## 8 Results
### Stopping Condition  
In our second experiment, we decided to observe how the correctness changed throughout the iterations. The predicted key candidates were used in the next iteration as training labels for newly initialized neural networks. Just like in [17], we observed that the longer the framework runs, the fewer bits change in all key candidates between iterations. Therefore, we monitored the hamming distance (HD) between consecutive key candidates to see whether the framework converges to any particular solution. Since there are 54 candidates, each 230 bits long, the maximal cumulative hamming distance is 12,420. If all key candidates do not change between the iterations, the cumulative hamming distance is 0 and the framework stops. We have reported the maximal correctness of the last iteration (with a cumulative hamming distance of 0) for both designs in Table 3. We have also included the SVM results from [17] although the results between the first and last rounds of SVM did not differ. In the first row, we show the initial correctness of the horizontal attack, just like in Table 2, and the correctness in the last iteration. We have also reported how many iterations were needed to achieve no change between consecutive key candidates for all ANNs. Both tables are connected in the following way: we have taken all \(\lambda\) parameters and reported the results after the first iteration in Table 2. We continued the training until the cumulative hamming distance was equal to zero and reported the result of the last iteration in Table 3. Table 2 includes all \(\lambda\) parameters, and we have marked the best parameters with a bold font. Only those best parameters are later shown in Table 3. Since the attack was fully unsupervised, we tried out all \(\lambda\) parameters reported previously in Table 2, but only summarized the best results in Table 3. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multicolumn{2}{c}{**Analyzed Trace**} & \multicolumn{1}{c}{**Method**} & \multicolumn{1}{c}{**0.001**} & \multicolumn{1}{c}{**0.1**} & \multicolumn{1}{c}{**0.1**} & \multicolumn{1}{c}{**1**} & \multicolumn{1}{c}{**10**} \\ \hline \multirow{8}{*}{\begin{tabular}{c} Design\_seq \\ (FFGA) \\ \end{tabular} } & \multicolumn{4}{c}{96\%} \\ \cline{2-7}  & SVM C = 0.3 & & & 100\% & & \\ \cline{2-7}  & scikit-learn L2 & & 96\% & & & **100\%** \\ \cline{2-7}  & tensorflow L2 & 96\% & & 98\% & **100\%** & 98\% \\ \cline{2-7}  & tensorflow L1 & 96\% & 99\% & 52\% & 57\% & 52\% \\ \hline \multirow{8}{*}{\begin{tabular}{c} Design\_Seq \\ (FPGA) \\ \end{tabular} } & \multicolumn{4}{c}{88\%} \\ \cline{2-7}  & SVM C = 0.3 & & 99\% & & \\ \cline{2-7}  & scikit-learn L2 & & 88\% & & **94\%** \\ \cline{2-7}  & tensorflow L2 & 88\% & & 91\% & **97\%** & 69\% \\ \cline{2-7}  & tensorflow L1 & **88\%** & & 53\% & 52\% & \\ \hline \multirow{8}{*}{\
\begin{tabular}{c} Design\_ultra \\ (ASIC) \\ EMT \\ \end{tabular} } & \multicolumn{4}{c}{75\%} \\ \cline{2-7}  & SVM C = 0.3 & & 90\% & & \\ \cline{2-7}  & scikit-learn L2 & & 75\% & & **82\%** \\ \cline{2-7}  & tensorflow L2 & 75\% & & 77\% & 84\% & **86\%** \\ \cline{2-7}  & tensorflow L1 & **75\%** & & 55\% & 56\% & 58\% \\ \hline \multirow{8}{*}{
\begin{tabular}{c} Design\_ultra \\ (ASIC) \\ PT \\ \end{tabular} } & \multicolumn{4}{c}{74\%} \\ \cline{2-7}  & SVM C = 0.3 & & 89\% & & \\ \cline{2-7}  & scikit-learn L2 & & 74\% & & **81\%** \\ \cline{2-7}  & tensorflow L2 & 74\% & & 76\% & 80\% & **84\%** \\ \cline{2-7}  & tensorflow L1 & 74\% & **75\%** & 63\% & 52\% & 62\% \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Correctness of the best extracted key candidate after one iteration of the framework. The SVM classification is just given for comparison. Similar to the results presented in Table 2, the percentages of correctly guessed bits in the best-performing key candidate have been reported. The higher a percentage is, the lower the remaining brute-force complexity needed to uncover the real secret scalar is.