
Saliency
108.5 0.4
9.4
9.7
0.3
18
1,014 0.001
Input Grad
0.4
9..8
9.7
0.3
1.7
1.013 0.001
LRP
108.5 1: 0.4
96.8 1.44
9.7
125.6
1.7 0.2
1.013 0.001
OccPOI
122.3 0.8
1.2
5812
1.3
2.6
1.09 0.04
1-Oeclusion
108.5 0.4
96.7
9.4
0.3
1.7
1.013 + 0.001
mn" mn*-Occlusion
108.2 0.5
9.6
9.0
1.2
181022
1.013 0.001
2"d-order I-Oeclusion
108.4
9..0
9.4
1.3
1.7
1.013 0.001
ordde v -Oellusion
108.2 0.5
95.9
9.0+
125.3 0.2
1.7 0.2
1.013 13 0.001
ALL (ours)
107.3 1: 0.4
104 +
0.9
125.5 1
1.8 0.1
1.014 0.001
Rev. DNN occlusion 1
GradVis
125.9 0.2
127.6 0.1
122
128.0
4.2
1.34
Saliency
125.8 0.2
127.4 0.2
122
128.0
5.1
1.33 0.06
Input Grad
125.7 + 0.3
127.5
121.9 0.9
123
5,2003
1.34 0.06
LRP
125.7 0.3
127.5
121. 0.9
123
5.2003
1.31 0.06
OccPOI
122.3 0.4
0.2
43
0.3
3.6
1.09 0.04
1-Ooclusion
125.8
1.2
122
123
5.2
1.31 0.06 0.06
m" -Oellusion
126.0
127.4
121
128.5
5.3
0.04
2dd_order 1-Occlusion
125.8
1.7.5
1.9
128.1
5.3 0.2
1.34 1 0.06
2nd qui-erder m -Oellusion
126.1
0.2
121.3
0.2
5.3 0.2
1.30 0.04
ALL (ours)
125
128.3
variable under consideration. In light of the ever-increasing efficacy of deep side-channel attack algorithms and the failure existing work to detect all leakage they may exploit, our work marks a critical step towards understanding and mitigating the emerging vulnerabilities of cryptographic hardware.
12

---

Published in Transactions on Machine Learning Research (03/2026)
Broader Impact Statement
The goal of our work to enhance the security of cryptographic implementations against side-channel attacks by identifying the points in time al which they reveal sensitive information, thereby facilitating largeted defenses and mitigation strategies. We foresee ALL as being a useful complement to widely-adopted parametric leakage localization techniques due to its ability to identify leakage in a 'black box' manner without being limited by the domain knowledge of its users.
Our work is primarily defensive in nature. We do not introduce strategies that directly improve the performance of profiling side-channel attacks, and we solely consider cryptographic datasets which have been made available for research purposes and are already widely studied and understood. Nonetheless, improving the ability to identify and understand the weaknessos of cryptographic systems could potentially benefit. attackers as well defenders. We believe the utility of our work for defense outweighs this risk.
Acknowledgments
We are thankful to Sakshi Choudhary, Zachary Ellis, Timur Tbrayev, Amogh Joshi, Amitangshu Mukherjee, Deepak Ravikumar, Arjun Roy, and Utkarsh Saxena for helpful discussions and feedback. The authors acknowledge the support from the Purdue Center for Secure Microclectronics Ecosystem CSME#210205. This work was funded in part by CoCoSys JUMP 2.0 Center, supported by DARPA and SRC.
References
Dakshi Agrawal, Josyula R Rao, Pankaj Rohatgi, and Kai Schramm. Templates as master keys. In Cryptographic Hardware and Embedded Systems Ceatems-CHES 2005: 7th International Workshop, Edinburgh, UK, August 29- 19-September 1, 2005. Proceedings 7, pp. 15-29. Springer, 2005.
Cédric Archambeau, Eric Peeters, F X Standaert, and J Quisquater. Template attacks in principal subspaces. In Cryptographic Hardware and Embedded Systems- CHES 2006: 8th International Workshop, Yokohama, Japan, Oclober 13, 2006. Proceedings 8, pp. 1 14. Springer, 2006.
Sebastian Bach, Alexander Binder, Grégoire Montavon, Frederick Klauschen, Klaus-Robert Müller, and Wojeiech Samek. On pixel-wise explanations for non-linear classifier decisions by layer-wise relevance propagation. PloS one, 10(():e0130140, 2015.
Ryad Benadjila, Emmanuel Prouff, Rémi Strullu, Elconora Cagli, and Cécile Dumas. Deep learning for side-channel analysis and introduction to ASCAD database. Journal of Cryptographic Engineering, 10(2): 163-188, 2020.
Shivam Bhasin, Nicolas Bruneau, Jean-Tuc Danger, Sylvain Guilley, and Zakaria Najm. Analysis and improvements of the dpa contest v4 implementation. In Security, Privacy, and Applied Cryptography Engineering: 4th International Conference, SPACE 2014, Pune, India, October 18-22 22, 2014. Proceedings 4, pp. 201-218. Springer, 2014.
Shivam Bhasin, Dirmanto Jap, and Stjepan Picek. AES HD dataset 50 000 traces. AlSyLab repository, 2020. http:s//giaaau..oo//////LAL/L// AAES HD
com/AISyLab
Bluefin Payment Systems. Bluefin and ID TECH partner to deliver PCI validated Advanced Encryption Stan- dard (AES) P2PE solution. Online, November 2023. URL https: bluef in com/news/bbuefinn and
encrypptiincyytiooo standard- aes- aes-appe--
solution/
Eric Brier, Christophe Clavier, and Francis Olivier. Correlation power analysis with a leakage model. Tn Marc Joye and Jean-Jacques Quisquater (eds.), Cryptographic Hardware and Embedded Systems CHES 2004, pp. 16-29, Berlin, Heidelberg, 2004. Springer Berlin Heidelberg. ISBN 778-3-540-28632-5
Olivier Bronchain and Frangois-Xavier Standacrt. Side-channel countermeasures disscction and the limits of closed source security evaluations. IACR Tronsactions on Cryptographic Hardware and Embedded Systems, pp. 1-25, 2020.
13

---

Published in Transactions on Machine Learning Research (03/2026)
Elie Bursztein, Luca Invernizzi, Karel Král, Daniel Moghimi, Jean-Michel Picod, and Marina Zhang. Generic attacks against cryplographic hardware through long-range deep learning. arXiv preprint ar 2t::2306007249 2023.
Suresh Chari, Charanjit S Jutla, Josyula R Rao, and Pankaj Rohatgi. Towards sound approaches to counteract. power-analysis attacks. In Advances in Cryptology- -ANCONG--RRTTOTTT 199: 19th Anrual International Cryptology Conference Sanla Barbora, California, USA, August 15 15-19, 1999 Proceedings 19, pp. 398 412. Springer, 1999.
Suresh Chari, Josyula R. Rao, and Pankaj Rohatgi. Template attacks. In Burton S. Kaliski, getin K. Kog, and Christof Paar (eds.), Cryptographic Hardware and Embedded Systems CHES 2002, pp- 13-28, Berlin, Heidelberg, 2003. Springer Berlin Heidelberg. ISBN 978-3-540-36400-9
Committoe on National Sccurity Systems. Committec on National Socurity Systems Policy No. 15, Fact Sheet No. 1, June 2003. URL
Jean-Sébastien Coron and Ilya Kizhvatov. An efficient method for random delay generation in embedded
software. In International Workshop on Cryptographic Hardware and Embedded Systems, pp. 156-170. Springer, 2009. Dataset available at
traces.
Joan Daemen and Vincent Rijmen. AES proposal: Rijndael document version 2. AES Algorithm Submission, September 1999. URL
ahandards-and-guuidellasa http:///sw....tta..oo//////////a
pdf
Joan Daemen and Vincent Rijmen. The Design of Rijndael. Springer Berlin, Heidelberg, March 2013. URL
Josef Danial, Debayan Das, Anupam Golder, Santosh Ghosh, Arijit Raychowdhury, and Shreyas Sen. Em-x-dl: Efficient cross-device doep learning side-channel attack with noisy signatures. ACM Journal on Emerging Technologies in Compuling Systems (JETC), 18(1):1 17, 2021.
Debayan Das, Anupam Golder, Josef Danial, Santosh Ghosh, Arijit Raychowdhury, and Shreyas Son. X- deepsca: Cross-device deep learning side channel attack. In Proceedings of the 56th Annual Design Automation Conference 2019, pp. 1 1-6, 2019.
Maximilian Egger, Thomas Schamberger, Lars Tebelmann, Florian Lippert, and Georg Sigl. second look the ASCAD databases. In International Workshop on Constructive Side- Cide-Chhnnel Analysis and Secure Design, pp. 75-99. Springer, 2022.
Guangjun Fan, Yongbin Zhou, Hailong Zhang, and Dengguo Feng. How to choose interesting points for template attacks? Cryptology ePrint Archive, Paper 2014/332, 2014. URL https::/ iacr. iari..rgg//r.............. org/ 2014/332
Robert Geirhos, Jörn-Henrik Jacobsen, Claudio Michaelis, Richard Zemel, Wieland Brendel, Matthias Bethge, and Felix A Wichmann. Shortcut learning in deep neural networks. Nature Machine Intelligence, 2(11): 665-673, 2020.
Daniel Genkin, Adi Shamir, and Eran Tromer. RSA key extraction via low-bandwidth acoustic cryptanalysis. In Juan A. Garay and Rosario Gennaro (eds.), Advances in Cryplology CRYPTO 2014, pp. 444 461, Berlin, Heidelberg, 2014. Springer Berlin Heidelberg. ISBN 44877-..
Daniel Genkin, Lev Pachmanov, Itamar Pipman, Eran Tromer, and Yuval Yarom. ECDSA key extraction from mobile devices via nonintrusive physical side channels. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 1626 1638, 2016.
Xavier Glorot and Yoshua Bengio. Undcrstanding the difficulty of training deep feodforward neural networks. In Proceedings of the thirteenth international conference on artificial intelligence and statistics, pp. 249-256. JMLR Workshop and Conference Proceedings, 2010.
14

---

Published in Transactions on Machine Learning Research (03/2026)
Anupam Golder, Ashwin Bhat, and Arijit Raychowdhury. Exploration into the explainability of neural network models for power side-channel analysis. In Proceedings of the Great Lakes Symposium VLST 2022, GLSVLSI '22, pp. 59 64, New York, NY, USA, 2022. Association for Computing Machinery. ISBN 9781450393225. doi: 24111453526241..22
URL https:///ol fttp:::/ddi..og/1..1111 111//10.1144/3622211 3530346
lan Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Farle, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. Advances in neural information processing systems, 27, 2014.
Ishaan Gulrajani and David Lopez-Paz. In search of lost domain generalization. In International Conference on Learning Representations, 2021. URL lattps://opearevienn net net:/foruunidd-1XaeXooooo
Charles R. Harris, K. Jarrod Millman, Stéfan J. van der Walt, Ralf Gommers, Pauli Virtanen, David Cournapeau, Eric Wieser, Julian Taylor, Sebastian Berg, Nathaniel J. Smith, Robert Kern, Matti Picus, Stephan Hoyer, Marten H. van Kerkwijk, Matthew Brett, Allan Haldane, Jaime Fernández del Río, Mark Wiebe, Pcaru Peterson, Pierre (Crard-Marchhan
Kevin Sheppard, Tyler Reddy, Warren Wockesser, Hameer Abbasi, Christoph Gohlke, and Travis E. Oliphant. Array programming with NumPy. Nature, 585(7) URL https: http:///oooorg/1.1100/0 1033/445113
357 362, September 2020. doi: 10.1038/ 1.008//415866 /114/41-56-020 020-0000-2222200 2649-2. 020- 2649-2
Katherine Hermann and Andrew Lampinen. What shapes feature representations? exploring datasets, architectures, and training. Advances in Newrol Information Processing Systems, 33:9995 10006, 2020.
Benjamin Hettwer, Stefan Gehrer, and Tim Güneysu. Deep neural network attribution methods for leakage analysis and symmetric key recovery. In Kenneth G. Paterson and Douglas Stebila (eds.), Selected Areas in Cryptography - SAC 2019, pp. 645-666, Cham, 2020. Springer International Publishing. ISBN 978-3-030-38441-5.
Gabriel Hospodar, Benedikt Gierlichs, Elke De Mulder, Ingrid Verbauwhede, and Joos Vandewalle. Machine learning in side-channel analysis: a first study. Journal of Cryptographic Engineering, 144):293 302, 2011.
Michael Hutter and Jörn-Mare Schuidtt The temperature side channel and heating fault attacks. In Smart Card Research and Advanced Applications: 12th International Conference, CARDIS 2013, Berlin, Germany, November 27-29, 2013. Revised Selected Papers 12, pp. 219-235. Springer, 2014.
Eric Jang, Shixiang Gu, and Ben Poole. Categorical reparametrization with gumble-softmax. In International Conference on Learning Representations (ICLR 2017). OpenRovicw. not, 2017.
Minhui Jin, Mengee Zheng, Honggang Hu, and Nenghai Yu. An enhanced convolutional neural network in side-channel attacks and its visualization. arXiv preprint (rXii::009.08890 2020.
Diederik P. Kingma and Max Welling, Auto-encoding variational bayes. In Yoshua Bengio and Yann LeCun (eds.), 2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings, 2014. URL httpp://axxv..rrgg wwt.oor///bb...b../..//
Paul Kocher, Joshua Jaffe, and Benjamin Jun. Differential power analysis. In Michael Wiener (ed.), Advances in Cryptology - CRYPTO' 99, pp. 388-397, Berlin, Heidelberg, 1999. Springer Berlin Heidelberg. ISBN 978-3-540-48805-9.
Paul Kocher, Jann Horn, Anders Fogh, Daniel Genkin, Daniel Gruss, Werner Haas, Mike Hamburg, Moritz Lipp, Stefan Mangard, Thomas Prescher, Michael Schwarz, and Yuval Yarom. Spectre attacks: Exploiting speculative exccution. In 40th IEEE Symposium on Security and Privacy (S8P'19), 2019.
Paul C. Kocher. Timing attacks on implementations of Koblitz (od.), Advances in Cryptology - CRYPTO '96, pp. 104-113, Berlin, Heidelberg, 1996. Springer Berlin Heidelberg, ISBN 978-3-540-68697-2.
RSA, DSS, and other systems. In Neal
Narine Kokhlikyan, Vivek Miglani, Miguel Martin, Edward Wang, Bilal Alsallakh, Jonathan Reynolds, Alexander Melnikov, Natalia Kliushkina, Carlos Araya, Siqi Yan, et al. Captum: unified and generic model interpretability library for pytorch. arviv preprint ar FF0:2009.07800 2020.
15

---

Published in Transactions on Machine Learning Research (03/2026)
Siu Kwan Lam, Antoine Pitrou, and Stanley Seibert. Numba: A llvm-based python jit compiler. In Proceedings of the Second Workshop on the LLVM Compiler Infrustructure in HPC, pp. 1-6, 2015.
Yanbin Li, Yuxin Huang, Fuwei Jia, Qingsong Zhao, Ming Tang, and Shougang Ren. gradient deconvolutional network for side-channel attacks. Computers & Electrical Engineering, 98:107686, 2022.
Yanbin Li, Jiajie Zhu, Zhe Liu, Ming Tang, and Shougang Ren. Deep learning gradient visualization-baser pre-silicon side-channel leakage location. IEEE Trunsactions on Information Forensics and Security, 2024.
Moritz Lipp, Michael Schwarz, Daniel Gruss, Thomas Prescher, Werner Haas, Anders Fogh, Jann Horn, Stefan Mangard, Paul Kocher, Daniel Genkin, Yuval Yarom, and Mike Hamburg. Meltdlwn: Reading kernel memory from user space. In 27th USENIX Securily Symposium (USENIX Securily 18), 2018.
Phillip Lippe, Taco Cohen, and Eistratios Gavves. Efficient neural causal discovery without acyclicity constraints. In International Conference on Learning Representations, 2022. URL
net/foorumiideeeCciPPP....
llya Loshchilov and Frank Hutter. Decoupled weight decay regularization. In International Conference on Learning Representations, 2018.
Xiangjun Lu, Chi Zhang, Pei Cao, Dawu Gu, and Haining Lu. Pay attention to raw traces: A deep learning architecture for end-to-end profiling atlacks. TACR Transaclions Cryplographic Hurdware and Embedded Systems, pp. 235-274, 2021.
Chris J. Maddison, Andriy Mnih, and Yee Whye Teh. The concrete distribution: A contimuous relaxation of discrete random variables. In International Conference on Learning Representations, 2017. URL
https://openrevier. http://ww.ee/tormmmrrddss11s.1..
Houssem Maghrebi, Thibault Portigliatti, and Emmanuel Prouff. Breaking cryptographic implementations using deep learning techniques. In Security, Privacy, and Applied Cryptography Engineering: 6th Inter- national Conference, SPACE 2016, Hyderabad, India, December 14-18, 2016, Proceedings 6, pp. 3-26. Springer, 2016.
Stefan Mangard, Elisabeth Oswald, and Thomas Popp. Power analysis attacks. Springer New York, NY, 1st edition, March 2007. doi: 10. 101-007/778---88--888 0-77788-387--812-2-- URL https:///iii https://iink..prrnner springer cwm/ booobook/10
1007/978-0-387-381165
Loic Masure and Rémi Strullu. Side-channel analysis against ANSSI's protected AES implementation ARM: end-to-end attacks with multi-task learning. Journal of Cryptographic Engineering, 13(2):129-147, 2023.
Loie Masure, Cécile Dumas, and Emmanuel Prouff. Gradient visualization for general characterization in profiling attacks. In Constructive Side-Chanme Analysis and Secure Design: 10th Internalional Workshop, COSADE 2019, Dormstadt, Germany, April 3-5, 2019, Proceedings 10, pp. 145-167. Springer, 2019.
Thomas S Messerges. Using second-order power analysis to attack dpa resistant software. In International Workshop on Cryptogrophic Hardware and Embedded Systems, pp. 238-251. Springer, 2000.
Nicky Mouha. Review of the Advanced Encryption Standard. NIST Cnteragency/Inteenn Report (NISTIR) 8319, National Institute of Standards and Technology, July 2021. URL http::////ccc..ss.ovvosoo
ir/8319/finall
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, high-performanee deep learning library. Advances in neural information processing systems, 32, 2019.
Guilherme Perin, Lichao Wu, and Stjepan Picek. I know what your layers did: Layer-wise explainability of deep learning side-channel analysis. Cryptology ePrint Archive, Paper 2022/1083 2022. URL https //eprint. iacr. www.iiarrrr....... aaarroorg/00221000
16

---

Published in Transactions on Machine Learning Research (03/2026)
Stjepan Picek, Guilherme Perin, Luca Mariot, Lichao Wu, and Lejla Batina. SoK: Deep learning- based physical side-channel analysis. ACM Compuling Surveys, 55(11):1 2023.
Jean-Jacques Quisquater and David Samyde. ElectroMagnctic Analysis (EMA): Mcasures and counter- measures for smart cards. In Isabelle Attali and Thomas Jensen (eds.), Smart Card Programsming and Security, pp. 200-210, Berlin, Heidelberg, 2001. Springer Berlin Heidelberg. ISBN 978-3-540-44411--2
Christian Rechberger and Elisabeth Oswald. Practical template attacks. In Chac Hoon Lim and Moti Yung (eds.), Information Security Applications, pp. 440 456, Berlin, Heidelberg, 2005. Springer Berlin Heidelberg. ISBN 978-3-540-81815-6
Eric Rescorla. HTTP over TLS. RFC 2818, May 2000. URL https://www...ttcattooroooo////.
Danilo Jimenez Rezende, Shakir Mohamed, and Daan Wierstra. Stochastic backpropagation and approximate inference in deep generative models. In Eric P. Xing and Tony Jebara (eds.), Proceedings of the 31sl International Conference on Machine Learning, volume 32 of Proceedings of Machine Learning Research, pp. 1278-1286, Bejing, China, 22-24 Jun 2014. PMLR. URL https://proccecinngs mmleeeddiiiiin.......mm... http://rroedddng.....rrrres/s//s rezende14.hos
Kotaro Saito, Akira Ito, Rei Ueno, and Naofumi Homma. One truth prevails: A deep-learning based single-trace power analysis on rsa-crt with windowed exponentiation. IACR Transactions on Cryptographic Hardware and Embedded Systems, pp. 490-592-20 2022.
Thomas Schamberger, Maximilian Egger, and Lars Tebelmann. Hide and seek: Using occlusion techniques for side-channel Icakage attribution in cmns. In Jianying Zhou, Lejla Batina, Zengpeng Li, Jingqiang Lin, Eleonora Losiouk, Suryadipta Majumdar, Daisuke Mashima, Weizhi Meng, Stjepan Picek, Moham- mad Ashiqur Rahman, Jun Shao, Masaki Shimaoka, Ezekiel Soremekun, Chunhua Su, Je Sen Teh, Aleksei Udovenko, Cong Wang, Leo Zhang, and Yury Zhaumiarovich (eds.), Applied Cryptography and Network Security Workshops, pp. 139 158, Cham, 2023. Springer Nature Switzerland. ISBN 978-3-031-41181-6.
Werner Schindler, Kerstin Lemke, and Christof Paar. A stochastic model for differential side channel oryptanalysis. In Cryptographic Hardware and Embedded Systems- CHES 2005: 7th International Workshop, Edinburgh, UK, August 29 Seplember 1, 2005. Proceedings 7, pp. 30 46. Springer, 2005.
Claude Elwood Shannon. A mathematical theory of communication. The Bell system technicol journal, 27 1233 1948.
Alexander Shekhovtsov. Bias-variance tradcoffs in single-sample binary gradient estimators. In DAGM German Conference on Pallern Recognilion, pp. 127-141. Springer, 2021.
Avanti Shrikumar, Peyton Greenside, and Anshul Kundaje. Learning important features through propagating activation differences. In Doina Precup and Yee Whye Teh (eds.), Proceedings of the 34th International Conference on Machine Learning, volume 70 Proceedings of Machine Learning Research, pp. 3145 3153. PMLR, 06 11 Aug 2017. URL
ppress/t70/sbrrkkuarrl1/// mlr. wttggssmm..pppeeeeee pwwss/v70/ wwrsshumar1aaa h7m.
K Simonyan, Vedaldi, and A Zisserman. Deep inside convolutional networks: visualising image classification models and saliency maps. In Proceedings of the International Conference on Learning Representations (ICLR). ICLR, 2014.
Biaoshuai Tao and Hongjun Wu. Improving the biclique cryptanalysis of AES. In Ernest Foo and Douglas Stebila (eds.), Information Security and Privacy, pp. 39-56, Cham, 2015. Springer International Publishing. ISBN 978-3-319-19962-7.
George Tucker, Andriy Mnih, Chris Maddison, John Lawson, and Jascha Sohl-Dickstein. Rebar: Low- variance, unbiased gradient estimates for discrete latent variable models. Advances in Neural Information Processing Systems, 30, 2017.
17

