🤖 AI

Beyond TVLA: Anderson-Darling Leakage Assessment for Neural Network Side-Channel Leakage Detection

This paper proposes Anderson-Darling Leakage Assessment (ADLA), a framework that outperforms the standard TVLA method in detecting side-channel leakage in protected neural network implementations by utilizing the Anderson-Darling test to identify full distributional differences rather than relying solely on mean shifts.

Original authors: Ján Mikulec, Jakub Breier, Xiaolu Hou

Published 2026-03-20

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Ján Mikulec, Jakub Breier, Xiaolu Hou

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a security guard trying to catch a spy who is sneaking into a secure building. The spy isn't leaving footprints (which are easy to see); instead, they are changing the vibe of the room slightly every time they enter.

This paper is about a new, sharper pair of "security glasses" that can spot these subtle changes, whereas the old glasses were only looking for footprints.

Here is the breakdown of the paper using simple analogies:

1. The Setting: Neural Networks as Secret Agents

Modern devices (like your phone or a car) are starting to use Neural Networks (AI brains) to make decisions. These AI brains are like secret agents working inside a locked room.

The Problem: Even though the AI is doing math inside a black box, it leaks information. When it calculates something, it uses a tiny bit of extra electricity.
The Attack: A hacker can measure these tiny power fluctuations. If the AI is thinking about a "1," it might use slightly more power than if it's thinking about a "0." By measuring this, the hacker can steal the secret keys or the data the AI is processing.

2. The Old Tool: TVLA (The "Average" Detective)

For years, security experts have used a standard tool called TVLA (Test Vector Leakage Assessment).

How it works: Imagine you have two groups of people: Group A (who are thinking "1") and Group B (who are thinking "0"). The TVLA detective looks at the average power consumption of both groups.
The Flaw: If Group A averages 100 watts and Group B averages 100 watts, the detective says, "No leak! They are the same."
The Reality: But what if Group A is mostly 100 watts, but occasionally spikes to 200? And Group B is mostly 100, but occasionally drops to 0? The average is still 100 for both, so the old detective misses the leak. The "shape" of the data is different, even if the "center" is the same.

3. The New Tool: ADLA (The "Shape" Detective)

The authors of this paper, Ján, Jakub, and Xiaolu, created a new tool called ADLA (Anderson–Darling Leakage Assessment).

How it works: Instead of just looking at the average, ADLA looks at the entire shape of the data. It asks: "Do these two groups of power measurements look like they came from the exact same distribution?"
The Metaphor: Imagine two bags of marbles.
- TVLA weighs the bags. If they weigh the same, it assumes the bags are identical.
- ADLA pours the marbles out and looks at the pattern. It might see that Bag A has mostly small marbles with a few giant ones, while Bag B has mostly medium marbles. Even if the total weight is the same, ADLA screams, "These are different!"

4. The "Countermeasures" (The Spy's Disguise)

To stop hackers, engineers use tricks called Countermeasures.

Shuffling: Imagine the AI does its math in a random order, like shuffling a deck of cards before dealing. This confuses the hacker's timing.
Jitter: Imagine the AI adds random pauses (like a stutter) to its work. This makes the power spikes happen at different times, blurring the signal.

These tricks are very good at hiding the average power difference. They make the "footprints" disappear. This is why the old TVLA tool often fails against modern, protected AI systems.

5. The Experiment: Who Wins?

The researchers tested both tools on a real AI running on a chip (a ChipWhisperer).

The Setup: They protected the AI with Shuffling and Jitter.
The Result:
- TVLA looked at the data and said, "I see no difference. The averages match. The system is safe."
- ADLA looked at the data and said, "I see a difference! The shape of the power usage is different. The system is leaking!"
The Efficiency: ADLA found the leak using fewer measurements (traces). This is like finding a needle in a haystack after looking at only 100 pieces of hay, while the old tool needed to look at 1,000 pieces and still missed it.

6. Why This Matters (The "So What?")

For Security Labs: Testing security is expensive and time-consuming. If you can find leaks faster (with fewer traces), you save money and time.
For the Future: As AI gets more complex and hackers get smarter, relying on "average" checks isn't enough. We need tools that understand the full "personality" of the data, not just its height.

Summary Analogy

Imagine you are trying to tell if two singers are singing the same song.

TVLA listens to the average volume. If both singers are loud on average, TVLA thinks they are singing the same thing.
ADLA listens to the entire melody and rhythm. It realizes that even if the volume is the same, one singer is hitting high notes while the other is humming low notes.
The Paper's Conclusion: In the world of AI security, the "melody" (the distribution) often leaks secrets even when the "volume" (the average) is perfectly hidden. ADLA is the tool that finally lets us hear that melody.

1. Problem Statement

The rapid deployment of neural networks (NNs) on embedded and edge devices has increased their exposure to physical side-channel attacks (SCA). While standard countermeasures like shuffling and random jitter are used to protect these implementations, they often obscure traditional leakage signatures.

The current de facto standard for leakage assessment is Test Vector Leakage Assessment (TVLA), which relies on Welch's t-test. TVLA is a mean-based statistical test; it detects leakage by identifying significant differences in the average power consumption between two sets of traces (e.g., corresponding to different input values).

