Source-linked AI summary
A Simple Transformer Pipeline for Full-Key Side-Channel Attacks on Uncropped Datasets
Jimmy Gammell, Kaushik Roy
TL;DR
The paper addresses the lack of a simple baseline for simultaneous full-key attacks on uncropped side-channel traces. It presents an open-source transformer pipeline that adapts only the input and output layers around a standard encoder, with released recipes and weights achieving competitive performance across three datasets. The study also reports resource measurements and limits its claims to the evaluated setting.
Problem
Prior side-channel work often targets one byte and manually crops traces, while the literature lacks a simple standard-transformer baseline for simultaneous full-key attacks on uncropped traces.
Method
The paper uses a standard pre-norm transformer encoder with trace patches as input tokens and one learned output token per targeted byte, predicting all 16 bytes jointly.
Results
Competitive performance is reported on uncropped ASCADv1f, ASCADv1r, and CHES-CTF-2018, with comparable or better reported metrics across all three datasets.
Takeaways & Limitations
The released implementation, training recipes, and pretrained weights provide a simple, reproducible baseline for researchers studying uncropped full-key attacks.
Takeaways & Limitations
Experiments cover only profiled attacks on first-order masked AES-128 targeting the first SubBytes output, and prior-work comparisons do not control compute or tuning budgets.
Abstract
from arXiv · showhide
Deep learning-based side-channel analysis has historically focused on single-byte targets and manually cropped traces, which risks discarding exploitable leakage. While recent work has proposed specialized architectures and resampling techniques to address this gap, the literature lacks a simple transformer baseline for simultaneous full-key attacks on uncropped traces. We present an open-source transformer implementation for uncropped full-key attacks which uses the standard transformer encoder backbone, adapting only the input and output layers to the side-channel setting. We release our implementation, training recipes, and pretrained weights for uncropped ASCADv1f, ASCADv1r, and CHES-CTF-2018 which achieve performance competitive with previously-reported results, while using less than 10GB of VRAM and requiring at most 3.34 hours of training on a single NVIDIA A6000.
1 Introduction
The paper addresses the lack of simple, full-key transformer baselines for uncropped side-channel traces. It releases an open-source implementation, recipes, and pretrained weights intended to support reproducible uncropped attacks.
- Problem: Single-byte targets and manual trace cropping dominate prior DLSCA, risking the loss of exploitable leakage outside selected regions.The paper frames full-execution testing as useful when designers cannot assume where leakage occurs.
- Problem: Recent work handles multiple bytes or long and raw traces, but often uses specialized architectures, leaving no simple unchanged-backbone baseline for simultaneous full-key uncropped attacks.The paper identifies this as the specific gap addressed by the artifact.
- Contribution: The artifact provides an installable PyTorch transformer pipeline for full-key attacks on uncropped traces without manual feature selection or cropping.The release adapts the standard approach to the side-channel setting while retaining the intended uncropped workflow.
- Contribution: Weights are released for uncropped ASCADv1f, ASCADv1r, and CHES-CTF-2018, with performance competitive with previously reported results.The release also includes training recipes and positions the artifact as a baseline for future architectures.
- Contribution: The artifact offers an open-source case study, reference implementation, and reproducible benchmark results for standard deep learning on public uncropped side-channel datasets.Its intended users include researchers seeking pretrained models, an extensible backbone, or a reproducible baseline.
2 Artifact overview
The artifact combines a standard transformer encoder with side-channel-specific input and output layers, then evaluates full-key performance using metrics that distinguish byte-level from joint-key success.
- Repository: The repository separates dataset preprocessing, model architectures, training infrastructure, experiment entrypoints, and evaluation metrics.The listed evaluation metrics are accuracy, rank, and minimum traces to disclosure (MTD).
- Architecture: The pipeline divides traces into contiguous patches, projects them into token embeddings, appends one learned output token per target byte, and predicts byte logits after transformer encoding.A single transformer predicts all 16 bytes of the first SubBytes output.
- Architecture: The model uses a standard pre-norm transformer encoder with rotary position embeddings, modifying only the input and output layers for side-channel data.This design leaves the transformer backbone largely unchanged.
- Training: Training uses AdamW, warmup followed by cosine annealing, mean cross-entropy across target bytes, batch size 256, gradient clipping, standardization, and a 20% validation split.Weight decay is applied to linear weights rather than biases, and trace statistics come from the profiling set.
- Evaluation: Full-key accuracy is not determined uniquely by per-byte accuracy, so the artifact reports both per-byte and full-key performance.The passage gives bounds linking joint accuracy to individual byte accuracies and similarly reports full-key and per-byte MTDs.
3 Experimental results
The pipeline is evaluated on three uncropped side-channel datasets and achieves comparable or better reported performance across all three. The paper also reports training-resource measurements under recommended settings.
- Datasets: The evaluation covers ASCADv1-fixed, ASCADv1-variable, and CHES-CTF-2018.The models are compared with results reported in prior work under corresponding targets and metrics.
- Attack performance: Comparable or better performance is achieved on the reported metrics across all three datasets, establishing that the released models are competitive.The comparison is presented in Table 2 against prior work.
- Computational cost: Parameter count, FLOPs, peak GPU memory, and wall-clock time are reported for each training run under the recommended hyperparameters.Wall-clock measurements use a system with an NVIDIA A6000 GPU, AMD Ryzen Threadripper PRO 5965WX CPU, and 128GB RAM.
4 Limitations
The evaluation is limited to profiled attacks on first-order masked AES-128 implementations targeting 16 first SubBytes-output bytes, and broader settings remain unevaluated. Comparisons do not isolate pipeline superiority because compute and tuning budgets are unmatched, while filesystem-based loading can substantially increase training time.
- Scope: The experiments cover only profiled attacks on first-order masked AES-128 implementations targeting the 16 bytes of the first SubBytes output.Performance in other settings remains to be evaluated.
- Comparative evidence: Unmatched compute and hyperparameter-tuning budgets prevent the comparisons from establishing that the pipeline itself is superior.Observed differences may reflect architecture, input features, tuning, regularization, or jointly predicting multiple bytes.
- Comparative evidence: Performance differences may stem from architecture differences, more input features, hyperparameter tuning, or regularization from jointly predicting multiple bytes.These factors are not independently isolated in the reported comparisons.
- Reproducibility and resources: Repeated filesystem loading can make data loading a bottleneck and substantially increase training time.The experiments used machines with sufficient RAM to cache the full datasets in the operating system.