---

Published in Transactions on Machine Learning Research (03/2026)
Daan der Valk, Stjepan Picek, and Shivam Bhasin. Kilroy here: The first step towards explainability of neural networks in profiled side-channel analysis. In Guido Marco Bertoni and Francesco Regazzoni (eds.), ) Constructive Side- Channel Analysis and Secure Design, pp. 175 199, Cham, 2021. Springer International Publishing. ISBN 978-8-030-68777--1
Pauli Virtanen, Ralf Gommers, Travis E. Oliphant, Matt Haberland, Tyler Reddy, David Cournapeau, Evgeni Burovski, Pearu Peterson, Warren Weckesser, Jonathan Bright, Stéfan J. van der Walt, Matthew Brett, Joshua Wilson, K. Jarrod Millman, Nikolay Mayorov, Andrew R. J. Nelson, Eric Jones, Robert Kern, Eric Larson, C J Carcy, Πhaa Polat, Yu Feng, Eric W. Moore, Jake VanderPlas, Denis Laxalde, Josef Perktold, Robert Cimrman, lan Henriksen, A. Quintero, Charles R. Harris, Aune M. Archibald, Antônio H. Ribeiro, Fabian Pedregosa, Paul van Mulbregt, and SciPy 1.0 Contributors. SciPy 1.0: Fundamental Algorithms for Scientific Computing in Python. Nature Methods, 17:261 272, 2020. doi: 10.1038/s41192-000
Zhiguang Wang, Weizhong Yan, and Tim Oates. Time series classification from scratch with deep neural networks: A strong baseline. In 2017 International joint conference on neural networks (IJCNN), pp. 1578 1585. IEEE, 2017.
Leo Weissbart, Stjepan Picek, and Lejla Batina. One trace is all it takes: Machine learning based side-channel attack on eddsa. In Securily, Privacy, and Applied Cryplography Engineering: 9th International Conference, SPACE 2019, Gandhinogar, India, December 3-7, 2019, Proceedings 9, pp. 86 16-1 Springer, 2019.
Saaning-based
Ronald J Williams. Simple statistical gradient-following algorithms for connectionist reinforcement learning. Machine learning, 8:229-256, 1992.
Lennert Wouters, Victor Arribas, Benedikt Gierlichs, and Bart Preneel. Revisiting methodology for efficient CNN architectures in profiling attacks. IACR Transactions on Cryptographic Hardware and Embedded Systems, pp. 147-168, 2020.
Yuxin Wu and Justin Johnson. Rethinking" batch" in batchnorm. arXiv preprint urXiv:2105.07576, 2021.
Trevor Yap, Adrien Benamira, Shivam Bhasin, and Thomas Peyrin. Poek into the black-box: Interpretable neural network using sat equations in adde-hhannd analysis. IACR Transactions on Cryptographic Hardware and Embedded Systems, pp. 23,53, 2023.
Trevor Yap, Stjepan Picek, and Shivam Bhasin. Ocepois: Points of interest based on neural network's key recovery in side-channel analysis through occlusion. In Sourav Mukhopadhyay and Pantelimon Stănică (eds.), Progress in Cryptology INDOCRYPT 2024, pp. 3-28, Cham, 2025. Springer Nature Switzerland. ISBN 978-3-031-80311-6,
Gabriel Zaid, Lilian Bossuet, Amaury Habrard, and Alexandre Venelli. Methodology for efficient CNN architectures in profiling attacks. TACR Transactions on Cryptographic Hardware and Embedded Systems, pp. 1-36, 2020.
Matthew D. Zeiler and Rob Fergus. Visualizing and understanding convolutional networks. In David Fleet, Tomas Pajdla, Bernt Schiele, and Tinne Tuytelaars (eds.), Computer Vision ECCV 2014, pp. 818-833, Cham, 2014. Springer International Publishing. ISBN 978-3-319-10590-1
18

---

Published in Transactions on Machine Learning Research (03/2026)
A
Notation and variable names
See table 3 below for list of the notation use, and table for for list of the main variables we define.
Table 3: List of the notation used in our paper.
Symbol
Description
Variable case: X, x
Upper case: random variable, lower-case: actualization
IR, Z
Set of real numbers, of integers
[a .. b] where
aZ
Interval of integers {a....;b)
Serif font: S
Other sets
A C B
A is non-strict subset of B Complement of B in A, i.c. 44
A\B
S+
Nonnegative elements of 5 _ IR.
S++
Positive elements of S C R Vector in RD for some Elementwise product of and Elementwise application of f to Gradient with respect to æ Sub-vector of æ according to a: (xa d = 1.... D: is a random variable with distribution
Bold font: æ
Z++
a
f(x) where f: IR
R
V Vax,......
Ta where a 10
X X~p
PA
The distribution of A
PA.B
The joint. distribution of and The conditional distribution of A given B
PAIB
X N.
X is random vector with elements X1, X2,... 1id. Normal distribution with mean μ4 scale Uniform distribution over set S Expectation w.r.t. all random variables A, B, in expression Expectation w.r.t. only to Mutual information between and
p
02)
U(S)
E ES(A, B,......
EA f(A, B....)
[[A; B)
[A; C] A IL B, A K. B A B A
Conditional mutual information between A and B given C A is marginally independent, dependent on B
A is conditionally independent, dependent B given C
B Extended background
Here we provide high-level overview of the AES algorithm and power side-channel attacks aimed at a machine learning audience. Since our algorithm views the cryptographic algorithm and hardware as a black box be characterized with data, a deep understanding is not necessary to understand and appreciate our work. Thus, we omit many details and aim to impart an intuitive understanding of these topics. Interested readers may refer to Daemen & Rijmen 2013) for a detailed introduction to the AES algorithm, to Mangard et al. (2007) for detailed introduction to power side-channel attacks, and to Picek et al. (2023 for survey of supervised deep ccaning-based power sidc-channel attacks on AES implementations. Additionally, note that. while for clarity of exposition we focus here on power side-channel atlacks on AES implementations, our algorithm requires only a supervised searning-style dataset of side-channel emission traces and metadata which enables computation of the target variable, so applicable in a moro-general setting. We have demonstratod that it works with various target variables on AES, ECC and RSA implementations with both power and EM radiation measurements, and suspect it is relevant in far more contexts.
19

---

Published in Transactions on Machine Learning Research (03/2026)
Table 4: List the main variables defined in our paper.
Variable
Description
TE Z44
Dimensionality of power trace
X Px
Power trace (random variable)
BE R'
Power trace (actualization)
X,,
Power measurement at time t, i.c. f-th element of power trace Set of values the largeted variable may take on
YCZ
Y~py
Targeted variable (random variable)
BEY
Targeted variable (actualization)
DCRTA Y
Dataset of power traces/targetes variable pairs, sampled i.dd. from px,Y
Y (0, m Y e 1).1]" NERT
Occlusion probabilities
Occlusion probability at timestep
The optimal value of after solving Equ. ??
Unconstrained logits which parameterize
A PA
Multiplicative binary noise vector paramotorized by occlusion probabilities y
a a 10,
Actualization of A
c: -;
Cost function for occlusion probability elements "t
CER++
Budget for occlusion probabilitios: they must satisfy C= d(%))
7E (0.1)
Reparameterized version of which is more stable w/ data dimensionality
Po RT
[0. 1)7 - Noise-conditional neural net w/ weights 0; returns softmax logits for Y
Secure
channel
Key
Insecure channel
aad
The creii car
Plaintext
Cryplographic hurdware
Ciphertext
Cryptographic hurdware
Plaintext
Sender
Potential eavesdroppers
Intended recipient
Figure 6: Diagram illustrating the main components of symmetric-key cryptographic algorithms, which enable secure transmission of data over insecure channels where it may intercepted by eavesdroppers. The data is first partitioned and encoded as sequence of plaintexts. Fach plaintext transformed into a ciphertext. by an invertible function indexed by cryptographic key. The key is transmitted over secure channel intended recipients of the data, allowing them to invert the function and recover the original plaintext. The set of functions is designed that absent this key, the ciphertext gives no information about the plaintext. Thus, the data remains secure even if cavesdroppers have access to the ciphertext.
B.1 Cryptographic algorithms
Data is often transmitted over insecure channels which leave it accessible not only to intended recipients, but also to unknown and untrusted parties. For example, when a signal is wirelessly transmitted from one anlenna to another, an eavesdropper could set up a third antemna between the two and intercept the signal. Alternately, data stored on a hard drive by one user of a computer may be accessed by a different user. Cryptographic algorithms aim to preserve the privacy of data under such circumstances by transforming it that it is meaningful only in combination with additional data which is known to its intended recipients but not to the untrusted parties.
20

---

Published in Transactions on Machine Learning Research (03/2026)
We focus here on the ubiquitous advanced encryption standard (AES), which is symmetric-key cryptographic algorithm. See Fig. D for a diagram illustrating the important components of such algorithms. The unencrypted data to be transmitted is encoded and partitioned into a sequence of fixed-length bitstrings called plaintents. The cryptographic algorithm encrypts cach plaintext into a ciphertezt by applying an invertible function from a set of functions indexed by an integer called the cryplographic key. This set functions designed so that of one were to sample a key and plaintext uniformly at random from the sets of all possible keys and plaintexts, then the plaintext and ciphertext would be marginally independent. Thus, such an algorithm may be used to securely transmit data by ensuring that the sender and recipient of the data know shared key and that the key is kept secret from all potential eavesdroppers on the data.
B.2 Side-channel attacks
Many symmetric-key cryptographic algorithms are believed to be secure in the sense that it is not feasible to determine their cryptographic key by encrypting known plaintexts and observing the resulting ciphertexts. Any such alm with a finite number of possible keys is vulnerable to 'brute-foree allacks based on arbitrarily guessing and checking keys until success, but doing so requires checking half of all possible keys in the average case, which unrealistic for algorithms such as AES which has either 2128 2192, or 2266 possible keys. To our knowledge the best known such attack against AES reduces the required number of guesses by less than a factor of 8 compared to a naive brute force attack (Mouha 2021 Tao & Wu 2015
However, while algorithms may be secure when considering only their intended inputs and outputs, hardware executing these algorithms will inevitably emit measurable physical signals which are statistically associated with their intermediate variables and operations. Examples of such signals include a device's power con- sumption over time (Kocher et al. 1999), the amount of time it takes to execute a program or instruction Kocher et al.) 2019), electromagnetic radiation it emits (Quisquater & Genkin et al. 2016), and sound due vibrations of its electronic components (Genkin et al. 2014). This phenomenon is called side-channel leakage, and can be exploited to determine sensitive data such 88 cryplographic key through side-channel allacks.
[Kocher 1996 Lipp et al. 2018
Samyde 2001
As a simple example of side-channel leakage, consider the following Python function which checks whether a password is correct:
def is_correct (provided
str, corsect_password: str) -> bool:
if len bel(proridee_paswor)) !- len (correect return False
for in range (len (proviieed (p..rorrdddddsssord)))))))
password)):
if return False
[i] != correct_ [i]:
return True
Suppose the password consists of characters, each with e possible values. Consider an attacker seeking to determine the correct. password by feeding various guessed passwords until the function returns True Naively, the attacker could simply guess and check all possible m-length passwords for m I,..., n. This would require O(e") calls to the function, which would be extremely costly for realistically-large and n. However, an attacker with knowledge of the function's implementation could dramatically reduce this cost by observing that the function's execution time depends on correct_passwett exits immediately if len ppprovided_passwoore
Because the function != (en ppssswordd the attacker can determine the length of porrect_passwore in (n) time by feeding increasing-lengthl guesses to is_correct until its execution time increases. Next, because is ss__correctt exits the first time it detects an incorrect character, the attacker can sequentially determine each of the characters of correct saarect_password by checking all possible values of each character and noting that the correct value leads to an increase in execution time. Thus, although is_ correct secure against attackers which use only its intended inputs and outputs, it provides essentially no security against attackers which measure its exccution time.
Thhe key is typically shared using an asymmetric-ker cryptographic algorithm such RSA or ECC. Asymmetric-key cryptography is slow and resource-itensivve, when sufficiently-lage amount of data must be transmitted, it morc-efficient to share the key with an asymmetric-Bn key algorithm and then transmit data using symmetric-key algorithm than to simply transmit the data with asymmetric-key algorithm.
21

---

Published in Transactions on Machine Learning Research (03/2026)
No change
Data line pre-charged to
High vollage
Data Line stores chorge
Bit value?
Charge is drained
Low vollage
Figure 7: Diagram illustrating one reason there is power side-channel leakage in the device characterized by (Mangard et al.) 2007] ch. 4). Data is transmitted over bus consisting of multiple wires, with one wire representing each bit. Each wire represents 0 bit some prescribed 'low' voltage and 1 bit as 'high' voltage. Energy is consumed when the voltage of a wire changes from low to high because positive and negative charges, which are attracted to one-another, must. be separated to create a high concentration of positive charge on the wire. When 'writing' data to the bus, this particular device first 'pre-charges' all wires to 1, then drains charge from the wires which should represent 0. Thus, because the 0's must be changed I's before the next write, energy is consumed in proportion to the number of 0's, thereby creating a statistical association between the device's power consumption and the data it operates
In this work we focus on side-channel leakage due to the power consumption over time of a device (as well as EM radiation, which closcly related due to being dominated by the time derivative power consumption). A device's power consumption is inevitably statistically-assciialee with the operations il execules and the data it operates on, because these dictate which components are active and the order and manner which they operate. There are many types of components with different funetionality, and components with the same intended functionality are not identical due to imperfect manufacturing processes. These differences impact power consumption. While in general the association between power consumption and data is multifactorial and difficult to describe, in Fig. 7 we illustrate a simple relationship which accounts for a significant portion of the leakage in a device characterized by Mangard et al. 2007
B.3 Power side-channel attacks on AES implementations
Side-channel attacks techniques which exploit side-channel leakage to learn sensitive information such cryptographic keys. There are many categories of attacks, but in this work we focus on category called profiled side-channel attacks on symmetric-key cryptographic algorithms. These attacks assume that the 'attacker' has access to clone of the actual cryptographic device to be attacked, and the ability to encrypt. arbitrary plaintexts with arbitrary cryptographic keys, observe the resulting ciphertexts, and measure the side-channel leakage during eneryption. In practice, these assumptions almost certainly overestimate the capabilities of attackers for example, while in some cases an attacker could plausibly identify the hardware and source code of cryptographic implementation, purchase copies of this hardware, program them with the source code, and characterize these devices, the nature of the side-channel leakage of these purchased copies would differ from those of the actual device due to PVT (pressure, voltage, temperature) variations (c.g. due to imperfect manufacturing processes, environment, and measurement selup). It has been demonstrated that profiled side-channel attacks can be effective despite this, especially when numerous copies of the target hardware are used for profiling (Das et al. 2019 Danial et al. (022). Regardless, this type of attack provides an upper bound on the vulnerability device to sido-channel attacks, which is a useful metric for hardware designers.
22

---

Published in Transactions on Machine Learning Research (03/2026)
While there diverse types of profiled side-channel attacks, at high level the following steps encompass the important elements of these attacks:
Select some "sensitive" intermediate variable of the cryptographic algorithm which reveals the cryptographic key (or part of it).
Compile dataset of (side-chamnel leakage, intermediate variable) pairs by repeatedly randomly selecting key and plaintext, encrypting the plaintext using the key and recording the resulting ciphertext and side-channel leakage during encryption, and computing the intermediate variable based on knowledge of the cryptographic algorithm.
3. Use supervised learning to train a parametric function approximator to predict intermediate variables from recordings of side-channel leakage during encryption.
Measure side-channel leakage during eneryptions by the actual target device. Use the trained predictor to predict sensitive variables from side-channel Icakage. Potentially, these prodictions can be combined to get better estimate of the key.
In the case of power side-channel attacks on AES, it is generally infeasible to directly target the cryptographic key because care is taken by hardware designers to prevent from directly influencing power consumption. Instead, it is common to target an intermediate variable which the algorithm directly operates on. A common target the SubBytes output, which computed as
y == Sbox (A: (D w)
where & E {0, 1 is the key, E {0, 1) is the plaintext, Thits E E++ is the number of bits of the key and plaintext, @ is the bitwise exclusive-or operation, and Sbox {00, (0,1)mmiu + 13 is an invertible function which is widely known and the same for all AES implementations. Note that if the plaintext is known, the key can be computed as
(6) Additionally, it is common to independently target subsets of the bits of the cryptographic key (c.g. the individual bytes). This is reasonable because the common AES target variables are largely leaked by instructions which operate on individual bytes.
k == Sbox SSbxx-(yy)>> + w.
B.3.1 Template attack: example of a classical profiled side-channel attack
In order to underscore the advantage of deep learning over previous side-channe attack algorithms, we will here describe the template attack algorithm of Chari et al. (2003), variations of which are the stato-of-tho-art non-deep learning based attacks. The attack is based on modeling the joint distribution of power consumption and intermediate variable as Gaussian mixture model, as described in algorithm 1
Note that this algorithm assumes that the joint distribution is well-described by Gaussian mixture model, which may not hold in practice. Additionally, due to the near-cubic runtime of the matrix inversion of each Eg required to compute the Gaussian density functions, this algorithm requires pruning power traces down to a small number of "high-leakage" timesteps. Follow-up work (Rechberger Oswald 2005) proposed performing principle component analysis on the traces and modeling the coefficients of the top principle components rather than individual timesteps. Nonetheless, these constraints mean that the efficacy of this attack is contingent on simplifying assumptions and judgement of which points are 'loaky' using simple statistical techniques and implementation knowledge, limiting its usefulness as way for hardware designers to evaluate the amount side-channel leakage from their device.
B.3.2 Practical profiled deep learning side-channel attacks on AES implementations
Here we will give common and concrete setting and method for performing profiled power side-channel attacks AFS implementations, which is used for all of our experiments.
23

---

Published in Transactions on Machine Learning Research (03/2026)
Algorithm 1: The Gaussian template attack algorithm of Chari et al. (2003)
Input: Profiling (training) dataset = {(x(1) yy() : [1 .. N] R x {0, 1] m attack (testing)
dataset Dattack == {xx) Wa :n E [1 N.. ER" x {0, m 'points of interest"
(n)
Ppoi == {fm= m = 1,...................... 7 C [1..7
Output: Predicted key 1*
Function get_y (k, w)
2
return Sbox(k: @ w)
// calculate intermediate variable for given key
for n E [1... N. do
4
(m) (()) f L
: m
,
// prune power traces to 'points of interest'
for y E {0, 1 do
// fit a multivariate Gaussian mixture model to the training dataset
Dy - {-(") : [1 .. M). y()) = =y}
7
Ny. + Dyy
My & 1
N, ΣBED, áb
Ey E N,-I EeED, (a 14y - m.y)
10 for Na) do
11
(n) aa" am (m)
T)
// prune power traces of attack dataset
// predict key value which maximizes log-likelihood of attack dataset
12 k* f arg max) EN= log.N (z(m;; M yck
E get "ggt_s((s,n) (kk))))))))))) + log got_s(k;,(()))
13 return E.*
Consider an AES-128 implementation, which has a 128-bit cryptographic key and plaintext. Typically, attackers target each of the 16 bytes of the key independently rather than attacking the full key at once. This practice tacitly assumes that the bytes of the sensitive variable are statistically-indeeeedentt given the power trace, which is reasonable because many AFS operations (including those which are commonly targeted) are performed independently on the individual bytes. Thus, it is convenient way to simplify the attack without significantly impacting performance.
Additionally, it difficult and uncommon to try to directly map power traces to associated cryptographic keys, because great care is taken by hardware designers ensure that the key does not directly impact power consumption. Instead, attackers generally target 'sensitive' intermediate variables which unavoidably directly impact power consumption and can be combined with the plaintext and ciphertext to learn the key. We consider one such intermediate variable which is referred to as the first SubBytes output, and is equal to
y = Sbox @ w),
where & e {0, 1)8 is byte of the oryptographic key, w E {0, is the corresponding byte of the plaintext, @ denotes the bitwise exclusive-or operation, and Sbox {0, 1] + {0, 1) is an invertible function which is publicy--vailaale and the same for all AES implementations. Note that if w is known, as is assumed in the profiled side-channel allack setting, then k can be recovered as
k w ( Sbox (v).
In the context of profiled power side-channel analysis, one assumnes to have a 'profiling' dataset (i.e. training dataset) and an 'attack' dataset (i.e. a test dataset). Suppose we target Rbytes bytes of the sensitive variable. In our setting, the profiling dataset consists of ordered pairs of power traces and their associated sensitive intermediate variables:
D = 0=((10)) (z011), (00): n E
[ [1... NN] c CR" x {0, 1] 10 X8
(9)
24