The Limitation: Countermeasures like shuffling and jitter effectively randomize execution timing and order, often eliminating mean shifts while leaving higher-order distributional differences (e.g., variance, skewness, tail behavior) intact. Consequently, TVLA may fail to detect leakage in protected implementations because it is insensitive to non-mean distributional changes.
The Gap: There is a need for a leakage assessment methodology that evaluates the entire distribution of side-channel traces rather than just the mean, specifically tailored for the complex, non-linear nature of neural network implementations.

2. Methodology: Anderson–Darling Leakage Assessment (ADLA)

The authors propose ADLA, a framework that replaces the mean-based Welch's t-test with the two-sample Anderson–Darling (A-D) test.

Statistical Foundation

Null Hypothesis ( $H_0$ ): The side-channel leakage distributions for two different input conditions are identical ( $F_X = F_Y$ ).
Alternative Hypothesis ( $H_1$ ): The distributions differ ( $F_X \neq F_Y$ ).
The Test Statistic: Unlike the t-test which compares means ( $\mu_x$ vs $\mu_y$ ), the A-D test compares the Cumulative Distribution Functions (CDFs) of the two samples. It is a non-parametric test sensitive to differences in location, scale, and shape (including tails).
The statistic $A^2$ is calculated as:
$A^2 := \frac{1}{n^2} \sum_{i=1}^{2n-1} \frac{(2nM_i - n_i)^2}{i(2n - i)}$
Where $M_i$ is the count of observations from the first sample less than or equal to the $i$ -th ordered value in the pooled sample.

Threshold Derivation

To make ADLA practical for engineering evaluations, the authors derived a specific decision threshold ( $\tau_A$ ) comparable to the standard TVLA threshold ( $\tau_t = 4.5$ ).

They adopted the same significance level as standard TVLA: $\alpha \approx 3.4 \times 10^{-6}$ .
Since the limiting distribution of the A-D statistic does not have a closed-form expression, the authors used Pearson curve fitting based on the first four cumulants of the limiting distribution to numerically approximate the critical value.
Resulting Threshold: $\tau_A \approx 11.99$ .

Experimental Setup

Target: A Multilayer Perceptron (MLP) trained on the MNIST dataset, implemented on an Atmel SAM4S (ARM Cortex-M4) microcontroller.
Countermeasures: The implementation utilized shuffling (randomizing multiplication order) and random jitter (inserting pseudo-random delays).
Data Acquisition: Power traces were captured using a ChipWhisperer-Husky platform.
Procedure: Two sets of traces were collected by varying the value of a specific input neuron while keeping others constant. The ADLA and TVLA statistics were computed for each time sample.

3. Key Contributions

Introduction of ADLA: A novel leakage assessment framework for neural networks based on the two-sample Anderson–Darling test, designed to detect leakage beyond simple mean shifts.
Threshold Derivation: The derivation of a practical detection threshold ( $\tau_A \approx 11.99$ ) that aligns with the strict significance levels used in standard TVLA, enabling direct comparison and adoption in certification workflows.
Empirical Validation: Experimental proof that ADLA outperforms TVLA in detecting leakage in protected neural network implementations, particularly when the number of traces is low.

4. Results

The authors evaluated the framework using three different pairs of fixed input values on the protected MLP implementation.

Sensitivity: ADLA demonstrated significantly higher sensitivity than TVLA. In several test cases, ADLA detected statistically significant leakage with fewer traces than required by TVLA.
Failure of TVLA: In a representative experiment with $n=850$ traces, the TVLA statistic ( $|t|$ ) remained below the threshold of 4.5 across the entire trace, failing to detect leakage. Conversely, the ADLA statistic ( $A^2$ ) exceeded its threshold of 11.99 at specific time samples, successfully identifying the leakage.
Distribution Analysis: Quantile-Quantile (Q-Q) plots confirmed that the leakage distributions were non-Gaussian. The empirical quantiles deviated significantly from the normal reference line, explaining why the mean-based t-test (which assumes normality) failed to capture the leakage, while the distribution-based A-D test succeeded.
Margin of Detection: The normalized ADLA statistics ( $A^2/\tau_A$ ) exceeded the threshold by a much larger factor than the normalized TVLA statistics ( $|t|/\tau_t$ ), indicating that the leakage is characterized by broad distributional differences rather than simple mean shifts.

5. Significance and Practical Relevance

Efficiency in Evaluation: Improved sensitivity at low trace counts translates directly to shorter acquisition campaigns and reduced measurement costs. This is critical for certification laboratories where time-to-result is a bottleneck.
Robustness Against Countermeasures: As neural network implementations increasingly adopt shuffling and jitter to defeat standard attacks, ADLA provides a necessary tool to verify that these countermeasures are actually effective. It prevents a "false negative" scenario where an implementation is deemed secure by TVLA but remains vulnerable to attacks exploiting higher-order statistical properties.
Future Directions: The paper suggests that leakage points identified by ADLA could be exploited by higher-order attacks (e.g., Higher-Order CPA), motivating further research into exploiting non-mean leakage signatures. It also notes that while $\chi^2$ -type tests exist, they are currently too sensitive to binning choices for this specific application, reinforcing the utility of the continuous-distribution approach of ADLA.

In conclusion, the paper argues that for modern, protected neural network implementations, distribution-sensitive assessment (ADLA) is superior to mean-based assessment (TVLA), offering a more rigorous and efficient method for side-channel security evaluation.