---

Published in Transactions on Machine Learning Research (03/2026)
and the attack dataset consists of ordered pairs of power traces and their associated plaintexts:
D2 (aff wn n [1.. [1...Na]] S R (0.1) "hythtyy
(10)
Many works prove the concept of their approaches by targeting only a single byte of the sensitive variable. When multiple bytes are targeted, it is common to either train separate neural network for each byte of the sensitive variable, or to amortize the cost of targeting these bytes by training single neural network with a shared backbone and a separate head for each byte. In this work we exclusively target single bytes, though it would be straightforward lo exlend our approach lo the multitask learning setting.
T XRP- R (y, - Φ(y x; 0), where each $ x; 0) is a probability mass function over Y. In the case of a multi-hcaded network with each head independently predicting a single byte, we compute this probability mass of y E Y as the product of the mass assigned to each of its bytes. We train the network by approximately solving the optimization problem
Consider a neural network architecture
max OERP
(
Σ log (1
x (n)
(11)
Given θ arg max ((0), we then identify the key which maximizes our estimated likelihood of our attack dataset and key follows:
N
arg max
Σ
log & ((Sbox(ks @ w((?)) ) : I...., Rbytes xc (1) ,,(())))
(12)
KE (E "bytes
where we denote by k; and w (n) the individual bytes of ls and w(n).
C Extended related work
Here we consider existing work which has been applied to leakage localization in the context of power or EM radiation side-channel analysis. In line with the problem framing given in Sec. 2 we view these methods functions which map joint emission-target variable distributions px,y y to vectors in IRT which assign to each emission measurement variable X, scalar 'leakiness' measurement. Prior approaches to leakage insissccsbbssee methods which check for
localization ion can largely be categorized as either 1) parametric pairwise associations between X, and Y, or 2) neural net attribution methods which use standard supervised deep learning techniques to train a model pyix x pyJx; then use 'attribution' techniques to estimate the average 'importance' each feature X, to the predictions made by the model.
C.1 First-order parameteric statistics-based methods
In the side-channel attack literature it is common to use parametric first-order statistical methods to localize leakage. In this work we consider the signal to noise ratio (SNR) (Mangard et al. 2007), the sum of squared differences (SOSD) (Chari et al. 2003). and correlation power analysis with Hamming weight leakage model (CPA) (Brier et al., 2004) due to their popularity and efficacy for 'point of interest' selection (Fan et al. 2014). Below we summarize and discuss these methods.
The SNR is a standard tool for leakage localization and defined as
Vary Ex Ex-pxIx X
SNR(px,y) = Ey-py Varx
(13)
X
The SOSD method was introduced as point of interest (feature) selection technique for the Gaussian template attack, a parametric side-channel attack based on modeling emission measurements multivariate Gaussian mixture model with component corresponding to each possible value of the target variable,
25

---

Published in Transactions on Machine Learning Research (03/2026)
then using Bayes' rule to estimate the conditional distribution of the target variable given the emission measurements. The SOSD is defined as
sosd(px,y) = =E
Ex (Xx) E Ex-px v(b))))))) ? D'Y
(14)
CPA is based on the assumption that power consumption is a noisy linear function of the Hamming weight of the target variable, which is a useful model for certain devices. is defined as the elementwisc Pearson correlation bet ween emission measurements and the larget variable's Hamming weight:
cpa(px,)) = [ VVar Var(HW(Y))
(15)
where HW: : (o.. 2d -1] + (0.. ..] maps integers to the sum of their bits when writing them as an unsigned integer.
While techniques such as these are invaluable due to their simplicity, interpretability and low cost, they have major shortcomings. Notably, they consider they are sensitive only to pairwise associations between single emission measurements and the target variable and will consider the measurement Xt to be non-leaky when it is nonleaky in isolation but gives exploitable information when combined with X, for some T * t. iee. when X]] = 0 but 3r # t such that [|Y;X, X+] > 0.
Additionally, these techniques make strong assumptions about the nature of px.y which have generally been observed to hold in practice, but nonetheless introduce the risk of failing to detect leaking measurements. SNR and SOSD) are sensitive only to the influence of Y on the mean of X, and would fail to identify X, is leaking if Y changes its distribution while leaving its mean unchanged (e.g. if the variance of X, changes with Y). CPA is sensitive only to associations between X, and the Hamming weight of Y, and additionally assumes a lincar relationship between these variables.
While the present work concerns mainly 'black box' leakage localization algorithms which make minimal assumptions about the cryptographic implementation being evaluated, in practice these parametric methods are often employed as tools in whitc-box analyses of implementations. For example, in our work we consider the ASCADv1 datasets (Benadjila et. al.] 2020), which use a Boolean masking countermeasure and thus have mainly second-order leakage. This renders the above methods ineffective when directly analyzing leakage of their canonical target variable. However, (Egger et al. (2022) identified 4 pairs of internal AES variables which individually have first-order leakage and may be combined to determine the target variable. Thus, if one is aware a priori that these variables leak and has access to the internal randomly-generatte Boolean mask variables, they may individually analyze leakage of these variables with the above methods and accumulate the results. We use such an approach to compute 'ground truth' Icakiness measurements when running experiments on the ASCADv1 datasets. We emphasize that this type of analysis is challenging and error-prone: multiple leaking variable identified by Egger al. (2022) were unknown or overlooked by Benadjila et al. (2020), who introduced the dataset. This underscores the importance of black box techniques such as ours to supplement white box analysis.
C.2 Neural net attribution methods
There is a great deal of prior work on localizing leakage based on interpretability tochniques to determine the relative importance of input features to a deep neural net which has been trained to model py Py|x [x
using standard supervised deep learning techniques (Masure et al. 2019 Hettwer et al.
2020 Jin et al. 2020
Zaid et al., 2020 Wouters et al.) 2020 van der Valk et al. 2021] Wu & Johnson 2021
Golder et al. 2022 Li
ct al. 2022 Perin et al. 2022 Schamberger et al.] 2023
Yap et al. 2023) Li et al.
2024 Yap et al.
2025
As baselines we consider the recent. works Yarks|Yap et al. (2025 Schamberger el al. 20233 as well as a variely of
older neural net attribution techniques which were compared in Masure et al. (2019): Hettwer et al.
(020 ;
Wouters et al. (2020). Note that our choice of deep lcarning baselines subsumes those of Yap al.
2025
Schamberger et al. (2023). Since these methods all 'interpret' a trained deep neural net, we view them as
functions mapping the data distribution px,y as well as model frix s.t. softmax by x PY|X to vector
26

---

Published in Transactions on Machine Learning Research (03/2026)
of leakiness estimates in R². Here we summarize and discuss the works Masure et al. (2019) Hettwer et al.
(2020): Wouters et al. 2020 Schamberger et al. (2023) Yap et al. (2025] which we consider as baselines.
To our knowledge Masure et al. (019 were the first to explore neural net interpretability for leakage localization, proposing the Saliency- GradVis leakage assessment, defined as
GradVis(px.r:fyxxx == Ex,y Ve logsoftmax Xx) (Y x>|a=x|
(16)
Hettwer et al. 2020) subsequently compared the 1-Occlusion Zeileer & Fergus 2014), Saliency (Simonyan
et al. 2014). and layerwise relevance propagation (LRP) (Bach et al. 2015) as leakage localization techniques.
The 1-Occlusion technique is based on computing the size of change in the model's prediction as each
individual input feature is 'occluded' (replaced by 0), and is defined as
1-0cchssion(px..:Pyxxxx == Ex,y (| X) Pvix(( | (1- :t= :t=.....,
(17)
where I denotes the vector in RT with element t equal to 1 and all other elements equal to 0. Saliency is defined as
Salioncy(px.x::Pyxx = Ex,y V x x==x-
(18)
LRP (Bach et al. 2015) is a gradient-basee explainability technique which is more-complicated than the above, and we refer readers to Bach et al. (2015) for an explanation. Wouters et al. (202)) applied the Input * Grad method (Shrikumar al.] 2017) to leakage localization; as its name suggests, this method is defined
Input * Grad(yx.r: == Ex,Y X + V (x) x=
(19)
We find that all these techniques have a tendency to incorrectly assign low leakiness to cortain measurements, particularly in scenarios where lots of features have significant leakage. We suspect that a primary reason for this is that these methods rely on pertur bing the input Ia the function Pr (y "......,...,,77777
but when Y is almost entirely determined by X, for + t, it becomes nearly independent of X, conditioned (X .r) \ (X1), i.e. d (y x, : =1 1, .,, 7) R Pxjx (v x, :T 1...., 1, 1, 1,...,,) T). We demonstrrae this phenomenon with simple Gaussian mixture model setting in Sec.
We also consider the recent works Schamberger et al. (0223 Yap et al. (2025) which estimate leakiness by perturbing many imputs simultancously to a classifier, and do not necessarily suffer from the same issue. Schamberger et al. (2023) presents the m-Oocllusoo technique, which is like 1-Occlusion except. that it occludes m-diameter windows rather than single points. This could plausibly overcome the aforementioned issue if the 'redundant' points are temporally-local. However, it has undesirable 'smoothing' effect where the estimated leakiness of a single point is tied to those of nearby points. Schambeerger et al. (2023) also proposes to use 2od-order m-Occlusion to analyze leakiness, where pairs of windows are occluded rather than only individual windows. This is computationalll-expeeeei the dataset where T is the data dimensionality. Additionally, Schamberger et al. (2023) proposes it as a means to determine whether a measurement has first-order leakage or is part sccond-order leaking pair, and does not explore its use for ainle-measuremeen leakiness estimation. In our experiments we find it only marginally-better than 1-Occlusion for this task, and not worth the significantly-highee cost. Yap et al. (2025) proposes the OcePOl technique, which aims to identify a non-unique minimal set of measurements sufficient for a neural net to attain some chosen classification performance when all other measurements are occluded. This differs from our other considered methods in that it does not assign a leakiness estimate to every measurement, and we find that it is ill-suited for our leakage localization task and performance metrics. Additionally, it is computatiionall--xppesss passes through the dataset.
because it requires ( passes through
computational
to run, requiring ((T) non-parallelizable
C.3 Numerical experiment illustrating conditional mutual information decay when many redundant leaking measurements are present
Here we provide a simple numerical experiment to illustrate conditional mutual information decay. Consider random variables Y ~ 1{11,1} and X1, X1,..., Xa Lidd NV(Y In Fig. g we plot the quantity T[Y; X,,
27

---

Published in Transactions on Machine Learning Research (03/2026)
10
H[
10-1
[|;XX] x2 X,l
100
10-2
10-3
10-1
5 10
15
Figure A numorical experiment evaluating the scaling behavior of I[:: Xn ,,,..., Xn-1] vs. n for varions values of o, where Y ~ 1f11,1 and X Xn iid. N(Y,o3) Observe that for small a, cach X, is approxtmately point mass Y and we have I[;; X1] H[Y] and I[Y: X, .n....,xn-11 ~ 0 for all 1. When a is large, each X; gives us little information about Y and we have I[V; Xn XI...., X.- < H[ approximately constant with n sufficiently small.
X vs. n. We see that for various values of a the quantity decays rapidly with n, and appears to be well-described by the function T[Y; X₁ X2,...,A,l 2 The for some I E R+, k E (0,1). Informally, the fact that conditional mutual information decays with n makes sense for the following reason: each successive X, can be viewed as an independent 'noisy observation' of which reduces uncertainty about it [i]++... I[Y: X,,
without fully determining it. For all have 0 < T[Y; X1,..., ......,,]]]] = [[] + T[;; . < [H[[]] If we assume that each [[Y; Xm XI...., X x is nonnegative, then for their sum to stay bounded they must converge to O.
D Extended method with derivations
(Xi...,,Tr) we seek to assign to each timestep scalar 7; indicating the 'amount of leakage' about Y due to X,- All of the quantities I[X; S for S (X.....,
Given X, Y PX,Y as defined in section where X
{Xe) are relevant to the 'leakiness' of X,, but it is not clear how to weight these 2 quantities into single scalar measurement. Most prior work simply ignores most of these quantities: the first-order parametric methods (Mangard et al. 2007 Brier et al. [004 Chari et al. (2003) consider only the pairwise terms I[Y; Xy), and GradVis (Masure et al. 2019). Saliency (Simonyan et al. 2014 Hettwer et al.) 2020), 1-Occlusion (Zeiler & Fergus 2014 Hettwer et al. (0200). , I.RP (Bach al. 2015 Hettwer al. 2020)]
Input Grad (Shrikumar et al. [017 Wouters et al. 2020) may looscly be viewed as computing proxies for IY; X, X X-yr). While mn-Oeclusion, 2nd ooder m-Occllsion (Schamberger al.) 2023 and OccPOI (Yap) et al. 2025 are sensitive to more of these terms, they still ignore almost all of them in an ad hoc manner.
In this soction we propose constrained optimization problem which implicitly defines an intuitively- reasonable definition of 7, which is sensitive to I[Y; X, S] for all S C (Xi,..., X,) (X,). We then propose an adversarial deep learning algorithm which lets us approximately solve it by modeling all the conditional distributions Py|s an amortized manner which emphasizes those with a large impact on the objective. While our objective sum over 2n occlusion mask-like values, in practice we find we can efficiently optimize it using the reparameterization trick (Kingma & Welling 2014
Rezende et al. 2014) with CONCRETF-like
28

---

Published in Transactions on Machine Learning Research (03/2026)
relaxation (Jang et al. 2017 Maddison et al. 2017] of our objective. This lets exploit first-order gradient
information, in contrast to 'hard' occlusion-basee methods such as Schamberger el. al. (2023) Yap et al. (2025) which leverage only zeroth-order information.
D.1 Optimization problem
1|" We define vector y [0, which name the occlusion probabilities. distribution over binary vectors in {0, 11 follows:
We use y paramcterize
Ay PA, where Ay, {
=
with probability -
(20)
with probability Yt.
ie. Ay is vector of independent Bernoulli random variables where the t-th element has parameter 1- For arbitrary vectors E RR?" E {0, , let us denote Fa == (æt : = 1, ...... T a 1), i.e. the sub-vector of æ containing its elements for which the corresponding element of is 1. We can accordingly use Ay to obtain random sub-vectors XA, of X. Note that % denotes the probability that X2 will not be an element of XA, (hence, 'ocelusion probability").
We assign each element of 'cost', defined as
I-z x < 1
:: [0, 1] +
(21)
x = 1
We seek to solve the constrained optimization problem
min 7
Lideal(T)) = ==;: A1J such that Σ cn) =C
(22)
for hyperparameter C>0 0. Note that e is strictly-increasing with c(0) = 0 and limg- d(x) = ao so that for a<1
finite C any optimal will be in 10, and increasing some necessarily entails reducing some other Yr. T * t. Additionally, for each & we can re-write our objective as
Lideal (7)
Σ PA (a)
(23)
aE(0.1)
Σ
PA PA (4 (1 [[; Xal xal+
(24)
aE(0.11
0==0
Σ
PA PAy.-. (a II; Oa. Xa] - 7 IY;
Xall
(25)
ac "
a,=0
which implics
@Lideally)
Σ (a. X.). _0
(26)
On
02
D.2 Estimating mutual information with deep neural nets
We cannot solve equation 22 directly because we lack an expression for Px,y. Here we derive an equivalent optimization problem which uses deep learning to characterize px,y using data.
Consider the family (#a)aE(0.)T with each element deep neural net.
Φ Y Et x R [0, (v, ma 0) Paly Fa;
(27)
29

---

Published in Transactions on Machine Learning Research (03/2026)
We assume each aa(- æx; 0) is probability mass function over Y (e.g. the neural net has softmax output activation).
We define the optimization problem
min max y DER"
Lr =E (Y X) such that Σ dd)
(28)
Proposition D.1. Consider the objective function Lady of equation 28 Suppose there erists some 0 RR such that (a Cxi 0*) Py (y va) for all {0, 13" E
E Y. Then
0" arg max Cavv (7, Vy E [0.
(29)
DER
Purthermore, for all y E Y and for all E (0, 1J, a 10 such that PA, (A)(a) > 0,
a Fai 0) -rIxx (y Ta) px palommost surely vi E arg min Ladv (7; 0)
(30)
DERP
Proof. Note that since each &a( æx 0) is a probability mass function over Y, by Gibbs' inequality we have
E log (Y (Y| Xa: 0) S Elogpy xa (Y Xa) va E (0,11",0ER"
(31)
Thus,
Ladv(y, 0-) Laav(7,0) V0 "
(32)
which implies the first claim.
Next, consider some fixed y E [0, 1)" and Ô e arg minger" Ladv(y, 0). We must have Cadv (7, 0) Ladv (7,0")
Thus,
Ladv (a, 0²) Ladvvly, Q)
(33)
E llgpPrIx (Y Xx) log 1 (Y Xx: 0)
(34)
Σ PA logprix.. (Y Xa) log 4a xa:0)] aE(0.1)T
(35)
By Gibbs' inequality, each of the expectations in the summation is nonnegative, which implies that whenever PA, (a) > we must have
0 E loggy PYSPYIX X. (Y Xx) log (Y Xx: 0)]
(36)
/ Dr or Pxa (xa) KLL px|Xa (- xaa || la (- wai 03] dx
(37)
Since KL |rIx__ ( xa)) || a. 0] 2 O with equality if and only if py (y x.) = Da (y Da; 0)
Vy E Y, this must be the case except possibly for a E RT where
J ( pxa (Da) (xa dxa =0 [ px (x( dx 0.
(38)
This implies the second claim.
Corollary D.2. Under the assumplions of Proposition D..1 equalions
2D and
28 are equivalent.
30

---

Published in Transactions on Machine Learning Research (03/2026)
Proof.
Observe that for any 7 [0, 1]".
max Ladv (r, 0) max E log A, (Y) XA, (Y XA,:0)
(39)
OER
DER"
Σ
PA, (a) BlogPyX, (Y) Xa) by Prop. D.1
(40)
f0,11
Σ PA) Xa
(41)
aE(0.1)
Σ PA (0) [H[ - H| Xall
because HY] is not function of y
(42)
aE(0,1)
E (0,1))
PAy (a)
(3
1|Y; Ay]
(44)
Cideal(7).
(45)
This implics the result.
Corollary D.3. Suppose the assumptions of Proposition D.1 are satisfied, and let Ô E arg millgER* p. Ladv (7, 0)
for some 7 E [0, 11". Consider a a' + a" where a a E {0,1)T such that al, = o and af"" 1 = ar = 0, and P.A. (ax) >> O. For all y Y, it follows immediately from Proposition D.1 that px palootost everywhere we
our classifiers to compute the pointwise matual information quantittes
pmi(y; For (ae)) logprox (y) xa) bogprix_co (y) Eer))
(46)
log ( Fa: 0) log t. (y) Te'"; O).
(47)
This is useful because it allows to assess leakage from single power traces, opposed to mercly summarizing distributions of power traces. There are scenarios where a power measurement might leak for some traces but not for others. For example, a common countermeasure is to randomly delay leaky instructions or swap their order with another instruction so that they do not occur at a deterministic time relative to the start of encryption. One could use pmi computations to determine the timetep at which the leaky instruction has been run a single trace.
Since it would be impractical to train 2 deep neural networks independently, we implement the family of classifiers by single neural net with imput dropout and with the dropout mask fed to the neural net as auxiliary input:
+ Y R 10,13a
R [0, (y, a, 0) P(y x ar
(48)
where ( Tx: 0) = ( x ② a, or; 0). This approach was inspired by Lippe et al. (2022)
D.3 Re-parametrization into unconstrained optimization problem
We would like to approximately solve equation 28 using alternating stochastic gradient descent-style
approach, similarly to GANs (Goodfellow et al. 2014 optimization problem. We first define new vector n A- where AT-1 ((ō1,-.., 5r) R Σt= &
Thus, it is convenient to express it as an unconstrained
1} denotes the T T-simplex. We then define r to be the vector satisfying the equality
c(7)) Ctp
(49)
7
Cn
(50)
7t
log 7:
log(1 7t) log C log n)
(51)
sigmoid (log C' + lt).
(52)
31

---

Published in Transactions on Machine Learning Research (03/2026)
If we define 17 softmax(m) for rj R.," then we express
Y sigmoid (log C' + log n. logsumexp(ri)).
(53)
which allows to map the unconstrained vector vi 7 or log y using numerically-stable PyTorch operations. Our constrained optimization problem 28 is thus equivalent to the following unconstrained problem:
min max N DERP
L 0) = Elog & (Y) X @ (
(54)
D.4 Implementation details
It is infeasible to exactly compute the expectation with respect to Ay(i)) because doing so would require summing over 2 terms. As is routine in deep learning contexts, we instead approximate the gradient with Monte Carlo integration. Note that our objective" takes the form [(n) = E f (A))))) where f(a) = Ex,y log (Y X ④ at, oz; 0) and the distribution of Aym depends on n..
Unbiased estimators for Vnf(n) of this form are usually based on the REINFORCE estimator (Williams 1992/ with control variates, and tend to have complicated implementations and high variance. We tried using the vanilla REINFORCE estimator with simple control variates as well as the morc-sophisticated REBAR estimator (Tucker et al. 2017), and found that the former works poorly, while the latter works well. Subsequent ablation studies revealed that the biased CONCRETE estimator (Maddison et al. 2017) works almost as well as REBAR for our application and is considerably simpler, so in this work we use CONCRETE.
The CONCRETE estimator lets us write Ay( as deterministic function of v and i-independent noise and thereby use the reparameterization trick to estimate V,,((r) using standard automatic differentiation tools. For binary random variables such the elements of Ax()), the estimator is built on the observation that
Bernoullipp) = Hlog log((1 p) log u - loog(1 - u)) for 1))
(55)
where H(x) [1 x 220 denotes the unit step function. H is not amenable to gradient descent because 0
x <<0
its derivative is zero almost everywhere, but we can approximate it with the tempered sigmoid function sigmoid, (ar) == sigmoid(x//)). The temperature parameter T > 0 can be tuned to control a bias-variance H(z) Yz E (0), but variance increases as (L/TT)
tradeoff for the estimator: lim (z) (Shekhovtsov 2021). We find that results are reasonable when we simply leave t fixed at 1, and we do this throughout the present work. We conjecture that this is because all our performance evaluation metrics consider only the relative leakiness estimates produced by our method, and the nature of the bias is not to significantly impact the relative sizes of the elements of y*
Note that while our original loss function
{ 0, y. a)) == log ( x @ az @ o;;
(56)
is written for a 'hard' occlusion mask a E 13 the relaxed occlusion masks lie inside the open ball (0, 1) Thus, we must relax our loss function to accept these inputs as well. While the right-hand side of Equ. 56 is
still a valid expression for a in 1) its optimal value of this loss with respect to 0 does not vary smoothly
with a because rescaling the elements of X by nonzero constants does not change its mutual information with Y. Thus, we instead use the stochastic relaxed loss function
frelaxed (17 2. y. a) log (gy x 10a (1 (1- a): where E 10,
(57)
In Alg. we provide pseudocode for a practical implementation of ALL, omitting details such as minibatch use for clarity. Also refer to this link for minimal self-contained Torch Paszke et al.. 2019 implementation.
Aignoring its dedeendeecc because differentiating with respect to 0 straigh here
32

---

Published in Transactions on Machine Learning Research (03/2026)
Algorithm 2: Simplified implementation of our Adversarial Leakage Localization (ALL) algorithm.
Input: Dataset = (() y(*)) n ll....,, N] C R. xY, mask-conditional classifier architecture
$ RT. [0, 10 R initial classifier weights 0g RR,, initial pre-constraint occlusion logits ti R occlusion budget E 10,
Output: Per-timestep 'leakiness' estimate 7 [0,
Function getOcc1ProbLogits (n) R²,; pre-constraint logits of occlusion probabilities)
return " logsumexp( log T log 7 log(1 >)
Function sampleFroomCNNREETE (5 E (0, 1) logits of occlusion probabilities)
return sigmnoi(((ggsiggnoii((() logsigmoid(-$) log log(1 u)), 1),
Function getMaskedCroaEEnttropy (0 RRP: classifier weights, (æ. R Y: input and label,
E (0, 1)": relaxed input mask)
rreturn logsoflmax P (1 (1) a a), *~N(0,11)
for L= 0, l,... until convergence do
(a,, y1) + sampleDatapoint(()
7: + getOcctPrroblogtts(()))
a: f sampleFTromcoOncEETE(}}]]
10
11
l gethaakeeeCros@fatttopp((,,,C (t)
g. + Vol. -.¹ + - Vi,,, 0 + (". M1t1 + (pt:tee(Ai:.g.!
12
13 return sigmoid get:occ11rooloogtts(()))))
33

---

Published in Transactions on Machine Learning Research (03/2026)
E Extended experimental details and results
E.1
Toy setting where our method succeeds and prior work fails
1.0
Oracle
Best m-ncclusion
Random
OcePOI
Best parametric
ALL (onEs)
Best gradicat-based
0.8
False negative rate J
0.6
0.4
0.2
0.0
100
101
102
103
10
Number of second-order leaky pairs: D
Figure 9: A loy setting where ALL (ours) significantly outperforms baselines. We sample 1 non-leaky feature and D second-order leaky pairs, then plot the false negative rate, defined as the proportion of points incorrectly assigned leakiness loss than or equal to that of the non-lcaky point, as we incrcase D. ALL (ours) succcods for D up to 64x higher the best prior deep learning- based approach, and the first-order parametric methods completely fail in this setting. Dots denote median and error bars denote min-max over 5 random seeds.
As previously discussed, first-order parametric statistics- based methods are inscnsitive to associations of order or higher. Prior deep learning- based leakage localization algorithms tend to exploit few of the available 2T-1 associations between X, and Y given subsets of (X1...., x,....,,,>>> (X,), with many of them using only the maximal conditioning set {X Xr) \ {X,) itself. This creates issues when there large number of leaky measurements and the individual contribution of each is 'drowned out' in the sense that T[;; {X,,..., Xr) \ (X,) vanishes. Here construct simple setting where both of these issues present, and demonstrate that ALL succeeds whereas the prior approaches face issucs.
We generate sequence of binary-label 2D + 1-feature classification datasets consisting of ordered pairs (X, Y) sampled independently as follows:
Y ~~ 1}, R ~ 14000 1), M, [(0,1) i= 1...., D. Xn ~ ((R 1), XM, ~ N(M, 1), XYÆM, ~ N(Y e M, 1,.... D.
(58)
(59)
Here we denote by @ the exclusive-or operation and X = (XR, XM XYoM XM XYœM,), Intuitively, we can view X as a noisy observation of R and each XM,, XYeM, as noisy observations of M,, t M,. respectively. Here the variable Y analogous to targeted sensitive variable, and the values (M, Y O M,) are analogous the pairs of second-order leaky variables which arise in Boolean masked implementations
such Benadjila et al. (2220)-
34

---

Published in Transactions on Machine Learning Research (03/2026)
Clearly R. and thus XR, tells nothing about Y. Additionally, the values M, in isolation tell nothing about Y. Similarly, the values Y @ M; in isolation tell us nothing about Y because.
= Y + M, 0) PMM = 0) P(M 1) PV
(60)
and similarly
P M, = = 1) - = -
- M, 1).
(61)
Despite this, given the pair of values (M, Y + M4} we recover Y via the identity
M, + M. = 0 = (Y
(62)
Thus, we would like a leakage localization algorithm to indicate that XR non-leaky and the values M,, XYœM are leaky.
All experiments use the hyperparameters shown in Table 5
Table 5: Hyperparameters used for our toy Gaussian dataset experiments. We use the default PyTorch settings except where specified. 'Thse hyperparameters apply only to ALL. Other hyperparameters are used both for ALL and for our bascline methods.
Hyperparameter
Value
Classificr architecture
ReLU MLP with 1 x 500-neuron hidden layer
Classifier optimizer
AdamW
Classifier learning rate
10-4
Classificr weight docay
0.01
Dataset size
10k
Training steps
5k
Minibatch size
800
Noise distribution learning ratef
10
Budget şी
1-2
Results can be seen in Fig. 9 We measure the performance of methods by the percent measurements in (XM, i 1,..., D) (XYaM,
I,..., D} assigned a leakiness greater than or equal that of XR. For clarity we report for each D the best result out of SNR, SOSD and CPA as 'best parametric', out of GradVis, Saliency, Input Grad, and LRP as 'best gradient-based", and the best result out of (2m + 1: m E [0 .. 24], m < 2D O--Cuuuuionn as 'best mn-occlusion. Due to their high cost we use OccPOI only for D to 256, and we do not use 2rd-order m--oclusion. Note that in subsequent experiments 2ud 2ud-order m-Oeclusion does not significantly outperform first-order occlusion, and OcePO1 performs poorly due to identifying only a small number of leaky measurements rather than assigning a leakiness to every measurement.
E.2 Simulated AES datasets where we have ground truth knowledge about leakage
Here we present experiments done on synthetic AES power traces. These are useful complement to the experiments on real datasets because 1) here we have ground truth knowledge about which timesteps are leaking, which we can use to validate our model's output, 2) we can generate infinitely-large datasets to climinate datasct size a confounding variable in results, and 3) we can observe the change in our technique's behavior we individually vary particular dataset properties such as low-pass filtering strength and Icaky instruction count.
35

---

Published in Transactions on Machine Learning Research (03/2026)
Algorithm 3: Pseudocode for our synthetic data generation procedure, based on the Hamming weight leakage model of Mangard et al. (2007). For clarity we omit the random delay and shuffligg procedures, but these are straightforward and may be found in our code.
Input:
Dataset size N Z+++
Timesteps per power trace T E Z++1
Bit count Abits E Z++:
Operation count Yhpps E 2
Data-dependent noise variance daata E R++,
Operation-dependent noise variance 2 E T4,, Residual noise variance Tesid R+: Low-pass filtering rength B (0,
Leaking timestep count Bikk E Σ
Output: Synthetic dataset D C RR X [0 2 - 1]
{k(m) nn [1 } ~ ~u (f0, 13 1) N
// AES keys
{w(n),
N]] ~ 21 (10, 13 Abiee ) for lo:te e [1 77} ~ 4 ([1 Rops 1) N
// plaintexts
// operations
[Top. : E Nops]] ~ A (O, oop
Mope
// operationndeeenderi power consumption
Tikg ~ u [1.. T]
// timesteps of leaky instructions
nikg
for E [I.. .] do
y(m) < Sbox((((n) @ (m)) (n)
// targeted variable: first SubBytes output // residual power consumption
Fresid ~N(0, of
for / E Tikg do
L 1(t) (n)
10
1/ leaky timesteps: targeted variable is the data
11
for t [1 .. T] Tikg do
12
1 ~ 11 (f0, Rbica)
// rest of data treated as random // kata-dependent power consumption
13
for E [1 [. T] do
data, + Odata (1 (4- (4-HW(d)))) //2
14
15
(1) + datta + Dop + wosid
// total power consumption
16
for t E .2.. T] do
Ft. (n) + Ax (n)
// Discrete low-pass filtering of (n). 1/ In practice we prepend 'burn-in' timesteps to allow transient effects to decay.
(1 f)x(") (m)
17
return (xx(") ((())) E [1 [1.. N1)
36

---

Published in Transactions on Machine Learning Research (03/2026)
Di-1
Dt
D+1
X data, 1-1
XX data, t
XX data, t+1
Xx-1
X
Xe11
Xresid, t-1
Xresid,
X resid, e+1
X 1-1
Xop, t
X op, f+1
O--1
O
0++1
Observed random variable
Unobserved confounder representing arbitrary data/operation associations
Unobserved random variable
Causal dependency
Figure 10: Causal diagram representing the assumed data-generating process for our synthetic AES datasets. We assume this is an I-map for the data- getaaaeenrating process i.e. we assume independence conditions present in the diagram hold for the data-generating process, but the data-generating process might have additional independence conditions not reflected here. This is effort to make more precise the Hamming weight leakage model of (Mangard et al. 2007 ch. 4). We represent the data of the AES algorithm by the random variables Dr, its operations O,, and its power consumption X,, which is further broken down into data-dependent power consumption Xdata, operation-deepndeen power consumption Xop. t. and 'residual' power consumption Xresid, (e.g. due to random noise, other processes running parallel, etc.). We assume that only the composite power consumption X, is observed.
37

---

Published in Transactions on Machine Learning Research (03/2026)
E.2.1 Data generation procedure
We base our synthetic data generation procedure on the Hammiing weight leakage model of (Mangard et al, 2007] ch. 4), which we will subsequently describe [ As above, let us represent our power/EM traces as a random vector X = (X, : 1,...,. ,,T) with range RT. We represent the cryptographic algorithm as soquences of data D = (Dz :t =........ ,,,.., T) and operations O == (O2 :0:t= ,,..,, T), where each De has range {0, 1] Jhhne and each O, has range [1 .. Nops for some Ahitss Maps E 2 For each E [1 T], we can decompose
X₁ Xdata, e Xop,t + Xresdd,
(63)
with dependency structure illustrated in the causal diagram of Fig. T0 Here we have represented by Xdata, the data-dependent component of power consumption, Xop, the operation-dependent component of power consumption, and Xresid, e the 'residual' power consumption due to random noise, other processes running simultaneously on the same hardware, etc.
Mangard et al. 2007 experimentally characterized the power consumption of a cryptographic device and found that it is reasonable to approximate Xdata, e as Gaussian noise with D,-dependent mean, Xop, as Gaussian noise with O-dependent mean, and Xresid, as Gaussian noise with constant mean (which we will assumee to be zero because it contains information and is thus irrelevant). For their device, they found that the mcan of X e was roughly proportional to Ahits HW(D:) where HW : {0, 1) Rhiae + [0.. /Piitts x + ==1 The We adopt these approximations for our synthetic dataset experiments. See Alg, [ for pseudocode giving a simplified version of our data gencration procodure, and refer to our code for full details.
We simulate several factors of variation which can reasonably be expected to occur in realistic settings. We apply discrete-time low-pass filtering the power traces, to simulate the low-pass filtering which occurs due to measurement apparatus as well as the fact that power consumption does not change instantaneously in real circuits. We allow for the presence of multiple leaky instructions. Additionally, we simulate random delays to the leaky instruction which might result from countermeasures such as random no-op insertion (Coron& & Kizhvatov] 2009), and random 'shuffling' where the leaky instruction is randomly placed at one of several points in time, as done in Masure & Strullu (2023).
We emphasize that these approximations are specific to the device studied by Mangard et al. (007 and may hold to a limited extent or not at all for other devices. For example, the Hamming weight dependence of power consumption stems from the fact. that their device 'pre-charges' all its data bus lines to 1, then drains the charge from the lines which should represent O, thereby consuming power proportional to the number of lines which represent 0. Many devices operate differently, and cryptographic hardware is often designed with the explicit goal of obfuscating this data/pol hawwer consumption dependence. Thus, while we expect all real cryptographic devices to have some exploitable dependence between data and power consumption given sufficient quality and quantity of data, in many cases the nature of the dependence will likely elude a simple characterization such as this.
E.2.2 Experimental details
We run experiments on many variations of this dataset and verify that ALL produces outputs which align with our expectations. For all these experiments, our classifier &e is a 3-layer multilayer perceptron with hidden dimension 500, ReLU activations, an input dropout rate of 0.1, hidden dropout rate of 0.2, and pre-logits dropout rate of 0.3. We generate data continuously so that our dataset size is effectively infinite. Additional hyperparamoters are listed in table [ and default settings corresponding to Alg. are listed in table 7 which we use except where otherwise stated.
E.2.3 Results
We vary 4 parameters of the data generation process of Alg. and observe its effect on the output of ALL. We find that. ALL consistently produces results consistent with our expectations given the timestep(s) of
For clarity alter the notation and explicitly define a causal structure for the data-gencrating process. The decomposition of power consumption in Eqn. 63 and the definition of Xasta, terms of the Hamming weight of the data are based Mangard al. 20007) but the additional details are our own.
38

---

Published in Transactions on Machine Learning Research (03/2026)
Table 6: List of hyperparameters used for experiments on synthetic AES datasets. We use the default PyTorrh settings unless otherwise stated. Note that in general for ALL classfiers we disable input dropout, but for these experiments the dropout rate was to 0.1 due an oversight.
Hyperparameter
Value
Classifier architecture
ReLU MLP with 3 x 500-neuron hidden layers
Input dropout
0.1
Hidden dropout
0.2
Output dropout
0.3
Optimizer for both and f
torch. torch.optim. AdamW
Weight decay for
0.01 for weights, for biases
Weight decay for
0
Training steps
10a
Minibatch size
103
Noise budget 7
0.5
Weight initializer
torch. nn. init. xavier. xavier_uniform,
Table 7: Default synthetic AES dataset configuration, corresponding to the inputs of Alg. experiments will use these settings unless otherwise stated.
Subsequent
Setting
Value
Dataset size N
8
Timesteps per power trace T
101
Bit count Ubiit
Operation count 7op
32
Data-dependent noise variance 2
1.0
Operation-dependentt noise variance o
1.0
Residual noise variance ofeiid
1.0
Number of leaky instructions fik
1
Low-pass filtering strength 3 Maximum random delay size
0.5
Possible leaky timestep location count (i.c. shuffling)
the Ieaky instruction(s), and that the variance of its output is quite low in this context where we have infinitely-large dataset and long training duration. Here we describe the parameters being swept and justify the output of ALL given this.
Low pass filtering strength 3 Recall that we are discrete low-pass filtering traces via the recursive function 2 = (1 8)x² + 3I See the first row of Fig. 11 where from left to right 3 takes on the values 0, 0.5, 0.75, 0.875, 0.9375, 0.96875, 0.984375, 0.9921875. Note that the peak estimated leakiness always corresponds to the ground-truth leaky instruction timestep. As we increase B we see that measurements the left and right are assigned high leakiness as well, which makes sense for the following reason:
Let denote by t" the timestep at which the leaky instruction ci HWW c2Ur- + - where Ui- denotes a 'residual' random variable independent of Y, and Cı, C2 are appropriate constants. Note that X 3X. + (1 B)U = 8c, HW(Y) + BczU,. + (1 - 3)U X also leaks Y. Recursively it clear that the same can be said for X X Less-intuilively, X,--1 also leaks Y. This is because although - is marginally independent Y, X - - has a higher correlation with HW(Y) than X,- does i.c. X,-- dependent on the Y-independent noise of X and can be used to reduce the noise. Recursively, since X -2- X -3...... are correlated with X they also leak Y by the same mechanism.
executed. We then have X,-
39

---

Published in Transactions on Machine Learning Research (03/2026)
Ladly pa.
Te 2011
Tenky CR..
Tealy
Lody
Lody
Max toa
Mac moopore
Mis roopo
Mac may or
Max rovegeer 13
Mas moop
Mos rovep ert
Max www.o.o... one. 25
Staffl
Staffe
Shemeo
Stuffelee
Shafll
Figure 11: Results of applying ALL (ours) to synthetic AES datasots with varying parameters. The estimatod leakage by ALL denoted by blue dots and the ground truth timestep of the leaking instruction is denoted by the vertical black dotted lines. Blue dots denote mean and shading denotes median over 5 random seeds. Note that the ALL output is consistent with the ground truth leaky instruction timestep in all cases, and the variance between runs is quite low in the infinite data regime. (first row) Increasing low pass filtering strength 3 from left to right. (second row) Increasing number of leaky instructions from left to right. (third row) Increasing random delay insertion from left to right. (fourth row) Increasing number possible shuffling locations for the leaky point from left to right.
Leaky point count Here we sweep the number of leaky instructions. See the second row of Fig. [I where from left right the leaky point count Bikg takes on the values 0, 1, 3, 5, 7, 9, 11, 13. As expected, all leaky instruction timesteps correspond peak of ALL-estimated leakiness.
Random delay size Here we insert random delays - i.e. instead of always occurring at time f, the leaky instruction occurs at + u where u (0....., dmax- See the third row of Fig. 11 where from left right dmax takes on values 0, 1, 5, 9, 13, 17, 21, 25. We see that the estimated leakiness becomes 'spread out' over the interval [t.. dmax)]
Shuffle location count Here we randomly 'shuffle' the leaky instruction i.e instead of always occurring time t, the leaky instruction occurs t' (ttt...... fnaaa) ) See the fourth row of Fig. 7 where from left to right Nshuff takes values 1, 3, 7, 11, 13, 15. We that the leakiness becomes 'spread out' over the set of timesteps at which the leaky instruction might occur.
E.3 Experiments on real power and EM radiation leakage datasets
Here we run experiments on a variety of publicly-vvillbbl side-channel attack datasets, where we attempt to localize leakage of their canonical target variable.
E.3.1 Datasets
We compare ALL with prior work on the 6 datascts described in Table X which consist of traces of power and EM radiation measurements and associated cryptographic variables recorded from real implementations. Note that evaluate AES, ECC and RSA implementations implemented several MCUs and FPGA
40

---

Published in Transactions on Machine Learning Research (03/2026)
Table 8: list of the datasets used in our paper, with a summary of their salient attributes. Note that our experiments cover a variety of settings: AES, RSA and ECC implementations on both microcontrollers (MCUs) and progrmmlgreem gate array (FPGA), both power and EM radiation traces, and various types of countermeasures. For all datasets we localize leakage of the canonical target variable. We denote by subscripts the targeted byte of the variable. We denote by ki, Wny Ma, kns On the n-th byte (counting from 0) of the AES key, plaintext, mask, last round key, and ciphertext, respectively. AA described below, we deviate from the canonical profling/attacl split.
Dataset
ASCADv1 (fixed key)
ASCADv1 (variable key)
DPAr4 (Zaid version)
Citation
Benadjila al. 2020
Beuadiila al. 2020
Bhasin ct al. 2014 Zaid
2020
Link
[here]
[here)
[here]
Algorithm
AES- 128
AES-128
AFS: 128
Hardware
ATMega8515 (MCU)
ATMega8515 (MCU)
ATMega163 (MCU)
Emission measured
Power
Power
Power
Countermeasures
Boolean mesking
Boolean masking
Rotating Sbox mask (known)
Targeted variable
Sbox @ ws)
Shox(Ks d wyy)
Shox(Ko @ myy
Dataset size (profile/attuck)
50k/10k 0.7k
100k/10kk
3k/500*
Feature count T
1.4k
4k
Dataset
AES-IID
One Trace is All it Takes (OTiAFT)
Oue Truth Prevuls (OTP) (1024-bit)
Citation
Bhasin et al. 2020
Welsshart et al. 2019
Saito et al. 2022
Link
( [here]
(here)
[here]
Algorithm
AES-128
EdDSA w/ Curve2559
1024-bit RSA-CRT
Hardware
XiLinx Virtex-5 (FPGA)
STM32F4 (MCU)
STM32F4 (MCU)
Emission measured
EM radiation
Power
EM radiation
Countermessures
None
None
Dummy load
Targeted variable
Sbox - (A4, @ (11) 0er
Ephemeral key nibble
Dummy load?
Dataset size (profile/attuck)
50k/25k
5.12k/1.28k
100k/98 90kk//9.300kk
Feature count
1.25k
1k
1k
with various largel variables. ALL as well as most of our baseline algorithms are in principle agnostic to most of these details, requiring only a supervised learning-style dataset with power traces and the associated value of the targeted variable as labels. Through these experiments we demonstrate that this is true in practice across a diverse array of settings.
Note that the ASCADv1 datasets have primarily second-order leakage due to their Boolean masking countermeasure, whereas the other 4 datascts have primarily first-order Icakage. Our comparisons include both deep learning methods as well as simple first-order parametric methods which are widely used due to their low cost and interpretability. We find that the latter are competitive or superior to the deep learning methods on the first-order datasets but perform significantly worse on the second-order datasets due to failing to exploit second-order leakage. Our experiments do not compellingly show that deep learning methods improve on these simpler methods for first-order datasets, but we nonetheless include them as additional points of comparison between the deep learning methods and to show that ALL works in a variety of settings.
In general we use the canonical target variable and profiling/atie attack dataset split (note that in the context of profiling side-channel analysis the training dataset is called the profiling dataset, and the test dataset is called the attack datasot). We deviate from the canonical dataset configuration in the following cases:
We find that the canonical allack dataset of DPAv4 is too small to compute useful oracle leakiness assessments, We thus concatenate the canonical 4.5k-trace profiling dataset and 0.5k-trace attack datasct into single 5k-length dataset, and use the first 3k traces for profiling and the last 2k to compute the oracle assessments. Since some of our experiments require meladata which is only available for the attack dataset, for everything other than oracle assessment computation we use the canonical attack dataset and leave the remaining 1.5k traces unused.
We use the version of DPAv4 which was preprocessed and distributed by Zaid et al. (2020) here rather than the original version. This version has shortened traces which have been cropped around the leaky instruction, and has the rotating Sbox mask effectively 'disabled' by providing the masked SubBytes variable as the target.
41

---

Published in Transactions on Machine Learning Research (03/2026)
The One Truth Prevails (OTP) dataset consists of approximately 64M traces and has high label imbalance. To save computational resources we extract 100k-trace randomly-selected balanced subset, which we find is more than sufficient for strong supervised classification and leakage localization performance. See our code for details.
E.3.2
Implementation details for the leakage localization algorithms
Occlusion musk E [o, 1F"
Linear: R BIY
Linear Rd
500
Linear : -,000 -> -5500
Logits predictions
Trace a E It
ReLU Dropout(O.))
ReLU (ropout(0.2)
ReLU Dro3out(0.3)
P(Y = v X
Concatenate
d
x3
Used for the ALL classifier but not supervised classificrs
Disabled ALT. classifier. Enabled disabled based hyperpuraaneter search for supervised classifiers.
Figure 12:
Diagram of the multilayer perceptron architecture used for classifiers in the deep learning methods, based on the architecture proposed in Wang et al. (2017) for time-series classification.
For ALL and all considered baseline methods the classifier uses the simple ReLU + Dropout MLP architecture of Wann et al. (0177) shown in Fig. 12 which has 3 500-neuron hidden layers, input dropout rate of 0.1, hidden dropout rate of 0.2, and output dropout rate of 0.3. For the deep learning baselines we enable or disable the input, hidden and output dropout based on our hyperparameter search outcome, and for ALL we leave it disabled. The classifier for ALL takes the occlusion mask as an auxiliary input, which we implement by concatenating it with the masked trace.
We also explored convolutional architectures, but preliminary experiments indicated that these achieved weaker classification and leakage localization performance across the board, as well as training more-slowly than the MLP architecture due to higher layer count. We suspect that the inductive biases of convolutional layers are not useful for the datasets we consider. As sanity check for this design choice, we run the deep learning baseline methods using both our MLP architecture and a handful of open-weight classifiers which were released with Wouters et al. 2020 on the datasets for which they are available.
All deep learning methods are implemented in Pyforch (Paszke et al. 2019 Most non-deep methods are implemented with Numpy (Harris ct al., 2020). with a handful of compute-inttensive methods implemented with Numba {Lm et al. 2015). We use Scipy (Virtanen et al. 2020 implementations of statistical methods where available.
We use the AdamW optimizer [Lohhchloov & Hutter 2018 Kingma & Welling 2014] with the default Porch settings B1 = 0.9, 32 = 0.999, x = 0,01, e = 10 and the learning rate chosen through hyperparameter search. Weight decay is applied only to the weights of the linear layers, not the biases. We use a minibatch size of 256. Weights are initialized with the uniform Glorot initialization (Glorot & Bengio 2010) torch. nn. init. xavier uniform_ (default for Keras) rather than the default PyTorch initialization, and find that this is critical detail many supervised classifier runs on the ASCADv1 datasets completely fail to generalize beyond the training datasct when the default PyToor weight initialization is used. We randomly set aside 20% of the profiling datasets for validation and use the remaining 80% for training. We standardize the traces as x + maxie,10 oj where μ and or denote the elementwise sample mean and standard deviation computed using the profiling dataset.
general we measure the performance of supervised classifiers with their mean rank rather than their accuracy, as accuracy tends to be low and too-coarse in the context of sido-channel analysis. Given a label y and predicted label distribution py E AYIII (e.g. the softmaxed output of classifier neural net), we define the rank as the number of possible labels assigned at least much probability mass the true label,
42

---

Published in Transactions on Machine Learning Research (03/2026)
i.c.
Rank(fr: = 1V EY: fr 2 (r))) This metric has range [1 M]], with lower being better.
(64)
Implementation of the baseline methods We use Captum Kokhlikyan et al. 2020 implementations of the Saliency, Input * Grad, LRP; and m-Oeclusion methods. We implement SNR. SOSD, CPA, GradVis, and 2nd-order m-Oeclusion ourselves, and we implement a PyTorch version of OccPOT based on the Keras implementation released by the authors here
Note the following choices have made in implementing and evaluating OcePO1 Yap et al. 2025
OcePOI differs from the other methods we consider in that rather than assigning a leakiness value every measurement, it aims to identify a non-unique subset of measurements which are sufficient. for a classifier to aftain some specified performance level when all other measurements occluded. Since our evaluation metrics require leakiness value for every measurement, assign leakiness of 0 to measurements not identified by OcePOI.
Their method uses the attack dataset for probing the classifier's sensitivity to input features, which introduces data contamination in the context of our performance metrics. We cannot casily use the validation dataset instead because the attack procedure requires having many traces corresponding to a fixed AFS key, which generally only available for the attack dataset. We find that ALL significantly outperforms OccPOI despite this contamination, so as the aim of our work is to demonstrate the efficacy of ALL, we allow OcePOI to use the attack dataset.
Since OTIAiT and OTP do not have attack datasets which facilitate this kind of multi-trace prediction, for these dalasets we simply use the mean rank of the classifier on the atlack dataset our performance metric.
proposes an extension of OcePOI which ranks the leakiness of the points it has identified using a L-occhusion-lie strategy. We use this extension in our implementation.
Yap et al. (025
2025 proposes an extension of OcePO1 where they apply it repeatedly on the residual measurements not selected during the last iteration. We do not use this extension because is very computationally expensive, requiring O(T) applications of OcePOI which each require ?!TT') non-parallelizable passes through the attack datasct. In preliminary experiments this extension performed better than basic OcePOI, but still far below the performance of the other considered methods despite requiring orders of magnitude more wall clock time.
Yap et al.
Similarly to Yap et al. (2025). to save compute we use only subset of the attack datasets for classifier evaluation. We use 1.8k traces for SSCADvI-fixed 2.8k for ASCADy1-variable, 140 for DPAv4, 25k for AES-HD, 100 for OTiAÎT, and 100 for ОТP. These are approximately 10-100x the necessary mumber of traces successfully attack the AES methods.
Yap et al. (2025) define their performance threshold to be that the classifier correctly predicts the AES key after accumulating all traces in the attack dataset, and we use the same threshold for the ASCADv1 datasets, AES- HD, and DPAv4. For the non-AES dataset OTiAiT and OTP, our threshold is that the mean rank of the classifier rises by 0.1 relative to its mean rank when no measurements are occluded.
As we will show, OccPOI attains significantly lower performance than other methods according our performance metrics, due to not assigning leakiness to most measurements. This reflects that the aim of Yap et al. (2025) is somewhat different from the present work: Yap et al. (2025) heavily emphasized the usefulness of OcePOI as a feature selection tool with leakage localization being an auxiliary goal, whereas our work is concerned solely with leakage localization. We consider OcePOT as a baseline because is similar in spirit to our work, but these results demonstrate that is ill-suited to the task considered in our paper.
We make the following choices in implementing m- Occlusioo and 2nd order m- O--Cccusiion (Schamberger et al, 2023
43

---

Published in Transactions on Machine Learning Research (03/2026)
Schamberger al. (2023) explore different ways to occlude measurements and conchude that it works well to replace measurements by their average value over the profiling dataset, whereas other heuristics such as replacing them with 0 or with Gaussian noise works poorly. We thus replace measurements by their mean. Since we are element-wise standardizing the traces, this is the same as replacing them by 0.
Schamberger et al. (223) propose 2nd -oddrr m-Occlusion as means of estinating the leakiness of pairs of windows, which is useful for discerning whether measurement has first-order leakage or is part of a second-order leaking pair of measurements. They do not propose means of using it to estimate the leakiness of individual measurements. We choose to define the leakiness of X, as the average leakiness of the pairs {(X,, Xx) [T]]))-
Schamberger et al. 2023) uses large stride for 2od-order m-Oeclusion, and thus get leakiness values for windows of measurements rather than single measurements. We set the stride to 1 for consistency with our other basclincs.
These mothods introduce the occlusion window size as new hyperparameter which must be tuned. For m-Oecllsion we tune by testing successive odd-numbered window sizes starting from until oracle agreement performance starts decreasing, and using the window size which maximizes oracle agreement. We denote this as m m"-Occlusion. Note that this introduces some data contamination, which we accept because our aim is to demonstrate the efficacy of ALL, and ALL outperforms m-Ooclusion despite the contamination.
For 2nd-order m-Ooclusion we use the optimal value of m for m-Ooclusion. We denote this 2nd-order n'--Occlsionn. We don't 't do another sweep because 2nd-order m- m--eclusion is very computationally- expensive, requiring O(T²) passes through the dataset.
Like Yap et al. (2025 Schamberger ct al. (2023) uses the attack datasct to evaluate the scnsitivity of the classifier to occluding measurements. To avoid data contamination, and for compatibility with the OTiAiT and OTP datasets which do not have the same kind of attack dataset as the AES implementations, we track the average change in logits over the profiling dataset as we occlude measurements (similarly to 1-Occlusion).
E.3.3 Hyperparameter tuning procedure
Table 9: Outcome of a 50-trial random hyperparameter scarch for the supervised classification models used by the deep learning baseline methods. All trials are early stopped at the point of lowest validation rank, and we choose the hyperparameter configuration which minimizes the lowest validation rank, with ties broken based on validation loss. Models are trained with AdamW and weight decay applied only to the weights of dense and convld layers. We use the default PyTorc scttings everywhere unless otherwise stated.
Hyperparameter Search space
Selected value
ASCADel (fixe)
ASCADel (variable)
DPA44 (Zald)
AFS-HID
OTIAI
OTP
Learning rate
U (m 10-s) (comstant, amseding
3 10 armealing
2- 2:10-1
4 10-3
9- 10
8: 10-3
6 10-a
L.R schedulo
annealing
annealing
arnealing
annodling
Ingul dropoul
(0.0.0.)
0.0
0.0
0.0
0.0
0.0
0.1
Hiddem dropont
(0.0. 0.2)
0.2
0.2
0:2
Outpul dropou.
(0.0, 0.3)
0.3
0.0
0.0
0.3
0.3
0.0
Training steps
20k
40k
20k
1k
Classification performance of chosen model
Tho runk &
101
124.7 0.2
1.010
1.0171 0.0007
Test loss 1
5.59
+: 0.04
5,380 = 0.009
3,0 0.2
5.66 = 0.01
0.10
0.08
0.0085 1 0.0006
Traces AES boy discleure
288 126
1/4:
4355 1915
n/a
n/a
All the deep learning methods we consider require hyperparameter luning. Work in other deep learning subfields such as Gulrajani & Lopez-Paz (2021) has emphasized the importance of a fair hyperparameter tuning process and realistic model selection criterion when comparing the performance different algorithms, and in this work we aim to follow these recommendations. Accordingly, all methods are tuned with a 50-trial random hyperparameter search. Note that while our main performance evaluation metric is the oracle
44

---

Published in Transactions on Machine Learning Research (03/2026)
Table 10: Outcome of a 50-trial random hyperparameter search for adversarial leakage localization. Models are trained with AdamW and weight decay applied only to the weights of the dense and convld layers. We use the default PyTorch settings everywhere unless otherwise stated. For ASCADv1 (fxxe)), ASCADv1 (variable) and AES-HD we find it helpful to 'pretrain' the classifier with fixed v before beginning the simultancous phase of training, but for DPAv4, OTiAiT, and OTP we find this unnecessary.
Hyperparamcter
Search space
Selected value
ASCADvl (fixed)
ASCADv1 (variable)
DPArt (Zaid)
AES-HD
OTIAT
OTP
0 Jearning rate (pretrain)
U (m 10-1)
10-4
10
n/a
10-3
D/a
n/a
7 (pretrain)
a/a U
0.5
n/a
n/a
a/a
0 learning
U fme- fmn- "}
6 6-10
7-10
2-10 4
10 4
10
8 Kurning nate
learning rate
U Usio (m 1m-10%)
9
20
7
- 10.00-0000000 m)
0.3
0.4
0.7
0.85
0.8
0.65
Training steps (pretrain)
n/a
10k
20k
0
10k
0
0
Training steps
a/a
10k
20k
10k
10k
1k
1k
agreement, it would be unrealistic to use this for model selection, even when computed on validation dataset, because it relies 'white box' knowledge about cryptographic implementations that assumne not to have at training time. Instead, for ALL we use the model selection criterion proposed in Sec. E.3.5) The prior deep learning methods are based on 'interpreting' a classifier trained with supervised learning, and in line with prior work we tune its associated hyperparameters to optimize classification performance via minimizing the early-stopped mean rank on a validation dataset. We also visualize the distribution of results over the hyperparameter sweep for each method.
ALL is sensitive the noise budget parameter 7 and the learning rates of the classifier weights @ and the noise distribution parameter 9j. We consistently find that f should have a higher learning rate than 0, so in order to focus the search on better hyperparameter configurations we tune the ratio of the learning rate of ñ to that of rather than the learning rate of rj. For ASCADv1 (fixed, variable) and AES-HD we find that performance is much better if we pretrain the classifier for half of the training steps with fixed rj = 0 and noise budget 7 = 0.5, then proceed as normal for the next half. Thus, for these trials, we first do a 10-trial grid search of the learning rate for to minimize mean rank during this pretraining phase, then tune all hyperparameters normal using this trained classifier as the starting point for the remaining 40 trials. In preliminary experiments we explored luning the $1, 82, and weight decay strength of the AdamW optimizer as well as the number of r steps per 0 step, but chose to leave these fixed for the final search because they had little impact on performance. See Table 10 for the hyperparameter search space and chosen configurations for ALL.
The deep learning baselines are based on 'interpreting' a trained supervised classifier and require tuning this classifier we tune its learning rate, dropout rates, and decide whether to use a constant or cosine decay learning rate schedule. In preliminary experiments we also explored tuning the $1, B2, and weight decay strength Ả of the AdamW optimizer, but chose to leave them at fixed values for the final search because they had little effect on classification performance. See Table g for the hyperparameter scarch space, chosen configurations, and resulting classification performance for the supervised classifiers.
E.3.4 Performance evaluation methods
Unlike for the experiments on synthetic datasets, here we lack ground truth knowledge about the leakiness of individual measurements. It is challenging to evaluate the performance of leakage localization algorithms in this setting, and there is currently no consensus about the best way to do so. We consider 4 quantitative performance evaluation strategies which are concoptually-simila to performance evaluation strategies of prior work. To account for the varying 'shapes' of leakage assessments returned by the compared methods, all of our evaluation metrics are sensitive only to the relative leakiness assigned to measurements.
'Oracle' leakiness via SNR with relevant leaking first-order variables The present work concerned with 'black box' leakage localization algorithms which require only a supervised learning-style dataset of traces and associated target variable values, and minimal priori knowledge about the cryptographic
45

---

Published in Transactions on Machine Learning Research (03/2026)
implementations being analyzed. However, it is also possible to analyze devices in a 'white box' manner which does incorporate a priori knowledge. In particular, while second-order datasets such as ASCADv1 (fixed and variable) are not amenable to black box analysis with the first-order parametric methods such as SNR, it is possible to study the implementation and 'decompose' the second-order leakage into first-order leakage of pairs of internal variables, then use parametric methods to analyze leakage of these variables individually. As our main performance evaluation strategy, we use such a white box analysis to compute per-measurement leakiness predictions, which we treat as an 'oracle' against which to compare output. This is a useful way to validate deep learning methods because 1) it is interpretable and hyperparameter- freee, and 2) it lets us check whether an output is consistent with an analysis which a domain expert might do.
For the ASCADv1 datasets, we use the white box analysis of Egger et al. 2022) to compute 'oracle' leakiness estimates for each of the measurements. We use the canonical target variable for both datasets, which is Sbox(kg @ w2) where Sbox is an invertible function which publicly-known and shared by all AES implementations, @ denotes the bitwisc exclusive-or operation and k2 and wy denote byte 2 of the key and plaintext, respectively, with indexing starting from 0. The underlying AES-122 implementation of these datasets uses Boolean masking, as shown in Alg. 1 of Benadjila et al. (2020). By design, this Boolean masking prevents the algorithm from ever directly operating on Sbox(Az @ W2), making all power mcasurements X; of Sbox(k2 @ @w)).
nearly marginally maatistiaall-indeeenedee
Alg. 1 does directly operate on the following pairs of variables: (r2, Sbox(k2 + W2) @ r2), (rout: Sbox @ w2) @ roue); (rin, k2 @ w2 2 rin). The variables r2, Tout, Tin are called masks and are internal variables which are randomly generated during each encryption. Thus, each of these variables is marginally dependent on some measurements X₂ and can be detected with first-order parametric methods. Each of these pairs is said to leak Sbox(k2 @ W2) because given both, one can calculate Sbox (k2 @ w2) using the identity e b @ b = In addition to these pairs of variables, Egger et al. (022)) identified that the variables Sbox(S (Sprev b rin) O Tout and a 'security load' Sprev @ Sbox(w2 (2 ① ke) + Tout also have a strong first-order association with power consumption and might contribute to leakage, where for byte 2 Sprev = Sbox(k1 @ wn1) ① 711-
All of these internal variables may be computed using the metadata published with the ASCADv1 datasets. As our oracle assessment for the ASCADv1 datasets, we compute the SNR of each of these 8 variables using the attack dataset and average them together. We can then qualitatively assess agrecment between the output of leakage loca localization algorithms and these oracle assessments. For the 4 first-order datasets, we use as our oracle assessment the SNR of the target itself from the attack dataset, which amounts to an assumption that there is no leakage of order 2 or higher.
We use the Spearman rank correlation coelficient as a scalar summary of this agreement. This quantity is defined as the Pearson correlation coefficient between the ranks of a pair of sequences, and useful for our purposes because it tells us the extent to which leakage localization algorithms assign the same relative leakiness to measurements the oracle, while being insensitive to differences in their 'shape'
Most prior work (Masure et al. 2019 Wouters et al. 2020 Schamberger et al. 2023 Yap et al. 2025 has used white box assessments similar to this for qualitative evaluation of leakage localization algorithms. To our knowledge, ours is the first work to summarize agreement with a scalar and use it for large-scale comparison between a large number of methods
We refer to this performance evaluation strategy as oracle agreement. Note that we use the word 'oracle' for clarity of exposition, and we believe this is the least-flawed of the evaluation metrics we consider, but it does not give us genuine ground truth leakiness measurements. It is sensitive only to first-order leakage of variables which can be identified a priori as leaky, and will ignore any other exploitable variables. Additionally, SNR is not perfectly sensitive even to first-order leakage: it relies on changes in the expected values EE[x, Y = v) with y and will not detect dependencies which do not influence the mean (e.g. X, is a Gaussian random variable with Y Y-independent mean but Y-dependent variance).
DNN occlusion tests Hettwer et al. 2020 proposed a variety of tests based on plotting the performance of trained supervisod classifier as its input features are successively occluded in order of their leakiness. The intuition is that leakier features should have a larger impact on the performance of the classifier, so the rate at which its performance changes as we successively occlude its inputs tells about the extent to which
46

---

Published in Transactions on Machine Learning Research (03/2026)
Algorithm 4: Pseudocode for the DNN occlusion tests.
Input: Trained supervised classifier 4* : R² x Y + [0, 1], attack dataset Dattack S R x Y, leakiness estimates E R²,, direction E ( ('forward', 'reversc")
Output: Area under DNN occlusion curve F
my t- 0
// occlusion mask // indices of sorted leakiness values, from low-high
Lidx < argsort(()
if d= = 'forward' then lax reversearder
// sort from high-low instead
else if = 'reverse' then pass
for / -= ...... T Tdo do
m. f- m + Itai. // un -ccllud t-th least (reverse) or most (forward)-leaky feature // record average classifier
Ti f Dattuch Da.vEDatnck Rank (+*(- (1 m²) O a); v)
performance on attack dataset under this occlusion mask
10 return EE=
// area under the DNN occlusion curve
these inputs were leaky. In a similar spirit, we propose 2 evaluation metrics which we name the forward and reverse DNN occlusion tests.
See Alg. 4 For the forward DNN occlusion lest we initially occlude all the input features of a trained classifier, then successively un-occlude one feature at time from most- to least-leaky as predicted by the leakage localization algorithm under test. At each occlusion level we measure the performance of the classifier the attack dataset in terms of mean rank. We then report the average performance across all occlusion levels. For a 'good' leakage assessment we expect the average performance to be better (lower) because useful features are un-occluded at a greater proportion of occlusion levels. Conversely, for a 'bad' leakage assessment we expect the average performance to be worse because useful features stay occluded for longer. The reverse DNN occlusion test identical except that we un-occlude features from least- to most-leaky. For this test we expect the average performance to be worse (higher) for a 'good' Icakage assessment and better (lower) for 'good' leakage assessment. In general we expect the forward Lest to be sensitive to the extent to which the predicted-leakien reverse test to be sensitive to the extent to which the to true/false negatives).
measurements are truly among the leakiest (similarr to true fflle positives), and the
features are truly nonleaky (similar
A major limitation of the DNN occlusion tests that they rely on an imperfect DNN classifier, and are only sensitive to associations insofar as the classifier exploits them. Additionally, we use the same architecture, training procedure and hyperparameters for these classifiers as for those 'interpreted' by the neural net attribution baseline methods, the test may be 'biased' in favor of these. Nonetheless, we consider them useful supplement to the oracle agreement metric because they do not suffer from the same restrictive assumptions about the nature of associations.
Feature selection efficacy for Gaussian template attack Similarly to Masure et al. (2019): Yap et al. (023), we also evaluate leakage localization assessments based on their ability to do feature selection for Gaussian template attacks. To carry out this test, we first select the top 20 measurements with the highest estimated leakiness. We then perform a Gaussian template attack (Chari et al.) 2003) using these measurements. The Gaussian template attack is & well-known parametric side-channel atlack based on modeling P with Gaussian mixture model with component per value Y may take on, then using Bayes' rule to estimate py The leakier these features are, the more-performant we expect the attack to be.
For AES datasets accuracy is often low when predicting Y from a single value of X. Thus, altack datasets typically consist of many traces XI,... XMM recorded with a fixed AES key but varying plaintext, The target variable Y is typically chosen so that given the corresponding plaintext and ciphertext, Y is a known invertible function of the key. One can thereby make many predictions about the key using these traces, then 'accumulate" these predictions through the identity lxg......... -IM log P...... where K denotes the
47

---

Published in Transactions on Machine Learning Research (03/2026)
key. A common performance metric for attacks is the minimum traces to disclosure (MTD), given by the number of traces one must accumulate before the true key has the highest predicted probability mass (lower is better). We use this metric to measure the performance of Gaussian template attacks on AES datasets. For OTiAiT and OTP, which are not AES datasets, we simply use the mean rank of the target variable on the altack dataset.
Note that for the second-order ASCADv1 datasets, the algorithms we consider do not reveal which of the leaky internal AES variables a mcasurement leaks. This is problematic when selecting features for template attack, because successful attack must have features corresponding to both of a pair of second-order leaky variables. If we simply used the top 20 predicted-leakiest features for an attack, this would be left to chance and make the performance metric unreliable. To address this issue, for the second-order datasets we instead segment the T measurements into 10 bins each containing I consecutive measurements, then select the top leakiest measurements from each bin.
The main shortcoming of this performance metrie is that it is only sensitive to the 20 predicted-leakiest measurements and ignores all others (e.g. it cannot detect that leaky measurements have been assigned spuriously-low leakiness). Additionally, it assumes that the relationship between measurements and the target variable is well-described by Gaussian mixture model, which may not hold in practice. However, unlike the oracle agreement metric it does not rely on human-identisfed first-order leaky variables, and unlike the DNN occlusion tests it is byperparameter-fres and may be biased towards different associations than the DNN classifiers. Thus, it is also a useful supplement to the aforementioned metrics.
E.3.5 Model selection criterion
While we consider the oracle agreement metric our most straightforward and useful performance metric, we cannot use it for model selection (e.g. choosing hyperparameters, or early-stopping runs). This is because it relies on 'white box' knowledge of the internal first-order leaky variables of second-order algorithms and knowledge of their random masks, which we assume not to have at training time. Thus, we must devise model selection criterion which docs not rely this information.
Note that we can freely use the forward and reverse DNN occlusion tests and the template attack feature selection test for model selection by running them on our validation dataset rather than the attack dataset. Additionally, we find that bocause 'good' runs typically converge to similar leakiness assessments whereas bbdd' runs resemble random noise, a reasonable model selection heuristic to 1) compule the average leakiness value for each measurement over all hyperparameter tuning runs, then 2) use the Spearman rank correlation coefficient between the average leakiness assessments and those for particular run as a proxy for the run's performance. We refer to this model selection strategy the mean agreement criterion.
In Fig. 13 we visualize the relationship between the oracle agreement and the forward and reverse DNN occlusion tests as well as the mean agreement criterion. We find that the forward and reverse DNN occlusion criterion are weakly correlated with oracle agreement, and that the mean agreement is strongly correlated for every dataset apart from OtiAiT. However, while we can consistently discard bad runs using these criteria, they typically lead to selection of suboptimal models. In this work we select ALL models using a 'composite criterion' based on ranking runs according to the forward and reverse DNN occlusion tests and mean agreement criterion, then selecting the model with the highest mean ranking across these 3 criteria. More rescarch into model selection strategies for leakage localization algorithms is warranted.
E.3.6 Summary of experiments
We report and visualize results in variety of ways, which we list and summarize here.
Visualization of the best-performing leakage localization results found by ALL In Fig. 14 we
visualize the oracle leakiness measurements and qualitatively compare them with the best ALL runs found during our hyperparameter sweeps. For the ASCADv1 datasets we draw distinct curves for the individual leaky variables note the similarity between these plots and (Egger et al., 2022 Fig. 3a). We see a strong visual resemblance between the ALL outputs and the oracle leakiness assessments, despite the nonlinear relationship between them. Additionally, there are few points assigned low oracle leakiness but high relative
48

---

Published in Transactions on Machine Learning Research (03/2026)
Dursse ASCADs1 (Roed)
Datare:: ASCADe1 (tkee)
Dutset: ASCADvi (hhod)
Dunsee ASCADsI (txed)
2M
114-
129
E0-
Chepuser mrcoe
110
122
C4-
05
Dhatk
Under
Ohatz
Dassear ASCADi (veraable)
Datoeit ASCADa (snshic))
Dutrect ASCADiv (varistee)
Datner: ASci (ooribl)))
110-
DANO DeNO
227
Chepuitr entecre
120
133
012
8.2
0.1
02
66
Dhatl
Unde
Chatz
Dhrawet: DPAkel (Zond vox.)
Dataent DPA (on)
Datect:: DPPpk (Zaid ven.)
Daract:: DPAad (Zond von.)
131
CG-
110
DAND
Chepuste
Misa
15
22-
00-
02
8.2
Dhatk
Onde spreene)
Ohatz
Dersect ARS-III)
Datevar: AFS-IID
Demnctt ARSS-II
Damser ARS-IID
129:11
125.5
18-
129:00
125/5
12K-4-
Cheggeate crlecoe
129.0
225.7
12900
126
Masa
125.0
20-
155.00
127.4
-3.3
33
03
0.0
8.5
-21
01
00
-03
02
Drack
Onde
Ohatz
Datsos:: (TTAII
Dirwegt: CMAAT
Dassee OTIAI
Datser: (TBAIIT
Iouree SWOND creccee
Chepueter crleee
3.-
22
C
85
Dioik agreweet?
Ouidle speneet
Oodde agreewer
Datser: CTP (1004-41)
Datwer: CTP (104--0))
Tatoee OTP (1004-11)
Daveur: CTP (1056N6))
-18
2.44
Mausigg
Congrete
200
C0:4
0.5
0.5
0.4
0.0
0.1
30
0.5
855
Diorl
Oluile
Ohalle agreeeet
Figure 13: Visualization of the relationship between various model selection criteria from Sec. E.3.5 and the oracle agreement for ALL runs produced during hyperparameter search. We find consistently across datasets that the forward/reverse DNN occlusion and mean agrecment criteria are consistently positively or negatively correlated with the oracle agreement, though this correlation is often weak. We achieve slightly better results using a composite criterion which uses considers the 'votes' according to all these criterion, and we adopt this composite criterion when selecting ALL models for comparison with baselines. However, this criterion often selects suboptimal models, and future research on leakage localization model selection strategies is warranted.
49

---

Published in Transactions on Machine Learning Research (03/2026)
Datanct: ASCADvi (Raa))
Datase:: ASCADvi (Geca))
Dutect: ASCADs (Baed)
Oraha lakinn of X
Tira
Cracca Inaimmm
1000 LAlie of Nc 211-
Oreck Ieainnooooo
70
Deroott: DPAs4 von
Dutnact: DR (Zai v9n.)
Datract: DRAr (Zai van.)
000000 wa www.on by Al2.
Tima
Cracia Ieainee
Datrect:
Kyy
of
Thmme:
Tired
Detaset: OTINT
Dumser:: UTAAT
Dataser: OBAIT
Eatmand CAceem by AL2.
Onale lakiowed
Dutsect: OTP (1024-340)
Dataset: OTP (1024-bi0
Dussett OTP /1024
Eatroeeflokkeee Mineeee of A12.
Crack Icalitaco
Figure 14: plot which qualitatively compares the estimated leakiness of the best-performing ALL runs with the oracle leakiness values. (Ieft column) A plot of oracle leakiness of X, vs. timestep 4. For the second-order ASCADv1 datasets (top two rows), note that our plots are similar (Egger al. 2022 Fig. 3a) as they are based on the same first-order variables; differences are because SNR whereas they use CPOI. (middle column) A plot of estimated leakiness of X₁ vs. timestep & according to ALL, for the best-performing ALL run measured by oracle agreement. We want this column to look like the left column, up to
measure leakiness with
nonlinear transform. (right column) A plot of the ALL-estimated leakinoss of X, vs. the oracle leakiness of X,. These curves show that the ALL estimates are good in the sense that they lend to apply similar relative leakiness values the measurements as the oracle.
50

---

Published in Transactions on Machine Learning Research (03/2026)
ALL-predicted leakiness vice-versa. Most of the disagreement appears to lie in the predicted relative leakiness within groups of high-leakiness or low-leakiness measurements.
ALL training curves In Fig. 15 we plot the evolution of various metrics over time during the ALL training
procodure for the runs chosen using the model selection criterion of Soc. E.3.5 In Fig. 16 we compare the oracle agreement al different Limesteps on ASCADvI-variable for ALL and selected baselines. In general observe that for successful ALL runs the classifier validation rank drops significantly below the random- guessing threshold at some point in training, though it may begin to risc again as the noise distribution trains adversarially against it. These curves are generally smooth and we do not observe siguificant training instability. Unfortunately, we are not aware of a reliable way to predict oracle agreement performance from the training curves.
Sensitivity of ALL to hyperparamcters The main hyperparameters of ALL are the noise budget y and the learning rales of the classifier weights O and the noise distribution parameter nj. In Fig. we evaluate the sensitivity of ALL to these hyperparameters by varying them individually using the optimal configuration with respect to oracle agrecment as a starting point. We find in general that performance generally varies smoothly with these hyperparameterss and stays significantly above random- sandom-guessing over a large search space, which is desirable from a standpoint of hyperparameter tuning.
Attack performance and training curves of supervised classifiers All of the deep learning- based baseline methods are based on 'interpreting' a fixed classifier which has been trained using supervised learning to predict the larget variable Y from the trace X. In Fig. 18 we plot the cross-entropy loss and mean rank over time for these classifiers during training. Additionally, for the AES datasets we plot the rank of the correct key as we accumulate traces from the attack dataset. For reference we superimpose the correct key rank during trace accumulation for the following publiely-available open-weight classifiers: the CNN and MLP Best model of Benadjila et al. (2020), both of which are available here, and the models of Zaid et al. (2020) and their simplified versions from Wouters et al. (2020) distributed here Also note that in Table list the carly-stopped validation cross-cntropy loss, rank, and minimum traces to disclosure (MTD) for these models. We find that our classifiers are able to 'successfully' atlack all datasets (i.e. they can successfully predict the key by accumulating all traces in the provided attack dataset), and they achieve comparable MTD to these open- weight models on ASCADw1-fixed, ASCADvI-variable and DPAv4, and somewhat-worso MTD on the AES-HD dataset.
m-Occlusion window size sweep and smoothing effect We consider as baselines m- m-Ooclusion and 2nd 2od-order m-Occlusion. These baselines introduce the occlusion window size as an additional hyperparameter which must be tunod. In Fig. 19 we plot the oracle agrecment performance of m-Occlusion as we sweep m, and qualitatively show how the resulting leakiness vector is smoothed out with increasing m. In subsequent. experiments, we denote by m² the optimal value of found in these experiments, and report results for 1-Occlusion, m=- -cclusionn, 2nd-order 1-Occlusion and 2nd-order mnc-Ouclnionn (due to the high cost of 2rd-order m-Occllsion we do not separately sweep its window size). Note that this introduces some data leakage into the results, as we are doing validation with our test metric which incorporates inplementation knowledge that we assume not to have at training time. Because the goal of this work is to demonstrate the efficacy of ALL, and ALL generally outperforms --Ccclusion and 2nd-order m -Occlusioon despite the data leakage, we consider this acceptable.
Compared to 1-Occlusion, m-Occlusion has two major differences: it occludes multiple inputs simultaneously to increase the influence on classifier predictions, and it has 'smoothing' effect which causes nearby measurements to be assigned similar leakiness values. The latter effect can be easily simulated using average- pooling, so we also plot the performance of ALL as we average-pool it with stride 1 and kernel size m. We find that while m-Occlusion siguificantly improves performance over 1-Occlusion on the DPAv4 and AES-HD datasets, on these same datasets we can significantly improve the performance of ALL by average-pooling and ALL convincingly outperforms m- m-Ooclusion when accounting for this. We conjecture that the smoothing effect provides a useful inductive bias for these datasets, and emphasize that it can easily be applied to any other leakage localization technique.
51

---

Published in Transactions on Machine Learning Research (03/2026)
Table 11: Performance comparison between various leakage localization algorithms according to the oracle agreement metric (larger is better) described in Sec. E.3.4 Results are reported as mean + standard deviation over 5 random sceds. The best result is boxed and the best deep learning result is underlined. We consider a result to be 'best' if its mean lies inside of the error bars of the result with the highest mean.
2nd-order datasets
Ist-order datasets
Method
ASCADv1 (fixed)
ASCADv1 (random)
DPAv4 (Zaid van.)
AES-HID
OTRAF
OTP (1024-bit)
Random
-0.00 = 0.01
0.002 = 0.01
0.01 = 0,01
0.01 # 0.02
0.02 0.03
0.03 0.03
SNR
0.031
-0.092
0.344
0.185
0.989
0.944
SOSD
-0.253
0.272
0.259
0.063
0.856
0.803
CPA
0.521
-0.095
0.420
0.503
0.630
0.945
GradVis
0.48 0.02
0.27 + 0.01
0.009
0.07 +: 0.01
0.55 0.05
0.57 0.02
Saliency
0.47 0.02
0.26 1: 0.01
0.67
0.58
Input Grad
0.47 0.02
0.25 + 0.01
0.202 0.009
0.08 0.02
0.71 0.05
0.60 0.02
LRP
0.47 0.02
0.25 +: 0.001
0.202 + 0.009
0.08 + 0.02
0,71 = 0.05
0,60 1:00::00 0.02
OccPOI
0.07 0.01
0.064 + 0.004
0.030 + 0.008
0.044 + 0.009
0.07 1: 0.02
0.01 0.02
I-Oeclusion
0.17 0.17::0000
0.25 2 0.01
0,202 + 0.009
0.08 = 0.01
0.71 0.05
0.80 + 0.02
0.49 0.02
0.41 + 0.01
0.32 + 0.01
0.18 0.05
0.72 0.04
0.77 + 0.01
1-Orclusion"
0.51 0.00
0.27 + 0.01
0.206 0.009
0.08 0.01
0.74 0.05
0.60 0.02
0.52
0 0.01
0.330 0.009
0.19 0.05
0.75 0.04
0.758 0.007
WoutersNet 1-Oeclusion
0.18 0.03
0.21 0.02
0.11 0.03
n/a
WoutersNet -cellsiion
0.20 +
n/a
0.29 0.02
0.21 + 0.01
n// a
n/a
WoutersNet GradVis
0.19 0.03
n/a
0.21 = 0.02
0.11 = 0.03
n/a
n/a
Wouters Net Input Grad
0.18 + 0.03
n/a
0.21 + 0.02
0.11 + 0.03
n/a
n/a
WoutensNet Salieucy
0.19 0.19 0.03
n/a
0.21 + 0.02
0.11 = 0.03
a/a
n/a
ZakINet 1-Ocelusion
0,24 0.03
n/a
0.19 = 0.01
0
u/a
n/a
ZaidNet m² Qeellsioon
0.25 0.04
n/a
0.273 + 0.009
0.21 0.05 0.05
n/a
D//a
ZakdNet GradVis
0.25 0.03
n/a
0.19 0.01
0.13
n/a
nz/a
ZaidNet Input Grad
0.25 0.04
n/a
0.19
0.13 0.02
n/a
n/a
ZakdNet Sallency
0.25 0.03
n/a
0.19 0.01
0.13 0.02
1/a
ALL (ours)
0.794 0.006
0.60 0.01
0.317 + 0.002
0.22 +: 0.03
0.782 +: 0.001
0.848 0.003
Quantitative comparison between ALL and baseline methods using oracle agreement, forward and reverse DNN occlusion tests, and template attack feature selection test In Tables 11 12 compare the performance of ALL with our baseline methods according to the oracle agreement, forward DNN occlusion, reverse DNN occlusion, and template attack feature selection tests, respectively. As a sanity check against our supervised neural net architecture and training procedure, we also include results for GradVis, Saliency, LRP, Input * Grad, I-Occlusion, and m -Ocelussionn computed using the models of Zaid al. (200)) and their simplified versions from Wouters et al. (2020) distributed here
13
14
We find that ALL outperforms all prior deep learning-based leakage localization algorithms on all datasets except for DPAv4 according to the oracle agreement metric. The first-order parametric methods outperform the deep learning methods on the first-order datasets but generally do poorly on the second-order ASCADv1 datasets due to not being sensitive to second-order associations. Unsurprisingly, SNR and SOSD achieve ncar-random performance on ASCADv1-fixed and SNR and CPA achieve ncar-random performance on ASriDy--variable. Surprisingly, CPA performs fairly well on ASCADy1-fixed and SOSD performs fairly well on ASCADv1-variable. We are not sure why this is the case, but conjecture it is because these methods have some natural proclivity 'rule out' measurements which are not useful points in time for these particular datasets (e.g. those which are not close to a clock edge). Note that this surprisingly-stron performance compared to the deep learning baselines does not appear to carry over to the evaluations with the DNN occlusion tests or the template attack feature selection test.
On average, ALL is the best method on the majority of datasets according to the reverse DNN occlusion test and template attack test, but results are mixed according to the forward DNN occlusion test. However, we find that the DNN occlusion tests have high variance, and in general there is a large overlap error bars (note the large number of boxed and underlined methods in Tables 12 and 13
52

---

Published in Transactions on Machine Learning Research (03/2026)
Table 12: Performance comparison between various leakage localization algorithms according the forward DNN occlusion test (smaller is better) described in Sec. E.3.4 Results reported as mcan + standard deviation over 5 random seeds. The best result is boxed and the best deep learning result underlined. We consider a result to be 'best' if its mean lies inside of the error bars of the result with the highest mean.
2nd-order datasets
1st-order datasets
Method
ASCADv1 (fixed) ASCADr1 (random)
DPAvd (Zaid vsn.)
AES-IID
OTIAS
OTP (1024-bit)
Random
111 +1
111.7 0.8
20 00+:2
126.8
1.30 + 0.05
1.065
0.010
SNR
117.525
118.448
11.275
125.053
1.209
1.015
SOSD
115.516
106.072
11.455
125.365
1.213
1.032
CPA
111.449
117.349
11.811
125.207
2.049
1.015
GradVis
108.6 + 0.5
96.8 + 0.3
9.5 = 0.6
125.6 6: 0.3
1.9 : 0.2
1.013 = 0.002
Saliency
108.5 + 0.4
96.3 + 0.4
9.5 0.7
125.6 0.3
1.8 + 0.1
1.014 + 0.001
Input Grad
108.5 + 0.4
96.8 + 0.4
9.4 0.7
125.6 0.3
1.7 + 0.2
1.133 =: 0.001
LRP
108.5 + 0.4
96.8 + 0.4
9.4 1 0.7
125.6 - 0.3
1.7 :: 0.2
1.013 = 0.001
OoePOI
122.3 +
2.6
0.04
1-Oerlusion
108.5 + U.4
96.7 + 0.4
9.4 0.7
125.6 0.3
1.7 0.2
1.033 + 0.001
-e-Oeccusion
108.2 0.5 0.5
95.7 = 0.6
9.0
125.3
0.2
1.013 = 0.001
1-Oeclusion
108.4 -: 0.4
97.0 + 0.4
125.5
1.7 0.2
1.013 0.001
m n"-Oeclusion
108.2 U.5
0.2
WoutersNet I-Occlusion
109.1 0.7
n/a
125.4 0.3
n/a
n/a
WoutersNet m --Oollusion
109.0 + 0.8
n/a.
05.44:00 0.2
n/a
n/a
WoutersNet GradVis
109.3 0.8
n/a.
125. 4:
n/a
WoutersNet Input Grad
109.1 - 0.7
125. 4
n/a
n/a
WoutersNer Salieney
109.2
n/a.
8.7
125.4 0.3
n/a
n/a
ZaidNet L-Oeclusion
110.0 0.4
n/a
125.5 -::
n/a
n/a
ZaidNet m² Oee-Osonnoon
109.5 + 0.9
9.0
125.4 0.2
n/a
n/a
ZaidNet GradVis
109.7 + 0.6
n/o
8.7 0.7
125.5 0.2
n/a
n/a
ZaidNet Input Grad
109.9 + 0.3
n/4
8.7 0.7
125.5 0.2
n/a
a/a
ZeidNet Saliency
109.7 + 0.6
n/a
8.7 0.7
125.5 0.2
n/a
1/a
ALL (ours)
107.3 + U.4
104 +0
+
125.5 01.
1.8 + 0.1
1.014 0.001
53

---

Published in Transactions on Machine Learning Research (03/2026)
Table 13: Performance comparison between various Icakage localization algorithms according the reverse DNN occlusion (estelarger is better) described in Sec. E.3.4 Results reported mean + standard deviation over 5 random sceds. The best result is boxed and the best deep learning result is underlined. We consider a result to be 'best' if its mean lies inside of the error bars of the result with the highest mean.
2nd-order datasets
1st-order datasets
Method
ASCADe1 (fixed
ASCADv1 (random)
DPAv4 (Zaid vsn.)
AES-HD
ОTЗАFT
OTP (1024-bic)
Random
0.5
111#3
25
126.7 : 0.2
1.276 0.010
1.079
0.010
SNR
110.679
123:284
125.924
128.599
5:267
SOSD
112.074
126.765
108.267
128.216
4.957
1.369
CPA
119.875
117.885
114.857
128.367
3.792
1.364
GradVis
125.9 = 0.2
127.6 0.1
122 =
128.0 + 0.3
124:0.4
1.34 = 0.07
Saliency
125.8 + 0.2
127.4 0.2
122 +
128.0 + 0.3
5.1 11++0.8 0.3
1.33 0.06
Iaput Grad
125.7 - 0.3
127.5 0.2
121.9
128.1 0.3
5.2
1.34 1:3==10 0.06
LRP
1.3
127.5 0.2
1219
128.1 0.3
5.2
134 1:31=10 0.06
OndPOI
122.3 1 0.4
124.6 0.2
43
127.0 + 0.3
3.6 3.6
1.09 0.04
I-Occlusion
0.3
127.4
122
128.1 0.3
0.3
1.34 0.06
-ocluusion
126.0
127.4
121
128.5+00.2
53
1.30 0.04
Occlusion
127.5
1.9
1.3
5.2
1.34
2"celuunioonn
1.2
127.4
0.9
1.2
0.2
1.30 0.04
WoutersNeL 1-Occlusion
0.7
n/a
116::
1.1
WoutersNet mn--ocllssio
0.2
0.7
1.2
WontersNet GradVis
121.8
n/a
116+
128.2 + 0.1
n/a
WoutersNet Iuput Grad
121.9 0.7
n/a
116:5
128.2 0.1
n/a
WoutersNet Saliency
121.8
D/a
11644
123.2 + 0.1
1/a
1/8
ZaidNet 1-Oeclusion
1
n/a
11643
128.1
0.2
n/a
n/a
ZaidNet m² mn--Occlusion
123
n/a
119
128.4 + 0.3
n/a
n/8
ZaidNet GradVis
122 1
n/a
117
128.1 + 0.2
n/a
n/a
ZaidNet Input Grad
122 1:
n/a
116
128.
0.2
n/a
n/a
Net Saliency
122 3
n/a
117 17
128.1
+ 0.2
n/a
n/a
ALL (ours)
126.4 + 0.2
127.96 0.06
125 0
128.3 +: 0.2
5.6 A.G:t: 0.2
1.39 0.05
54

---

Published in Transactions on Machine Learning Research (03/2026)
Table 14: Performance comparison between various leakage localization algorithms according to the template attack feature selection test (smaller is better) described in Sec. E.3.4 Results are reported as mean + standard deviation over 5 random seeds. The best result is boxed and the best deep learning result is underlined. We consider result to be 'best' if its mean lies inside of the error bars of the result with the highest mean.
2ud-order datasets
1st-order datasets
Method
ASCADe1 (fixrd)
ASCADel (random)
DPAv4 (Zaid vsn.)
ARS-HD
OTFAFTT
ОTP (1024-bie)
Random
1293 + 1000
56421 40000
+ 100
25000.000
12401
144 0.02
SNR
5496.010
54834.990
2.590
17139-690
1.058
1.385
SOSD
7733.870
3237.250
91.410
17520.530
1.059
1.398
CPA
3826. 440
100000.000
10.540
18974.510
1.101
1.385
GradVis
686 + 100
1162 = 1000
2.7
20014 +: 6000
1.4
1.378 = 0.007
Saliency
726 + 100
1412 + 2000
2.7
19438 +: 6000
1.14 :: 0.02
1.379 0.005
Iuput Grad
675 + 100
1194 2000
2.6
19893 6000
1.14 0.02
1.378 0.003
675 +
2000
2.6
19893 6000
1.14 0.02
1.378 0.003
OccPOI
787 =
942
71
25000.000
1.08 0.03
1.77 0.05
1-Oeclusion
667 + 100
1376 2000
2.65 0.08
20011 6000
1.14 0.02
1.379 0.003
-ocllusonn
727
16283
1.17 0.02
1.382 0.00T
I-Occlusion"
709 + 100
1086 + 1000
2.65 + 0.08
20222 + 6000
1.14 0.02
1.378 0.003
n*-Oochusion
642
710
9+ 1
16033 700
1.16 0.03
1.381 0.008
WoutersNet 1-Oeclusion
6454 +: 4000
n/a
2.9:0...
20278 + 3000
2//a
0/8
WoutersNet, m² Occlusion
4408 + 4000
a/a
11.7 0.6
16124 :: 300
WoutersNer GradVis WontersNet. Input Grad
6230 + 1000
n/a
2,9 2.9
19539 + 5000
n//a
n/a
4988 +: 4000
n/a
3.0 +: 0.6
20546 4000
n/a
n/a
WontersNet Saliency
4000
n/a
2.8 0.5
20151
m/a
n/a
ZaidNet Occlusion
2236 +: 2000
a/a
2.6 0.3
0.3
20696 2000
n/a
n/a
ZaidNet m² -ne-oocusion
2185 + 2000
n/a
9
16124 = 300
1//a
D/8
ZaidNet GradVis
2560 3000
3.0 0.8
22790 3000
n/a
ZaidNet Input Grad
3234 + 3000
2,5 0.3
21600 3000
Net Saliency
2295 2000
2.4 0.4
22561 3000
n/a
ALL (ours)
459
394 +:
2.22 + 0.01
17582 5000
1.11 0.02
1.363 0.007
55

---

Published in Transactions on Machine Learning Research (03/2026)
Distribution of performance during hyperparameter sweeps In Fig. 20 we show the distribution of performance during the random hyperparameterr searches for ALL and selected baselines. We see that ALL convincingly outperforms all baselines besides m=-Ocelusion on all datasets. Additionally, it has a higher peak performance than m"-Occlusion on every dataset except for DPAv4, and a higher median performance on ASCADv1-fxed,, ASCADvI-variall
and AES-HD. As previously noted and considered again subsequent. ablation studies, we can further improve the performance of ALL relative to m -Ocelluuionn by mimicking its smoothing effect with stride-1 1 average-pooling.
E.3.7 Ablation studies
ALL has many differences from prior work, so here we run ablation studies to evaluate the impact of some of the important individual differences. For cach ablated design decision, we run a new 50-trial hyperparameter sweep and plot the distribution of performance in terms of oracle agreement. Results are shown in Fig. 21 with the salient results from Fig. 20 copied over for reference. We ablate the following design decisions:
Heavy input dropout for the supervised classifiers used by baselines See the distributions labeled "m"-Oeel= + heavy dropout'. The ALL classifier is trained on occluded inputs with the possible 'heaviness' of the occlusion chosen spanning a wide range and chosen as a hyperparameter to optimize our proxy for oracle agreement. In contrast, the baseline methods are based on 'interpreting' fixed classifiers which have been trained with input dropout chosen from (0.0, 0.1} to optimize classification performance. A plausible conjecture is that ALL has strong performance because the heavy input corruption 'encourages' the classifier to compensate by leveraging a wider variety of input-output associations, whereas because the supervised classifiers train uncorrupted or lighttly-ooruppedd imputs, they have no such 'incentive'. We test this assumption by tuning the classifiers with input dropout chosen from {0.05, 0.1, 0.95) (the same soarch space that ALL uses for 7). We plot the performance distribution for m*-occlusion and 1-occlusion. For clarity we omit GradVis, Saliency, LRP and Input * Grad, but these have similar trends as 1-occlusion. We did not test OcePOl or second-order occlusion because they are costly and in our prior experiments second-order m-ocelusion performs similarly to m-occlusion and OcePOI performs poorly compared to basclines.
We see that this heavy input dropout leads to significant. improvements to the maximum and median performance on all datasets, though ALL still convincingly outperforms 1-occlusion and m-occlusion except on DPAv4 and OTiAiT. To our knowledge no prior work has explored the effect of regularization strategies on leakage localization performance of methods which 'interpret' supervised classifiers, and this result suggests that such research may be fruitful.
Adversarial + 'Cooperative' leakage localization See the distributions labeled 'ALL (cooperative): The intuition behind ALL is that we train a noise distribution to distribute a fixed amount of noise to minimize the performance of classifier, and we then interpret noisier measurements as leakier. Along the lines of this intuition, we could also train it to distribute noise to mazimize the performance of classifier, then interpret less-noisy measurements as leakier. We try this approach and find that it typically degrades performance relative to the adversarial version of the algorithm. We conjecture that this is because the adversarial approach encourages the classifier to rely on a diverse assort of input-output associations, whereas the cooperative approach does the opposite.
Omitting the noise conditioning to the classifier See the distributions labeled 'ALL (unconditional): We feed the occlusion mask as an auxiliary input to the ALL classifiers, motivated by our theory which views it family of classifiers trained in an amortized manner via conditioning single neural net. We test omilting this auxiliary input and find mixed results. On ASCADv1-fieed and DPAv4, ALL achieves stronger performance without this auxiliary input, whereas on AES-HD it achieves stronger performance with this input and on ASCADvI-variable OTiAiT, and OTP results are approximately the same. For future work it is likely justifiable to simplify ALL by omitting this conditioning.
Average pooling ALL to mimic the smoothing effect of m -Occuuuuionn See the distributions labeled 'ALL + AvgPool(m"): Recall that we have chosen the occlusion window size m by sweeping it over successive odd numbers until finding a local maximum in oracle agreement. We find that this consistently improves
56

---

Published in Transactions on Machine Learning Research (03/2026)
performance. One plausible explanation for the performance improvement is that large-window occlusion has 'smoothing' effect which amounts to assumption that temporally-close measurements have similar leakiness. This is likely true for some datasets, and as 1-occlusion is always included in the window size search space, m" occlusion will never degrade performance relative to 1-occlusion. To test this explanation we average pool ALL with stride I, kernel size m², and zero-padding to preserve dimennsoonality, which creales a similar smoothing effect. Our results seem to support this explanation, with average pooling significantly improving the performance of ALL on the DPAv4 and AES-HD datasets, where m*-occlusion also has significantly stronger performance than 1-occlusion. Note that using oracle agreement to choose an occlusion/ poooliiioopoooiingg pooling window size causes data contamination, so while it is fair to compare results for m mm-average-poole ALL to those of m -oclusionn, they cannot fairly be compared to any other baseline.
E.3.8 Theoretical and empirical computational cost of deep learning methods
In table 15 we list the thcoretical computational complexity of the considered mothods, as well as the mcasured wall clock time to run them. While for fairness our experiments use an equal number of training steps for ALL and supervised learning, note that in general we suspect the latter will converge in fewer training steps; thus, these measurements likely overestimate the practical wall-clock time of supervised training. Additionally, note that OccPOI takes significantly more time than m-occlusion despite having the same computational complexity; this is because it requires S(TT) sequential forward passes through the model, whereas all forward passes may be done in parallel for m-occlusion. There is additional variance for the runtime of this method because we choose the attack dataset size to be as small as possible while comfortably allowing the classifier to attain a correct-key rank of 0 - e.g. AES-HD takes the longest because we use the full attack dataset. We omit the parametric statistics-basee methods from consideration, but these are done on the CPU and take a negligible amount of time compared to the deep learning methods.
Table 15: Comparison of the computational cost of methods considered in our work. We denote by CF and CB the cost of a forward and backward pass through our neural net respectively, N the dataset size, Rsup and aall the number of epochs required for supervised learning and ALL respectively, and T the data dimensionality. We omit the parametric statistics-based baseline methods because they are done on the CPU and take a negligible amount of time relative to the deep learning methods. Runtimes are reported as mean + standard deviation over 5 runs. TThese methods are used to 'interpret' trained supervised classifier, but for comparison we report the cost of running them after training the classifier. In practice one would also incur the cost of supervised training (first row).
Method
Total FLOPS
A 6600 minutes per trial DPAsd (Zaid)
ASCADe1 (6xed)
ASCADv1 (randam)
AES-IID
OTLAT
OTP
Supervised training
@(Nn + On))
2.09 = 0.01
3.88 4: 0.02
1.98 = 0.04
1.78 4: 0.03
0.17 0.02
0.448 +: 0.009
GradVis!
e(N Cal)
0.0675 0.0006
0.203 1
0.0080 0.0001
0.0381 1 0.0003
0,0080 0.0001
0.0886 0.0005
Saliency'
e[N(Cr + CC])
0.078 0.001
0,300 4: 0.003
0.0086 0.0002
0.048 4: +0.002
0,0085
0.0002
0.0881 +: 0.0004
Input Grdd
e[N[Cp+ Csl)
0.3023 0.0007
0.0066
0.0002
0.002
LRPI
e(N(Cp+ Ual)
0.000=00001
0.3046 4: 0.0008
0,008s = 0.0002
0.050 :: 0.002
0.00861
0.000077
0.087 :: 0.005
m-Deciusion!
e(NC,7")
11233-0..000
0.952 0.003
0.0644 0.0000
0:1781 0.0007
0.018 0.002
0.247 0.002
sedor m--oeduuiion
@(NCFT")
1666
327 1
81.1 + 0.5
68-4 1:
4.42 0.02
70.6 4: 0.3
OeePOIT
D[NC,T)
2.29-0.0
7.6
0.700 0.000
36.5 0.6
0,042 0.002
0.0437 0.0004
ALL (Ours)
@(NnatCC Cn))
0.2=022
0.2
2.44 = 0.05
2.28 =: 0.05
0,200 = 0.005
0.323 4: 0.004
F Limitations
For real side-channel leakage datasets we lack ground truth knowledge about the leakiness of each measurement, and all evaluation metrics considered in our paper have limitations. In particular:
The 'oracle' leakage assessments used in the main paper ignore leakage of order greater than except. where higher-order leakage may be decomposed into first-order leakage of multiple variables, similarly to the analysis of Egger et al.] (2022). This relics on careful analysis of implementations by humans, and is subject to error and oversights. Additionally, the SNR is not guaranteed to detect even first-order leakage- it is sensitive only to the influence of the secret variable y on the mean of each
57

---

Published in Transactions on Machine Learning Research (03/2026)
X1 Y, and will not detect cases where the distribution of X Y changes with the mean remaining fixed (e.g. if X is Gaussian distributed with Y-dependent variance and Y-independent mean).
The DNN occlusion tests and similar metries proposed by Hettwer al 2020 are sensitive only to the associations between X and Y that the neural net exploits. The superior performance of ALL compared to prior deep learning-basee based algorithms, as well as work in other domains such as Geirhos et al. (2020]; Hermann & Lampinen (020), suggests that DNNs are prone to exploiting some but not all of the associations at their disposal. Additionally, such metrics may be biased in favor of deep learning methods due to both leveraging SGD-trained DNNs.
Evaluation via feature selection for a Gaussian template attack as done by Masure et al. (0019 Yap
ett al. (2023) is sensitive only to the top & 10 leakiest measurements identified by an algorithm and ignores all others, which is major limitation. Additionally, for second-order datasets template attack will be unsuccessful unless both of leaking pair of variables (e-g- r's and Sbox @ Aia) @ ra for ASCADv1) are leaked through the selected measurements, and because method considered in our work except for second-order occlusion has any ability to discern the particular variable leaking through a measurement, this would rely on random chance.
We believe it is important for work in this domain to use a variety of evaluation strategies to compensate for these individual limitations. This is similar to image synthesis research where it is common to use procision, recall, and FID score to avoid the individual limitations of each of these metrics.
ALL (alongside the other deep learning-basse based method we consider) has major advantages over manual analysis and simpler parametric methods. However, it also comes with its own limitations:
Deep learning methods such as ours have a far larger computational cost than parametric methods. Additionally, ALL is more computationally-expenna from OcePOI and sccond-order occlusion. This increased cost is not fully reflected in our reported runtimes because while for fairness we have run both ALL and supervised learning- basen methods for the same number of training steps and post-hoc early-stopped the latter, in practice we find that supervised learning usually converges to good solutions in fewer training steps than ALL.
than the prior deep learning algorithms apart
Deep learning methods such as ours require hyperparameter tuning and will give incorrect leakiness estimates if poorly tuned. We view ALL as complementary with traditional approaches rather than as a replacement. Traditional approaches can cheaply exploit domain momaiiiiimplmmnnatioon knowledge and detect many types of leakage for a low computational cost. ALL can then be used to search for additionally leaking measurements not detected by these approaches.
Additionally, limitation of the literature on deep side-channel leakage localization which we do not address in this work is that experiments are done at a smaller scale than the state of the art in deep sido-channel attacks, and the considered algorithms would likely need to be significantly scaled up for practical use. The largest-scale experiments in this and prior work consider the ASCADv1-variabl dataset, which consists of 300k 1400-measurement power traces and can be attacked with simple MLP and CNN architectures. The 1400-length power traces are extracted from longer 250k-length traces via downsampling and cropping in the general vicinity of known leaky instructions which were themselves located with a white box analysis. We believe that a critical direction for future work in this area scaling existing methods to larger-scale architectures applied to uncropped high-dineesionalliy datasets, such as the transformer architecture of Bursztein et al. (2023) and the raw ASCADv2 dataset (Masure & Strullu 2023), which consists of 800k IM-measurement power traces.
power trace datasets, which we believe is reasonable because in practice implementation designers are likely able to collect synchronized traces, as the dataset authors have done (c.g. by using the clock line of the hardware to trigger an oscilloscope). In practice a violation of this condition would mean that leakage appears 'spread out' (c.g. see row 3 of Fig. 4 making it more-challenging for designers to identify its source.
Our experiments consider mainly
58

---

Published in Transactions on Machine Learning Research (03/2026)
A limitation of ALL, alongside the parametric statistical methods and OcePOI, is that they produce only single vector summarizing leakage over the entire dataset, rather than for individual traces. As observed by Wouters et al. 2020), the neural net attribution methods can also be used to assign leakiness estimates to individual traces, though to our knowledge no work has systematically studied this ability. This would be a useful direction for future work, and would likely require innovation in performance evaluation strategies beyond those introduced in this paper or prior work.
59

---

Published in Transactions on Machine Learning Research (03/2026)
Dutaect: ASCADv1 (ixal)
Datsez: ASCADvi (iszll)
Dutect:: ASCADu (Good)
NCC cacenaneee of 20
2000
1801
Tratsing
Datrset: ASCADN (vorishte)
ADvl (xnnable)
Datantt: Dvt rommaNe
011
Class moc mast,
Chick gpreeeer
Trakking srp
Trakleg seop
Teadiing sxp
Diitset DPApl (Zaid
Denaset: DR
Datase:: DRNN44 iZaid
NCC oftrice C20 01
Oredl
-00
200 000
4001
Dataset AES-HD
Dutset: AES HDD
Dussen: ABS HD
MMC eacaaaaaaeiiii 2..00.000000 80
vile
-5x
Traaneng Map
Traning skop
Tmaasiue wap
Detzset: UTLVT
Danase:: OTAAT
MCC ViC-oonaaca of CON 01
-00
30 600
40
Dutrect: OTP (1024 KD
Datase: OTP (1004-b))
Dutset: CTP (1024 ho)
Chaniforetnn
Traaning
Transng
Trassu Wip
Figure 15: Training curves for ALL with the hyperparameter configuration chosen using our composite model selection criterion. Grey shaded regions denote 'pretraining' phases where we optimize but not nj. Note that jumps in the traces happen because we set र = 0.5 0.5 for pretraining and change to the setting chosen through hyperparameter search for training. (left column) The per-minibatch estimates of our objective function C(O, 7) (i.c. negative cross-entropy classification loss of the classifier) during training. We are optimizing O to maximize this value and to minimize it. (center column) The mean rank of the correct label in the logits of the classifier (lower corresponds to higher classifier performance). We use this instead of accuracy for its finer granularity. (right column) The performance in terms of oracle agreement over the course of training: higher is better, as it indicates that the current ALL leakiness estimates are closer to being a strictly-increasing function of the oracle assessments.
60

---

Published in Transactions on Machine Learning Research (03/2026)
0.-
ALL
Orucle agroement
0.4
0.11
1000
20000
1000
(X033
Training steps
Figure 16: A comparison of the evolution of oracle agreement training steps for ALL and selected basclines. Note that the oracle agreement for ALL is flat for the first 20k training steps and jumps up for the remaining steps because we leave all elements of y fixed at 0.5 during our "pretraining' phase of training, and update it only during the second half. For 2rd-order m*-Occlusion and OccPOl, due to their high computational cost we report only the final performance after training via horizontal lines, rather than the evolution of performance during training-
Dataset: ASCADv1 (fised) Learning rate 77 10-3
Datasct: ASCADv1 (variable) Learning rate of ?
Dataset: DPAvf (Zaid vsa.) Learning rate of ij
10
10
10 10-2
Leaming g rate of
Learning rate of 0
Learning rate of 0
10
10
10
10
10
10
10
10
10
6.8
Oracle agreement f
0.75
Oracle agreement 1
Oracle agreement t
0.30
0.25
0.2
0:00
-0.50
0.2
0.2
Budget hyperparameter
Budgel hyperparameter 7
Budgel hyperparameter 7
Dataset: AES-HD
Dataset: OTAAI
Ditiset: OTP (1024-b11)
Learning rate of
Learning rate of ?
Learning rate of
10
10
Leaminng rate of
Learning rate of 0
Learning rate of A
10-5
10-5
10-7
10-1
10-3
Oracle agreement
Oracle ugroement 1
6.8
Oracle agroement
0.8
6.6
0.6
6:4
0.4
0.1
0.2-
0.2
0.0
0.0
012
0.4
0.5
0.5
0.2
0.4
0.6
0.8
0.2
0.4
0.6
0.5
Budget hyperparameter 7
Budget hyperparameter 7
Budget hyperparameter 7
Figure 17: A plot of the performance of ALL as we perturb its 3 main hyperparameters: the noise budget 7 and the learning rates of the classifier weights 0 and the noise distribution parameter ýj. We find that performance varies smoothly with these hyperparameters and stays significantly better than random guessing over a large region of the search space, which is useful from a standpoint of hyperparameter tuning. We consider 7 values in mp. arange (0. 1.0, 0. 0.05) and learning rates scaled by values in np lo.soge (-2, 2, 19) relative to their optimal values according to the oracle agreement metric. All hyperparameters other than those being perturbed are left at their optimal values according to the oracle agreement metric. We repeat trials for 5 random seeds and report their mean with dots and + 1 standard deviation with shading.
61

---

Published in Transactions on Machine Learning Research (03/2026)
Datract: ASCADyi (lxo))
Dataed: ASCADel (Goed)
Dutoct: ASCADv I (Good)
1022
Men Monveueed key JomiL
val
C
Tracm
Dataae:: ASCADVE (varabble)
Dusasct ASCADe1 (varisble)
Dutseet ASCADIV (vuriable)
Mox couseet key orkk.
Croa-cntang Inn
1321
9000
17
Trasing dep
Trasisg siap
Trnoo voon
Dupeet: DPAN (Zidd ym1)
Dutaact: DBAs (Zaid van)
Dateec: DRAcs (Zhid ven.)
valx
Coavatnng los
Movecomeent key cark
Compo ALS bey oark
Zartfie
ALL oveoo
Tracos
Datiour: ARS-HD
Datneit: AFS-HI)
ARS-HD
Coo-camip Jan.
Moc correct Lee
cay
Thanning org
Thaiking step
Tiaoe 1000
Dotaret: ORAI
Dumsee:: ULAII
Gra-dtapp los
Dussen: OTP (1024-800
Dasaue:: OTP (1024-b83)
Conneetopy
Viacsing 4C2
Trazita 1ko
Figure 18: Training curves and attack performance of the supervised classifiers which are 'interpreted' by the deep learning baseline methods. (Left column) The training + validation cross-entropy loss vs. training steps for the supervised classifiers. (center column) The training + validation rank vs. training steps for the supervised classifiers. (right column) The rank of the correct key we accumulate predictions on the attack dataset for the supervised classifiers, which is a common way of evaluating attack performance in the side-channel literature. For reference, we superimpose the results using open-weighl classifiers provided by Benadjila et al. (2020) and Wouters et al. (2020). Note that our classifiers can successfully attack all datasets. They get comparable performance to the wein-w classifiers on ASCADv1-fixed, AsCrDvi-variable and DPAv4, and somewhat worse performance on AES-HD.
62

---

Published in Transactions on Machine Learning Research (03/2026)
Onacle apreement
Window
Window
Window
Sepposted
Edimuted kokitco
Estined loliness
Datuee: ASCADN
Dochsenn wendens
Timeseps
Timestop
Window
Window
Window
Dasset (vassa))
reveddiiis
poarpodted toant
of
30
Occlason wandow azze
Tinstep1
Timesto
Tincsop
agreement
Window
stnee
nuvedasis
Aoarpodid
Extinated Inckncaa
Exjanated teskineca
Occlason wandow a2o
Timestep
Timestop
Tinessop
auseement
since
recedadaa
Aogepoded ALL toan)
Edhitated teakiness of Xx
Dasect A15--11 155-111
Eairaatdd teakiners of
201
Occlason windm alze
Tinestep
Timeste
Tincsop sizc:
Oraele agseement
size:
recededaa
Aupgooted ALL feand
Patiraced luakitonn of XC
Exliaated Sclieadkkkatto kakites of X;
Ditac:: OTENT
of
Dochhenn windems don
Timeokpp
Timeskop
Thrroeop
Oncile agreement
Window
Window size:
siiee
poredesdas
Disand:: ORP (1024 100
pogie ALL fean)
Esuinddd Do
0.05
Ealental balkitech
(hockeco wrndims 436
Timmnokrg
Thereeorp
Figure 19: A sweep of the window size m for m-Occlusion. In the first column we plot the oracle agrecment v8. window size (red curve). For reference we also plot the output of ALL (blue curve) as we average-pool it with stride 1 and kernel size m. Note that ALL consistently outperforms m- m--Occlusion for a wide range of window sizes. In the second, third and fourth columns we plot the m-Occlusion leakiness assessment for m 1, optimal m, and maximum considered m. Observe that there smoothing effect as we increase m.
63

---

Published in Transactions on Machine Learning Research (03/2026)
Dataset: ASCADv1 (fixed)
Dataset: ASCADv1 (variable)
Dataset: DPAv4 (Zaid vsn.)
I
Oracle agreementt 1
0.8
Oracle agreement
Oracle agreement
0.4
0.1
0.2
0.0
AL1 toueo
Ghal
layor Crad
LRP
Saliowy
ALL (oars)
T-Qullsin
OOnkkiooon
Coal
Expas Goad
L80
Satiocy
ALL (wers)
41 Dhdinieo
/-Ockasio
Gul
Espar Grad
La9
Salancy
Dataset: AES-HD
Dataset: OTiAiT
Dataset: OTP (1024-bit)
08
Oracle agreement 1
Oracle agreement T
Oracle agrecment
aod-
0.1
0
0.0
0.0
-02
0.2
04
00
1I. Oodniep
VratVi
lopat Grad
LAT
Saleary
ALL (ears)
Ondeesoo
GrarVe
Jopat Grad
Salleayy
ALL (owrs)
Qulmica
GraVii
bppat Grnd
LAp
Saltanry
ALL
Figure 20: Distribution of performance of ALL and selected baseline methods during a 50-trial random hyperparameter search. Note that ALL generally outperforms baselines over a wide range of configurations. Blue dots denote individual samples, and boxes extend from first quartile to third quartile with line at the median and whiskers extending to the furthest dot lying within 1.5x the interquartile range from the box.
64

---

Published in Transactions on Machine Learning Research (03/2026)
Dataset: ASCADv1 (fixed)
Dataset: ASCADv1 (variable)
Dataset: DPAv4 (Zaid vsn.)
0.8
Oracle agreement 1
0.-
Oracle agreement
Oracle agreement
0.4
8
6.4
80
000
0.2
0.2-
0.2
0
0.1
0.0
0.0-
-02-
0.2
-04-
ALL AvgPnn
Al (ours)
ALl (moeperatie))
ALL (in (ntiinaa))
3-0rd heary despoot
1ddrd Reary deppoot
S- Aorinsi
ALL Aigholl
ALl (ourg)
ALL coopprativ)))
ALL (anc mnditt
7-0ed Heary dinpooo
1-Gel heary dispont
Costnsoo
ALL Arghoell4))
A tours)
ALL (corpenthe)
ALL (omoredittonn))
41-Geel Heary dinpooot
1-drel huary dispout
4 Crediinn
Dataset: AES-HD
Dataset: OTiAiT
Dataset: OTP (1024-bit)
0.4
Oracle agreenenn 1
088
Oracle agreement 1
0.8 6.0 0.4
Oracle agreement
6.6
0.2
o8
011
6.2
000
0.00
6.0
-022
-011
@
0.4
ALL AngFoal(1)
ALL (muns)
coopurativ))
tnttmnationll
31-Dked Hany dispeve
J-Cket Aetay dropee
ALL AngPodlC)
At cours)
ALL comperatiu))
ALL (ottonatiinn))
4iidd dropess
H-kkel diypont
ALL AngPoald)
AL (oum))
ALl Conperatio))
ALL (nitondiiannd)
S-Cked Baayy diyper
H-dkel Beany dropest
Figure 21: Ablation studics where we evaluate the influence of individual aspects of ALL on its performance gains relative to prior work, as described in Sec. E.3.7 These are plots of the distribution of oracle agreement values after a 50-trial random hyperparameter search with each ablation in place. 'ALL (ours)' denotes our method without modification. *ALL + AvgPool(m")) denotes an average-pooled version of ALL to mimic the smoothing effect of m ---Ccuusioon 'ALL (cooperative) denotes ALL with the adversarial objective replaced 'cooperative" objective where both the classifier and noise distribution
trained to maximize the performance of the classifier. 'ALL (unconditional) denotes ALL without the occlusion masks being fed as auxiliary inpul to the classifier. 'm--ccl + heavy dropout' denotes m- m--Occlsiion with the input dropout to the classifier chosen from {0.05, 0.1,..., 0.95) rather than {0.0, 0.1} as in our other experiments. 'm-Occlusion' denote the results with the unmodified m-Occlusion techniques.
65


Reviews:
[{"review_id": "MOHxZxa4eB", "reviewer": "Reviewer_8bB8", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper proposes a defense against side-channel attacks targeting physical implementations of cryptographic algorithms. The side-channel attack considered in this work aims at recovering secret variables of the scheme, such as cryptographic keys, by exploiting power and electromagnetic emission measurements from the cryptographic hardware. The proposed defense, called ALL, identifies, among a set of measurements, those that leak the most information, quantified through an arbitrary statistical association between the target information and the measurement at a given time. The leakiness of a measurement is defined via a constrained optimization problem, which is solved through the core deep learning algorithm underlying ALL, since solving it exactly would require exponential time in the number of measurements. Compared to state-of-the-art approaches, ALL is able to detect more subtle and complex leakages more accurately, while also accounting for redundancy among measurements in a sequence when computing leakiness.\n\nThe experimental evaluation is comprehensive, considering 11 baselines and 6 datasets. ALL often outperforms the baselines in terms of detecting leaky measurements. Moreover, the method is easy to tune and shows consistent performance across different parameter values.", "claims_and_evidence_yn": "Yes", "claims_explanation": "The experimental evaluation supports the effectiveness of ALL, that achieves strong results across different metrics. The experimental axes considered are numerous, including a clear example illustrating cases in which ALL succeeds while other algorithms fail, experiments demonstrating ability of ALL to detect the leakiness of specific components of the cryptographic pipeline and an important ablation study presented in the Appendix. Overall, the results are convincing with respect to the baselines and the paper does a good job of clearly stating the limitations of the approach (also discussed in the Appendix).", "audience_yn": "Yes", "audience_explanation": "The topic of this work embraces three different research areas: machine learning, cryptography, and computer security. These three components are equally represented and even though the main focus of the paper is a side-channel attack against cryptographic schemes, the authors do a very good job of providing the necessary background, allowing even an audience whose primary expertise is in AI or machine learning to fully appreciate the work. Therefore, I think that an interdisciplinary work like this may be of interest to the TMLR community because of its originality compared to contributions that are more narrowly focused on machine learning topics and it may also attract readers from other research communities to TMLR.", "requested_changes": "I propose the following suggestion to improve the presentation and strengthen the work:\n- I would consider moving part of Section 5.2 to the Appendix (such as the center and right subfigures of Figure 5 and their related discussion) and, instead, integrating more details from the Appendix about the Simulated AES-128 datasets experiment. Indeed, as far as I understand, this experiment is the one that shows that, in practice, it is possible to understand how and why the hardware leaks, since the ALL algorithm is applied while varying some components of the cryptographic implementation. In my opinion, this section is particularly important, given the motivations behind this work, and its content should be emphasized more, while the analysis of ALL’s performance under different hyperparameter settings or training steps can be delegated to the Appendix.", "broader_impact_concerns": "Nothing to signal.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "iwOlJxAecG", "reviewer": "Reviewer_ozmX", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The authors present Adversarial Leakage Localization (ALL), a deep learning algorithm designed to address a self-defined constraint optimization problem that quantifies leakage, specifically in the context of side-channel attacks against AES, ECC, and RSA implementations using power and electromagnetic measurements. They evaluate ALL against 11 methods across two second-order datasets and four first-order datasets.", "claims_and_evidence_yn": "Yes", "claims_explanation": "To the extent of my knowledge, the paper does not appear to make *bold* statements that lack empirical or rigorous evidence. It is clearly written, does not, to my knowledge, claim novelty over existing published work, and does not appear to re-implement ideas that have already been reproduced. I do share some concerns about the methodology, results and comparisons made to previous work, which I have attached in the requested changes section.", "audience_yn": "Yes", "audience_explanation": "The authors present a novel deep learning-based methodology in the domain of side-channel leakage localization. This work aligns with TMLR's scope, as it contributes to the understanding of the computational principles (specifically, leakage localization) through learning (given their deep learning-based approach). As such, it would likely be of interest to at least some individuals in the audience.", "requested_changes": "- **[5.Results]:** In the main section of the paper, the authors employ a scalar representation of oracle agreement as the primary method for evaluating results. This approach could raise some concerns, considering that, as the authors acknowledge, there is no established consensus on how to evaluate leakage localization algorithms and that this particular evaluation method is introduced by the authors themselves. While the method is novel, since it also appears to favor their work, I recommend incorporating the data from other methodologies (for example, Tables 11, 12, and 13, Appendix, E.3.6) to provide a more comprehensive and balanced perspective.\n\n- **[General]:** Please address consistency in naming conventions. \"input * grad\" is also referred to as \"input * gradient\" and \"Input * grad\". \"Saliency\" is also referred to as \"saliency\". \"Second-order\" is sometimes referred to as \"2nd-order\".\n\n- **[5.Results]:** It seems that ASCADv1 is the only second-order dataset used. Could you please elaborate on the decision to use only this dataset?\n\n- **[5.2, Figure 5, E.3.8]**: It would be helpful to provide additional context regarding the conditions under which comparisons between methods are conducted. It should be intuitive to the reader that these evaluations enable a fair comparison, despite differences in the underlying methodologies. As noted in section E.3.8, all methods except for ALL (and supervised training) are used to \"interpret\" a pre-trained supervised classifier, while ALL is not. Because of this, Figure 5 may initially seem unintuitive. Could you please expand on and clarify these points?\n\n- **[5.2, Figure 5]:** I would recommend using a different color for 1-occlusion and m*-occlusion.\n\n- **[4.3]:** Consider the claims: \"our method can detect the second-order leakage (...) the first-order parametric methods cannot\" and similarly, “first-order parametric methods completely fail in this setting because they are not sensitive to the second-order associations\". The limitations of first-order parametric methods are well-established and were clearly pointed out in the introduction. Given the known inherent differences, I believe it should be avoided to reinstate these limitations to create a favorable comparison to ALL.\n\n- **[Suggestion]:** I suggest using a different LaTeX font style for ALL (\\textsc{ALL}, \\textsf{ALL}, \\texttt{ALL}, \\emph{ALL}). Often, \"all\" serves as a natural continuation within a sentence, and using all caps may even be justified occasionally for emphasis. In the first few sections, this differentiation is important, as it can be confusing for readers to discern whether references are made to \"Adversarial Leakage Localization\" or simply to an emphasized \"all\" word. I never encountered a section where the answer was not intuitive (or it was not ALL, the paper's method), but it did naturally make me do a couple \"double takes\" on some occasions.", "broader_impact_concerns": "I find the Broader Impact Statement to be generally accurate in its intent. However, I would argue that while the work is defensive in nature, algorithms that improve the identification of any system's weaknesses (such as leakage) do ultimately formally increase capabilities of attackers, regardless of the authors' intentions or the permissibility of the threat model (profiling). Nevertheless, I concur with the authors' assertion that \"there are limited avenues to directly exploit this work for malicious purposes\".", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "KPkRN3NATU", "reviewer": "Reviewer_g2z4", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "1. The authors have proposed a deep-learning-based novel algorithm for localizing side-channel leakage from cryptographic implementations, while also introducing a principled information-theoretic quantity for measuring the ‘leakiness’.\n\n2. Wide experimental comparisons are conducted, including multiple baselines and benchmark datasets.\n\n3. The code is provided.\n\n4. Extend versions of background/related work/method introductions, etc, are provided in the appendix.", "claims_and_evidence_yn": "Yes", "claims_explanation": "The wide empirical evaluations on multiple datasets and across various baselines demonstrate the improved performance of the proposed method. My question here is how could the authors ensure that the comaprisons are fair?", "audience_yn": "Yes", "audience_explanation": "This work aims to develop a deep-learning-based method to localize leakage of cryptographic sensitive variables, which is a valued practical application of machine learning algorithms.", "requested_changes": "1. The paper uses a relatively complex system of symbols. The authors have tables of symbols in the appendix. Would it be better to move (part of) the tables into the main body and also include the dimensions of the symbols  (where applicable)?\n\n2. The authors use Eq.(3) for re-parameterization invovling sigmoid function. As one of the properties of the sigmoid function is the startution effect, will it also influence the algorithm?\n\n3. Do the authors have insights into the complexity of the proposed method (e.g., comparing with others or the scalability of larger and more complex problems)?", "broader_impact_concerns": "N/A", "additional_comments": "I have to admit that I do not have strong expertise in this specific subfield. As such, my review focuses on general clarity, methodological soundness, and logical consistency rather than deep domain-specific technical details", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)